OpenBAS-Platform/openbas: Open-Source Adversary Simulation for Security Teams

OpenBAS-Platform/openbas: Open-Source Adversary Simulation for Security Teams

Security teams need reliable ways to test their defenses against real-world threats. Running periodic penetration tests or red team exercises is expensive, infrequent, and hard to coordinate at scale. OpenBAS-Platform/openbas addresses this gap by providing an open-source platform for planning, scheduling, and conducting cyber adversary simulation campaigns and tests. Built in Java and maintained by Filigran, it integrates with threat intelligence from the OpenCTI platform to help organizations identify security gaps against actual adversary behaviors.

What is OpenBAS-Platform/openbas?

OpenBAS-Platform/openbas is an open-source adversary exposure validation platform with 1,750 GitHub stars and 215 forks. The project is actively developed, with its last commit dated July 16, 2026. It is primarily written in Java and distributed under a dual-edition model: Community Edition (Apache 2.0) and Enterprise Edition (proprietary license).

The platform is designed and developed by Filigran, a company specializing in open-source cybersecurity tools. OpenBAS fills a specific niche in the security operations toolchain: it sits between threat intelligence platforms (like OpenCTI, also by Filigran) and security testing tools, providing the orchestration layer that turns raw threat data into structured simulation exercises.

What makes OpenBAS relevant now is the growing recognition that traditional vulnerability scanning and compliance-driven testing are insufficient. Organizations need continuous validation that their detection and response capabilities actually work against the specific threat actors targeting their industry. OpenBAS provides this by linking simulations to real threat intelligence and supporting multiple communication channels for inject delivery.

The platform's architecture supports collaborative work, real-time monitoring, statistics collection, and feedback management—features that matter when multiple teams (blue, red, purple) need to coordinate complex exercises.

Key Features

Threat-Linked Simulation Planning

OpenBAS integrates with the OpenCTI platform to provide security gap analysis based on actual threats. This means simulations are grounded in real adversary behaviors rather than generic attack patterns.

Multi-Channel Inject Support

The platform supports different types of "injects"—the actions or stimuli delivered during a simulation. These can be delivered via email, SMS platforms, social media^{↗ Bright Coding Blog}, alarm systems, and other channels. The full list of supported integrations is documented in the OpenBAS ecosystem.

Modular Exercise Design

OpenBAS provides distinct modules for scenarios, teams, simulations, and verification of communication means including encryption. This modular approach allows organizations to scale exercises from technical drills to strategic tabletop exercises.

Collaborative Exercise Management

The platform supports collaborative work with real-time monitoring and statistics. This is critical for distributed security teams or exercises involving multiple organizational units.

Dual Edition Model

The Community Edition is fully open-source under Apache 2.0. The Enterprise Edition adds features requiring additional R&D investment and can be enabled directly in platform settings. Specific Enterprise features are listed on Filigran's subscription page.

Docker^{↗ Bright Coding Blog} and Manual Deployment

Installation is supported via Docker or manual installation, with documentation covering both approaches.

Use Cases

Continuous Security Control Validation

A security operations team can schedule recurring adversary simulations that mirror the tactics of threat actors known to target their industry. By linking to OpenCTI threat intelligence, the team validates whether their SIEM rules, EDR configurations, and incident response playbooks actually trigger against realistic behaviors.

Purple Team Exercise Orchestration

Red and blue teams often struggle with coordination during joint exercises. OpenBAS provides the shared platform for planning scenarios, delivering injects through multiple channels, and collecting real-time feedback. The statistics and monitoring features help both sides understand what worked and what didn't.

Crisis Communication Testing

The platform's support for email, SMS, social media, and alarm system injects makes it suitable for testing not just technical defenses but also organizational response procedures. A CISO can verify that critical alerts reach the right people through the right channels under simulated stress conditions.

Security Awareness Training at Scale

Rather than static phishing simulations, security teams can craft multi-stage scenarios that test how employees respond to increasingly sophisticated social engineering attempts, with results feeding back into training priorities.

Third-Party and Supply Chain Risk Assessment

Organizations can use OpenBAS to simulate attacks that might originate through partner organizations, testing whether their security controls detect and contain lateral movement from compromised trusted connections.

Installation & Setup

The official documentation provides complete installation instructions. Two methods are supported:

Using Docker

Docker deployment is the recommended path for most users. Refer to the Docker installation section:

# See https://docs.openaev.io/latest/deployment/installation/#using-docker
# for current Docker Compose configuration and environment variables

The Docker images are published to hub.docker.com/u/openaev. The badge indicates substantial pull volume, suggesting active community usage.

