splunk · Sep 4, 2024 · Sep 4, 2024 · Sep 4, 2024 · Sep 4, 2024 · Sep 6, 2024
diff --git a/configs/attack_range_default.yml b/configs/attack_range_default.yml
@@ -8,6 +8,8 @@ general:
   key_name: "attack-range-key-pair"
   # The key name is the name of the AWS key pair and at the same time an unique identifier for Attack Ranges.
 
+  name_prefix: "ar"
+
   attack_range_name: "ar"
   # Attack range Name let you build multiple Attack Ranges by changing this parameter.
 
@@ -67,7 +69,23 @@ aws:
   # Specify the already created S3 bucket in the same region
 
   tf_remote_state_dynamo_db_table: "test"
-# Specify the already created DynamoDB table in the same region
+  # Specify the already created DynamoDB table in the same region
+
+  domain_controller_ip: "10.0.1.20"
+  network_cidr: "10.0.1.0/24"
+  create_vpc: "0"
+  # Enable/disable creation of VPC by setting this to 1 or 0.
+
+  first_dynamic_ip: 14
+  bastion_host_ip: "10.0.1.17"
+
+  vpc_id: ""
+  public_subnet_id: ""
+  alt_subnet_id: ""
+  private_subnet_id: ""
+  # VPC ID and subnet arn for byo vpc in AWS.
+
+  windows_ami: ""
 
 azure:
   location: "West Europe"
@@ -97,7 +115,6 @@ local:
 # Attack Range Local used Virtualbox and Vagrant to build the Attack Range.
 
 splunk_server:
-
   install_es: "0"
   # Enable/Disable Enterprise Security by setting this to 1 or 0.
 
@@ -107,6 +124,9 @@ splunk_server:
   s3_bucket_url: "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com"
   # S3 bucket containing the Splunk Apps which will be installed in Attack Range.
 
+  s3_bucket_prefix: "attack_range"
+  # S3 bucket prefix containing the Splunk apps
+
   splunk_url: "https://download.splunk.com/products/splunk/releases/9.3.0/linux/splunk-9.3.0-51ccf43db5bd-Linux-x86_64.tgz"
   # Url to download Splunk Enterprise.
 
@@ -123,8 +143,8 @@ splunk_server:
     - cisco-secure-endpoint-formerly-amp-for-endpoints-cim-add-on_212.tgz
     - cisco-secure-endpoint-formerly-amp-for-endpoints_300.tgz
     - palo-alto-networks-add-on-for-splunk_813.tgz
-    - punchcard---custom-visualization_150.tgz
-    - python-for-scientific-computing-(for-linux-64-bit)_421.tgz
+    - punchcard-custom-visualization_150.tgz
+    - python-for-scientific-computing-for-linux-64-bit_421.tgz
     - snort-alert-for-splunk_111.tgz
     - snort-3-json-alerts_105.tgz
     - splunk-add-on-for-amazon-web-services-(aws)_770.tgz
@@ -143,11 +163,11 @@ splunk_server:
     - splunk-common-information-model-(cim)_532.tgz
     - splunk-es-content-update_4400.tgz
     - splunk-machine-learning-toolkit_542.tgz
-    - splunk-sankey-diagram---custom-visualization_160.tgz
+    - splunk-sankey-diagram-custom-visualization_160.tgz
     - splunk-security-essentials_380.tgz
-    - splunk-timeline---custom-visualization_162.tgz
+    - splunk-timeline-custom-visualization_162.tgz
     - splunk_attack_range_reporting-1.0.9.tar.gz
-    - status-indicator---custom-visualization_150.tgz
+    - status-indicator-custom-visualization_150.tgz
     - ta-for-zeek_108.tgz
     - vmware-carbon-black-cloud_222.tgz
   # List of Splunk Apps to install on the Splunk Server
@@ -162,14 +182,21 @@ splunk_server:
   # Ingest BOTS data to Attack Range.
 
