Documentation

Everything you need to run the range

Guides, references, and concepts for building ranges, running engagements, measuring what your detections catch, and turning it all into reports.

Get started

Create your workspace, fund it, launch your first lab, and run a full attack-to-report loop in your browser.

The range types (container, Active Directory, custom), Standard vs Express provisioning, sizing, and how to connect.

Pre-built purple-team scenarios: a real range plus a red-then-detect-then-respond playbook you drive, with one-click host actions.

The Wazuh SIEM, custom detection rules mapped to ATT&CK, and how coverage is measured.

How evidence is captured automatically, and how the five report perspectives are assembled and exported to PDF.

What is pre-installed on the attacker, victim, and detection hosts across the range types.

Provision labs, drive scenario actions, and manage firewalls programmatically over the Tyrian API.

Can't find what you need? Talk to the team or browse the ATT&CK library.