Hi dear community! Today we are proud to introduce the first upgrade of OpenBAS 🎉 leading the way to many other quick iterations we planned in order to provide you with the most complete Breach & Attack simulation solution to evaluate and validate your Security Posture! 🔥
Your feedbacks & requests will be very valuable to help us to shape this exciting new product. Please don’t hesitate to reach out. 🙂
OpenBAS Agent
With OpenBAS 1.1, we are introducing our own Agent in addition to Caldera and Tanium ones. The Agent is responsible for running your attack simulation on your endpoints. It aims to remain as neutral as possible, never directly executing malicious commands in order to stay operational and ensure the simulation flow, leaving that task to “injectors”. Until the 1.1, you could rely on a Caldera or a Tanium to be your Agent, both coming with inherent downsides, as they are not “real” BAS Agents. For example, Caldera is a well known implant, and is spotted and terminated by OS defenses right away, impacting your simulation flow.
We are planning to also provide a native OpenBAS injector, responsible for an enhanced malicious actions’ execution! 🚀
Breaking change: OpenBAS Agent is now the default Agent in platforms. If you previously used Caldera and want to continue to use it, you need to re-enabling it in the platform configuration file (documentation).
Custom payloads
We have introduced in OpenBAS 1.0.8 a key feature for our platform, and we wanted to celebrate this achievement in this major release ! 🎊 You can now create your own custom payloads inside OpenBAS and use them in your scenario, simulations and atomic testing. With this, you can integrate your carefully crafted scripts or even ones know to be used by threats meaningful to you! 🔥
Injects timeline in scenario
Until OpenBAS 1.1, it was not possible to easily see the injects’ time flow of your Scenario when defining it. We have brought the timeline to the inject page of your Scenario and simulations to let you see better when they will be played. The timeline is interactive and you can directly click on injects to edit them. 🧩
We will continue to facilitate Scenario creation, a tedious but really important phase for a relevant evaluation of your Security Posture!
Improvement of the time pickers and scheduling tool
Overall, the time picker was too clunky for efficient use. We have redesigned the UI to simplify and clarify the setup, providing you with a seamless scheduling experience.
Enhancements:
- #1089 Add timeline to the inject tab of scenario and simulation
- #919 Introducing OpenBAS Agent (Executor)
- #877 Empower the injects timeline with new interactions
- #860 Improvement of select date widget
Bug Fixes:
- #1067 Importing a simulation creates an error message or create the simulation completely empty
- #1022 Validation of manual expectation displayed in Validation screen even if the inject has failed at execution
- #1017 Full text search wrong indicators
- #1014 Error on Inject simulated emails
- #1005 Because of the sorting of simulation, it is impossible to find the recently created simulation
- #979 "Reply to" function doesn't send messages
- #944 Alignement issue in the MITRE results matrix
- #917 Inject Result for media pressure: image broken link
- #903 Imported scenario keeps the status / scheduling
- #868 Media Pressure articles are dissappearing
Pull Requests:
- [frontend] fix channels filter in definition by @guillaumejparis in #1049
- [backend/frontend] Fix reply to function in animation>mail section by @RomuDeuxfois in #1054
- [frontend]Updating the filters document by @johanah29 in #1063
- Issue/917 inject result for media pressure image broken link by @Christian-DONGMO in #1060
- Imported scenario keeps the status / scheduling by @RomuDeuxfois in #1050
- [backend] Improv performance on challenges by @RomuDeuxfois in #1066
- [backend] Improv performance on articles by @RomuDeuxfois in #1064
- [Backend] 1022 - Validation of manual expectation displayed in Valida… by @Christian-DONGMO in #1068
- [frontend] Refact timeline composant by @savacano28 in #1051
- [backend] Fix on get exercise details to have better performance by @Dimfacion in #1059
- [backend/frontend] Improv injects perf by @RomuDeuxfois in #1061
- [frontend] add timeline component into scenarios and exercise injects… by @savacano28 in #1072
- [frontend] fix by @savacano28 in #1076
- [Frontend]Improve select date widgets by @johanah29 in #1062
- [backend/frontend] Fix import by @RomuDeuxfois in #1069
- [frontend] Fix broken image by @RomuDeuxfois in #1077
- [frontend/backend] Fixing full text search wrong indicators by @Dimfacion in #1075
- [backend/frontend] Fix duplicate inject results by @RomuDeuxfois in #1074
- [backend/frontend] Adding feature flag by @Dimfacion in #1070
- [backend/frontend] Introduce the OpenBAS agent (#919) by @SamuelHassine in #1086
- Update V3_22__Endpoints.java by @RomuDeuxfois in #1088
- [frontend] Last fix before release by @johanah29 in #1083
- Issue/877 final improvements by @savacano28 in #1079
Full Changelog: 1.0.9...1.1.0