   install_dltk: "0"
-# Install Deep Learning Toolkit.
+  # Install Deep Learning Toolkit.
+
+  instance_profile_name: ""
+
+  role_arn: ""
+  # Role ARN generated by IAM
+
+  splunk_server_ip: "10.0.1.12"
 
 phantom_server:
   phantom_server: "0"
   # Enable/Disable Phantom Server
 
   phantom_app: "splunk_soar-unpriv-6.2.2.134-8f694086-el8-x86_64.tgz"
-  # name of the Splunk SOAR package located in apps folder. 
+  # name of the Splunk SOAR package located in apps folder.
   # aws: Make sure you use the RHEL 8 version which contains ....el8... in the file name
   # azure, local: Make sure you use the RHEL 7 version which contains ....el7... in the file name
 
@@ -180,14 +207,16 @@ phantom_server:
   # Specify Phantom IP address when you enabled byo phantom
 
   phantom_byo_api_token: ""
-# Phantom Api Token
+  # Phantom Api Token
+
+  phantom_server_ip: "10.0.1.13"
 
 windows_servers_default:
   hostname: ar-win
   # Define the hostname for the Windows Server.
 
   windows_image: "windows-server-2019"
-  # Name of the image of the Windows Server. 
+  # Name of the image of the Windows Server.
   # allowd values: windows-server-2016, windows-server-2019, windows-server-2022
 
   create_domain: "0"
@@ -199,9 +228,6 @@ windows_servers_default:
   win_sysmon_config: "SwiftOnSecurity.xml"
   # Specify a Sysmon config located under configs/ .
 
-  install_red_team_tools: "0"
-  # Install different read team tools by setting this to 1 or 0.
-
   bad_blood: "0"
   # Install Bad Blood by setting this to 1 or 0.
   # More information in chapter Bad Blood under Attack Range Features.
@@ -227,6 +253,9 @@ windows_servers_default:
   aurora_agent: "0"
   # Install Aurora Agent
 
+  instance_profile_name: ""
+  # Instance profile name generated by IAM
+
   advanced_logging: "0"
   # Enable verbose windows security logs by setting this to 1.
 
@@ -235,7 +264,28 @@ linux_servers_default:
   # Define the hostname for the Linux Server.
 
   sysmon_config: "SysMonLinux-CatchAll.xml"
-# Specify a Sysmon config located under configs/ .
+  # Specify a Sysmon config located under configs/ .
+
+  install_red_team_tools: "0"
+  # Install different read team tools by setting this to 1.
+
+  install_cortex_xdr: "0"
+  # Install Cortex XDR agents by setting this to 1.
+
+  install_crowdstrike: "0"
+  # Install CrowdStrike Falcon by setting this to 1.
+
+  install_carbon_black: "0"
+  # Install Carbon Black Cloud by setting this to 1.
+
+  install_cisco_amp: "0"
+  # Install Cisco AMP by setting this to 1.
+
+  install_nessus: "0"
+  # Install Nessus by setting this to 1.
+
+  instance_profile_name: ""
+  # Instance profile name generated by IAM
 
   install_crowdstrike: "0"
   # Install CrowdStrike Falcon by setting this to 1.
@@ -246,7 +296,9 @@ linux_servers_default:
 
 kali_server:
   kali_server: "0"
-# Enable Kali Server by setting this to 1.
+  # Enable Kali Server by setting this to 1.
+
+  kali_server_ip: "10.0.1.18"
 
 nginx_server:
   nginx_server: "0"
@@ -259,19 +311,93 @@ nginx_server:
   # Specify what ip to proxy.
 
   proxy_server_port: "8000"
-# Specify what port to proxy.
+  # Specify what port to proxy.
+
+  nginx_server_ip: "10.0.1.31"
 
 zeek_server:
   zeek_server: "0"
   # Enable Zeek Server by setting this to 1.
 
+  zeek_image: "zeek-v3-0-0"
+  # Specify the image used for Zeek Server.
+
+  zeek_server_ip: "10.0.1.50"
+
 snort_server:
   snort_server: "0"
   # Enable Snort Server by setting this to 1.
 
