MITRE Caldera

Reference for the Tracecat MITRE Caldera integration: registered actions, required secrets, expected inputs, and example workflow usage.

Add link to operation

Action ID: tools.caldera.add_operation_link

Queue an ability on an existing Caldera operation.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

ability_executor · string · required

Executor name to run the ability with (e.g. windows, linux, darwin).

ability_id · string · required

Ability ID to add to the operation.

operation_id · string · required

Operation ID to update.

paw · string · required

Agent PAW that should run the ability.

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

Caldera health check

Action ID: tools.caldera.health_check

Query the Caldera REST API health endpoint.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

Create adversary

Action ID: tools.caldera.create_adversary

Create a new Caldera adversary profile.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

description · string · required

Description of the adversary.

name · string · required

Name for the adversary.

atomic_ordering · array[string]

Ordered list of ability IDs for the adversary playbook.

Default: [].

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

plugin · string

Plugin that owns the adversary.

Default: "stockpile".

tags · array[string]

Optional tags to assign.

Default: [].

Create Linux ability

Action ID: tools.caldera.create_linux_ability

Create a Caldera stockpile ability that runs on Linux agents.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

command · string · required

Shell command to execute on the agent.

description · string · required

Ability description.

name · string · required

Ability name.

tactic · string · required

MITRE ATT&CK tactic (e.g. discovery, collection).

technique_name · string · required

MITRE ATT&CK technique name.

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

delete_payload · boolean

Delete payloads from the agent after execution.

Default: true.

payloads · array[string]

Optional payload files required by the ability.

Default: [].

privilege · string

Privilege level required to run the ability (blank for default).

Default: "".

repeatable · boolean

Whether the ability can run repeatedly on the same agent.

Default: false.

technique_id · string | null

Optional MITRE ATT&CK technique ID (e.g. T1059.004).

Default: null.

timeout · integer

Command timeout in seconds.

Default: 60.

Create operation

Action ID: tools.caldera.create_operation

Create a Caldera operation from an existing adversary profile.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

adversary_id · string · required

Adversary ID whose abilities should be executed.

name · string · required

Operation name.

auto_close · boolean

Whether to automatically close the operation when finished.

Default: false.

autonomous · integer

Autonomous mode value (0 = manual, 1 = full autonomous).

Default: 1.

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

group · string

Optional group assignment for the operation.

Default: "".

jitter · string

Sleep jitter value (format min/max seconds).

Default: "2/4".

obfuscator · string

Obfuscator to use for commands.

Default: "plain-text".

objective_id · string

Objective ID the operation should satisfy.

Default: "495a9828-cab1-44dd-a0ca-66e58177d8cc".

planner_id · string

Planner ID to use when scheduling the operation.

Default: "aaa7c857-37a0-4c4a-85f7-4e9f7f30e31a".

source_id · string

Source ID for fact collection.

Default: "ed32b9c3-9593-4c33-b0db-e2007315096b".

state · string

Initial operation state (e.g. running, paused, finished).

Default: "paused".

use_learning_parsers · boolean

Whether to enable learning parsers during the run.

Default: true.

visibility · integer

Visibility score for the operation.

Default: 51.

Create Windows ability

Action ID: tools.caldera.create_windows_ability

Create a Caldera stockpile ability that runs on Windows agents.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

command · string · required

Exact PowerShell command to execute.

description · string · required

Ability description.

name · string · required

Ability name.

tactic · string · required

MITRE ATT&CK tactic (e.g. discovery, execution).

technique_name · string · required

MITRE ATT&CK technique name.

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

delete_payload · boolean

Delete payloads from the agent after execution.

Default: true.

payloads · array[string]

Optional payload files required by the ability.

Default: [].

privilege · string

Privilege level required to run the ability (blank for default).

Default: "".

repeatable · boolean

Whether the ability can run repeatedly on the same agent.

Default: false.

technique_id · string | null

Optional MITRE ATT&CK technique ID (e.g. T1059.001).

Default: null.

timeout · integer

Command timeout in seconds.

Default: 60.

Get ability

Action ID: tools.caldera.get_ability

Retrieve a Caldera ability by ID.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

ability_id · string · required

Ability ID to fetch.

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

Get adversary

Action ID: tools.caldera.get_adversary

Retrieve a Caldera adversary by ID.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

adversary_id · string · required

Adversary ID to fetch.

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

Get agent

Action ID: tools.caldera.get_agent

Retrieve a Caldera agent by PAW.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

paw · string · required

Agent PAW identifier.

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

Get link result

Action ID: tools.caldera.get_operation_link_result

Retrieve the result payload for a specific Caldera link.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

link_id · string · required

Link ID to fetch.

operation_id · string · required

Operation ID that contains the link.

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

Get operation

Action ID: tools.caldera.get_operation

Retrieve a Caldera operation by ID.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

operation_id · string · required

Operation ID to fetch.

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

Get operation link

Action ID: tools.caldera.get_operation_link

Retrieve a specific link from a Caldera operation.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

link_id · string · required

Link ID to fetch.

operation_id · string · required

Operation ID that contains the link.

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

List abilities

Action ID: tools.caldera.list_abilities

List all Caldera abilities.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

List adversaries

Action ID: tools.caldera.list_adversaries

List Caldera adversaries.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

List agents

Action ID: tools.caldera.list_agents

List all Caldera agents (alive or dead).

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

List operation links

Action ID: tools.caldera.list_operation_links

List links for a specific Caldera operation.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

operation_id · string · required

Operation ID to inspect.

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

List operations

Action ID: tools.caldera.list_operations

List all Caldera operations.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.

List payloads

Action ID: tools.caldera.list_payloads

List uploaded payloads from Caldera.

Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

Secrets

Required secrets:

• caldera: required values CALDERA_API_KEY.

Input fields

base_url · string | null

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: null.