Documentation
¶
Overview ¶
Package emulation runs adversary emulation (issue #421) as a SUBSET of the exploitation machine's guarantees, never a looser path.
Each technique is admitted through the very same StepAdmitter the exploitation chains use — which consults the #418 offensive policy — and executed through the same sandboxed StepExecutor. What differs is the goal: emulation prefers a benign proof of the observable over a real effect, and its output is a coverage record (executed, expected detection, actual detection, gap), the offensive half of the purple ledger #426 consumes.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Options ¶
type Options struct {
// AllowLabOnly opts in to techniques that are not production-safe (no benign variant). Without it,
// a non-production-safe technique is refused before admission and recorded not-executed — a lab-only
// technique must never run against a customer estate by default.
AllowLabOnly bool
}
Options controls a run.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service executes emulation runs. It holds the SAME admitter and executor types the exploitation machine uses, so there is no second, looser admission path — an emulation technique goes through the identical governance gate.
func NewService ¶
func NewService(admit exploituc.StepAdmitter, exec exploituc.StepExecutor, store RunStore, audit ports.AuditLogger, clock ports.Clock, ids ports.IDGenerator) (*Service, error)
NewService validates its dependencies.
func (*Service) Emulate ¶
func (s *Service) Emulate(ctx context.Context, tenantID, engagementID, target shared.ID, actor string, opts Options) (demu.Run, error)
Emulate runs every catalogued technique against the target and returns the coverage run.
A technique never omitted: whether it is refused (lab-only without opt-in, or refused by the policy) or executes, it produces a coverage record. Actual detection is left empty here — matching expected against actual completes once the #422 detection engine exists — so an executed technique is a gap, which is the honest "coverage unproven" state rather than an assumed-clean one.
Source Files