Skip to content

Prelude Operator

Jump to bottom
Jose Enrique Hernandez edited this page Jun 22, 2022 · 8 revisions

Prelude Operator can be automatically configured and deployed with a Splunk Attack Range allowing a user to easily launch attacks via operator on a running range using the pre-installed Penuma agents. See the general architecture below:

Prelude Attack Range Architecture 3 0

A few things to note from this architecture:

  • A Headless Operator/Redirector is installed on the Splunk server, this means a user needs:
  1. Operator installed in their local machine (can be downloaded here) to connect and manage it, see screenshot below.
  2. Or talk through it via the API on TCP port
  • Pneuma is installed and supported on the Windows (server and domain controller) and Linux machines ONLY today
  • Pneuma connects back to the Headless Operator/Redirector via TCP port 2323

When an Splunk Attack Range is configured it will need to know the auto generated accountEmail to connect to. This can be obtained via the Prelude Operator client via clicking on Connect -> Deploy Manual Redirectors, see screenshot below for an example.

image
Clone this wiki locally