+  snort_server_ip: "10.0.1.60"
+
 simulation:
   atomic_red_team_repo: redcanaryco
   # Specify the repository owner for Atomic Red Team.
 
   atomic_red_team_branch: master
-  # Specify the branch for Atomic Red Team.
+  # Specify the branch for Atomic Red Team.
+
+  prelude: "0"
+  # Install Prelude by setting this to 1.
+
+  prelude_operator_url: "https://download.prelude.org/latest?arch=x64&platform=linux&variant=zip&edition=headless"
+  # Specify where to download Prelude Operator from.
+
+  prelude_account_email: "test@test.com"
+  # Email account login into a Prelude Operator UI.
+  # Required for connecting to redirector, can be found on the GUI under connect -> deploy manual redirector -> accountEmail.
+
+edge_processor:
+  edge_processor: "0"
+  # Enable Splunk Edge by setting this to 1.
+
+  use_nlb: "0"
+  # Enable/disable usage of Network Load Balancer by setting this to 1 or 0.
+
+  splunk_edge_url: ""
+  # Specify the Splunk Edge URL.
+
+  splunk_edge_token: ""
+  # Specify the Splunk Edge token.
+
+  splunk_edge_gid: ""
+  # The Splunk Edge Processor groupId
+
+  splunk_edge_tenant: ""
+  # Specify the Splunk Edge tenant.
+
+  splunk_edge_env: ""
+  # Specify the Splunk Edge environment.
+
+  edge_image: "splunk-edge-v3-0-0"
+  # Specify the image used for Splunk Edge.
+
+httpd_server:
+  domain: "www.attackrange.local"
+  dns_zone: "attackrange.local"
+  cert_name: ""
+  httpd_server: "0"
+  # Enable HTTPD Server by setting this to 1.
+  use_alb: "0"
+
+  httpd_image: "httpd-v3-0-0"
+  # Specify the image used for HTTPD Server.
+
+  install_lamp: "0"
+  # Install LAMP by setting this to 1.
+
+  install_modsec: "0"
+  # Install ModSecurity by setting this to 1.
+
+  install_dvwa: "0"
+  install_mutillidae: "0"
+  install_sqli: "0"
+  # Install vulnerable web applications by setting this to 1.
+
+waf:
+  waf: "0"
+  # Enable WAF by setting this to 1.
+  splunk_hec_endpoint: ""
+  splunk_hec_endpoint_type: "Raw"
+  splunk_hec_token: ""
+  # Specify the Splunk HEC endpoint and token.
diff --git a/docs/source/Attack_Range_Config.md b/docs/source/Attack_Range_Config.md
@@ -32,8 +32,8 @@ general:
   crowdstrike_logs_access_key_id: ""
   crowdstrike_logs_secret_access_key: ""
   crowdstrike_logs_sqs_url: ""
-  # All these fields are needed to automatically deploy a CrowdStrike Agent and ingest CrowdStrike Falcon logs into the Splunk Server.
-  # See the chapter CrowdStrike Falcon in the docs page Attack Range Features.
+# All these fields are needed to automatically deploy a Crowdstrike Agent and ingest Crowdstrike Falcon logs into the Splunk Server.
+# See the chapter Crowdstrike Falcon in the docs page Attack Range Features.
 
   carbon_black_cloud: "0"
   # Enable/Disable VMWare Carbon Black Cloud log forwarding to Splunkby setting this to 1 or 0.
@@ -177,7 +177,7 @@ phantom_server:
   # Enable/Disable Phantom Server
 
   phantom_app: "splunk_soar-unpriv-6.2.2.134-8f694086-el8-x86_64.tgz"
-  # name of the Splunk SOAR package located in apps folder. 
+  # name of the Splunk SOAR package located in apps folder.
   # aws: Make sure you use the RHEL 8 version which contains ....el8... in the file name
   # azure, local: Make sure you use the RHEL 7 version which contains ....el7... in the file name
 
@@ -195,7 +195,7 @@ windows_servers_default:
   # Define the hostname for the Windows Server.
 
   windows_image: "windows-server-2019"
-  # Name of the image of the Windows Server. 
+  # Name of the image of the Windows Server.
   # allowd values: windows-server-2016, windows-server-2019, windows-server-2022
 
   create_domain: "0"
@@ -283,4 +283,14 @@ simulation:
 
   atomic_red_team_branch: master
   # Specify the branch for Atomic Red Team.
+
+  prelude: "0"
+# Install Prelude by setting this to 1.
+
+  prelude_operator_url: "https://download.prelude.org/latest?arch=x64&platform=linux&variant=zip&edition=headless"
+# Specify where to download Prelude Operator from.
+
+  prelude_account_email: "test@test.com"
+# Email account login into a Prelude Operator UI.
+# Required for connecting to redirector, can be found on the GUI under connect -> deploy manual redirector -> accountEmail.
 ````