Manual Installation

For environments where Docker is not suitable, manual installation is documented at:

# See https://docs.openaev.io/latest/deployment/installation/#manual-installation
# for Java requirements, database setup, and service configuration

Given the Java codebase, manual installation likely requires:

• Java runtime (version specified in documentation)
• PostgreSQL^{↗ Bright Coding Blog} or compatible database
• RabbitMQ or similar message broker (common in Filigran's stack)
• Reverse proxy configuration for web access

Development Environment

For contributors, Ubuntu-specific development environment setup is documented at docs.openaev.io/latest/development/environment_ubuntu/.

Real Code Examples

The README does not contain extensive inline code examples. The following reflects the actual documentation structure and commands provided:

Docker Deployment Reference

The README points to Docker as the primary deployment method. While the exact docker-compose.yml is not inlined in the README, the documentation link is:

# Referenced at: https://docs.openaev.io/latest/deployment/installation/#using-docker
# Expected structure based on typical Filigran deployments:
# - Platform API service
# - Frontend application
# - Database (PostgreSQL)
# - Message broker (RabbitMQ)
# - Optional: OpenCTI connector for threat intelligence

Manual Installation Steps

# Referenced at: https://docs.openaev.io/latest/deployment/installation/#manual-installation
# Steps typically include:
# 1. Install Java runtime
# 2. Configure database connection
# 3. Set environment variables
# 4. Start the application server

Development Environment (Ubuntu)

# Referenced at: https://docs.openaev.io/latest/development/environment_ubuntu/
# For contributors modifying source code:
# 1. Clone repository
# 2. Install build dependencies
# 3. Configure development database
# 4. Start services in development mode

The limited inline code in the README reflects that OpenBAS is primarily a deployed platform rather than a library or CLI tool. Users interact with it through the web interface and configuration files rather than direct API calls in most cases. The API documentation likely contains more detailed integration examples.

Advanced Usage & Best Practices

Link to OpenCTI for Context-Rich Simulations

The integration with OpenCTI is a core differentiator. To maximize value, ensure your OpenCTI instance contains relevant threat intelligence for your sector before building scenarios. Generic simulations without threat context are possible but underutilize the platform's design.

Start with Communication Channel Verification

Before running full adversary simulations, use the platform's communication verification features to confirm that injects actually reach their targets through email, SMS, or other configured channels. Failed inject delivery invalidates exercise results.

Use the Enterprise Edition Trial for Evaluation

The Enterprise Edition can be enabled in settings for evaluation. This allows teams to assess whether the additional features justify the subscription before committing. The specific feature delta is documented on Filigran's subscription page.

Plan for Telemetry

OpenBAS collects anonymous usage telemetry by default. Review the telemetry documentation to understand what is collected and how to configure this for your organization's privacy requirements.

Engage with the Community

With 3,000+ members on Slack, the community is active for a project of this size. Given the "heavy development" status noted in the README, checking recent GitHub issues before deployment can reveal known limitations or workarounds.

Comparison with Alternatives

OpenBAS occupies a middle ground: more structured exercise management than Caldera, but open-source and self-hosted unlike commercial alternatives. The OpenCTI integration is unique to the Filigran ecosystem. Teams already using OpenCTI will find this linkage particularly valuable; teams without threat intelligence investments may need to build that foundation first.

FAQ

What license applies to OpenBAS?

Community Edition uses Apache 2.0. Enterprise Edition uses a proprietary license. Check the LICENSE file for specifics.

Is OpenBAS production-ready?

The README states it is "under heavy development." Evaluate stability for your use case; the demo instance resets nightly.

What Java version is required?

The README does not specify; check the installation documentation for current requirements.

Can I run OpenBAS without OpenCTI?

Yes, but threat intelligence integration is a core feature. Running without it reduces the platform's differentiation.

How do I report bugs or request features?

Use the GitHub issues module or the Slack channel.

Is there a hosted option?

No hosted SaaS is mentioned; self-hosted deployment via Docker or manual installation is required.

What does the Enterprise Edition cost?

Pricing is not disclosed in the README; visit Filigran's subscription page for details.

Conclusion

OpenBAS-Platform/openbas is a purpose-built tool for security teams that need to move beyond occasional penetration testing to continuous, intelligence-driven adversary simulation. Its integration with OpenCTI, multi-channel inject support, and structured exercise management distinguish it from simpler red team tools.

The platform is best suited for organizations with established security operations and preferably existing OpenCTI deployments. Teams without dedicated threat intelligence resources may find the setup investment substantial relative to immediate value. The active development status means features are evolving rapidly, but also that production deployments require careful evaluation.

For teams ready to implement adversary exposure validation, start with the demonstration instance to assess fit, then deploy via Docker for initial testing. The open-source Community Edition provides substantial capability without licensing cost.

Explore the project on GitHub: https://github.com/OpenBAS-Platform/openbas

For related threat intelligence capabilities, see [INTERNAL_LINK: OpenCTI threat intelligence platform overview].