Skip to main content
Action ID: tools.caldera.add_operation_link Queue an ability on an existing Caldera operation. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Executor name to run the ability with (e.g. windows, linux, darwin).
​
string
required
Ability ID to add to the operation.
​
string
required
Operation ID to update.
​
string
required
Agent PAW that should run the ability.
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.

​
Caldera health check

Action ID: tools.caldera.health_check Query the Caldera REST API health endpoint. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.

​
Create adversary

Action ID: tools.caldera.create_adversary Create a new Caldera adversary profile. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Description of the adversary.
​
string
required
Name for the adversary.
​
array[string]
Ordered list of ability IDs for the adversary playbook.Default: [].
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.
​
string
Plugin that owns the adversary.Default: "stockpile".
​
array[string]
Optional tags to assign.Default: [].

​
Create Linux ability

Action ID: tools.caldera.create_linux_ability Create a Caldera stockpile ability that runs on Linux agents. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Shell command to execute on the agent.
​
string
required
Ability description.
​
string
required
Ability name.
​
string
required
MITRE ATT&CK tactic (e.g. discovery, collection).
​
string
required
MITRE ATT&CK technique name.
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.
​
boolean
Delete payloads from the agent after execution.Default: true.
​
array[string]
Optional payload files required by the ability.Default: [].
​
string
Privilege level required to run the ability (blank for default).Default: "".
​
boolean
Whether the ability can run repeatedly on the same agent.Default: false.
​
string | null
Optional MITRE ATT&CK technique ID (e.g. T1059.004).Default: null.
​
integer
Command timeout in seconds.Default: 60.

​
Create operation

Action ID: tools.caldera.create_operation Create a Caldera operation from an existing adversary profile. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Adversary ID whose abilities should be executed.
​
string
required
Operation name.
​
boolean
Whether to automatically close the operation when finished.Default: false.
​
integer
Autonomous mode value (0 = manual, 1 = full autonomous).Default: 1.
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.
​
string
Optional group assignment for the operation.Default: "".
​
string
Sleep jitter value (format min/max seconds).Default: "2/4".
​
string
Obfuscator to use for commands.Default: "plain-text".
​
string
Objective ID the operation should satisfy.Default: "495a9828-cab1-44dd-a0ca-66e58177d8cc".
​
string
Planner ID to use when scheduling the operation.Default: "aaa7c857-37a0-4c4a-85f7-4e9f7f30e31a".
​
string
Source ID for fact collection.Default: "ed32b9c3-9593-4c33-b0db-e2007315096b".
​
string
Initial operation state (e.g. running, paused, finished).Default: "paused".
​
boolean
Whether to enable learning parsers during the run.Default: true.
​
integer
Visibility score for the operation.Default: 51.

​
Create Windows ability

Action ID: tools.caldera.create_windows_ability Create a Caldera stockpile ability that runs on Windows agents. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Exact PowerShell command to execute.
​
string
required
Ability description.
​
string
required
Ability name.
​
string
required
MITRE ATT&CK tactic (e.g. discovery, execution).
​
string
required
MITRE ATT&CK technique name.
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.
​
boolean
Delete payloads from the agent after execution.Default: true.
​
array[string]
Optional payload files required by the ability.Default: [].
​
string
Privilege level required to run the ability (blank for default).Default: "".
​
boolean
Whether the ability can run repeatedly on the same agent.Default: false.
​
string | null
Optional MITRE ATT&CK technique ID (e.g. T1059.001).Default: null.
​
integer
Command timeout in seconds.Default: 60.

​
Get ability

Action ID: tools.caldera.get_ability Retrieve a Caldera ability by ID. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Ability ID to fetch.
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.

​
Get adversary

Action ID: tools.caldera.get_adversary Retrieve a Caldera adversary by ID. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Adversary ID to fetch.
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.

​
Get agent

Action ID: tools.caldera.get_agent Retrieve a Caldera agent by PAW. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Agent PAW identifier.
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.
Action ID: tools.caldera.get_operation_link_result Retrieve the result payload for a specific Caldera link. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Link ID to fetch.
​
string
required
Operation ID that contains the link.
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.

​
Get operation

Action ID: tools.caldera.get_operation Retrieve a Caldera operation by ID. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Operation ID to fetch.
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.
Action ID: tools.caldera.get_operation_link Retrieve a specific link from a Caldera operation. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Link ID to fetch.
​
string
required
Operation ID that contains the link.
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.

​
List abilities

Action ID: tools.caldera.list_abilities List all Caldera abilities. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.

​
List adversaries

Action ID: tools.caldera.list_adversaries List Caldera adversaries. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.

​
List agents

Action ID: tools.caldera.list_agents List all Caldera agents (alive or dead). Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.
Action ID: tools.caldera.list_operation_links List links for a specific Caldera operation. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string
required
Operation ID to inspect.
​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.

​
List operations

Action ID: tools.caldera.list_operations List all Caldera operations. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.

​
List payloads

Action ID: tools.caldera.list_payloads List uploaded payloads from Caldera. Reference: https://caldera.readthedocs.io/en/latest/The-REST-API.html

​
Secrets

Required secrets:
  • caldera: required values CALDERA_API_KEY.

​
Input fields

​
string | null
Caldera API base URL (e.g. http://localhost:8888/api/v2).Default: null.