SMARE Forge

Advanced Multi-Agent Security Scenario Generator

šŸš€ SMARE Forge - Workflow Overview & CLI Interface

šŸ› ļø Implementation Workflow

1

Prerequisites

āœ… Scenario Applied
āœ… Topology Ready
āœ… Output Config
ā”€ā”€ā–¶
2

Generate Events

ā±ļø Choose Duration
šŸ“Š Set Event Rate
šŸš€ Execute Command
ā”€ā”€ā–¶
3

Output & Analysis

šŸ“” Stream to SIEM
šŸ’¾ Save to File
āœ… Verify Events

šŸ—ŗļø Map Application Deployment

Define your system architecture with precision:

  • Service Topology - Map microservices and dependencies
  • Agent Networks - Model AI agent interactions
  • Data Sources - Connect databases and caches
  • External APIs - Include third-party integrations
15+
Entity Types

šŸŽ­ Model Behavior

Create realistic operational patterns:

  • Baseline Traffic - Normal operational flow
  • Business Hours - Peak activity simulation
  • Seasonal Patterns - Holiday and weekend modes
  • Load Testing - Stress scenario generation
8
Traffic Patterns

āš”ļø Generate Traffic & Attacks

Forge comprehensive security scenarios:

  • High-Volume Events - 10K+ events/second
  • Multi-Vector Attacks - Coordinated threat campaigns
  • APT Simulation - Advanced persistent threats
  • Anomaly Injection - Realistic attack patterns
250K+
Events/Min

šŸ“ˆ Analyze Results

Comprehensive output and monitoring:

  • SIEM Integration - Real-time streaming
  • JSONL Export - Structured event logs
  • Interactive Visualization - Attack timeline views
  • Performance Metrics - Memory and CPU efficiency
<50MB
Memory Usage

Core CLI Commands - Based on Go Types from internal/telemetry/

forge telemetry - Core Commands 
# Generate baseline telemetry with TopologyGraph types
forge telemetry generate banking-demo --duration 15m --rate 150 --output file --file events.jsonl

# Execute AttackCampaign with multi-vector coordination  
forge telemetry campaign banking-attack-campaign.yaml --duration 30m --output http --endpoint https://siem.company.com/events

# Generate HTML visualization using VisualizationGenerator
forge telemetry visualize banking-attack-campaign.yaml --output pinelabs-attack-viz.html --theme dark --layout cose

# Run with specific traffic patterns and PropagationRules
forge telemetry generate banking-demo --pattern business_hours --duration 8h --rate 100

# Campaign orchestration with AttackVector dependencies
forge telemetry campaign --config campaigns/kyc-data-exfiltration.yaml --visualization --output-dir ./attack-results

Topology Configuration (TopologyGraph)

scenarios/pinelabs/topology.yaml 
# Topology configuration matching Go struct TopologyGraph
services:
  - id: "svc-onboarding"
    name: "Onboarding Service"
    endpoint: "https://onboarding.pinelabs.com"
    description: "Merchant onboarding and KYC processing"
    version: "2.1.0"
    apiEndpoints:
      - id: "ep-kyc-summary"
        name: "KYC Summary Generation"
        path: "/agent/kyc/summary"
        protocolType: "REST"
        httpMethod: "POST"

agents:
  - id: "agent-kyc-processor"
    name: "KYC Processor Agent"
    purpose: "Document verification and compliance checks"
    agentType: "DOCUMENT_PROCESSOR"
    endpoint: "https://kyc-agent.pinelabs.com"
    apiEndpoints:
      - id: "ep-doc-analysis"
        path: "/analyze/documents"
        protocolType: "REST"

dataSources:
  - id: "ds-payment-db"
    name: "Payment Database"
    type: "RDBMS"
    connection: "jdbc:postgresql://payment-db:5432/customers"
    schema: "customers"

edges:
  - id: "agent-kyc-to-onboarding"
    sourceId: "agent-kyc-processor"
    targetId: "svc-onboarding"
    communicationType: "AIAGENT_TO_SVC"
    protocol: "HTTPS"
    frequency: "high"

Attack Campaign (AttackCampaign)

campaigns/kyc-data-exfiltration.yaml 
# Attack campaign configuration using AttackVector struct
name: "KYC Data Exfiltration Campaign"
objective: "Exfiltrate sensitive customer KYC data"
description: "Multi-vector attack targeting PII data through AI agent compromise"

attackVectors:
  - name: "prompt-injection-kyc"
    sourceEntity: "agent-kyc-processor"
    targetEntity: "ds-payment-db"
    edgeType: "ANOMALY_DB_ACCESS"
    timeline: "T1"
    timelineOverrides:
      query_type: "SELECT * FROM customer_kyc_full"
      anomaly_type: "UNSEEN_DB_TABLE_ACCESS"
    dependencies: []
    triggers:
      - type: "TIME_BASED"
        condition: "after 10m"
        probability: 0.8

  - name: "external-api-exfiltration"
    sourceEntity: "agent-kyc-processor"
    targetEntity: "ext-forex-api"
    edgeType: "ANOMALY_EXTERNAL_API"
    timeline: "T2"
    dependencies: ["prompt-injection-kyc"]
    triggers:
      - type: "DEPENDENCY_BASED"
        condition: "requires prompt-injection-kyc"
        probability: 0.9

propagationRules:
  - sourceVector: "prompt-injection-kyc"
    effects:
      - targetEntity: "ds-payment-db"
        probabilityIncrease: 0.3
        intensityMultiplier: 1.5

correlatedDrifts:
  - driftType: "volume"
    pattern: "database_query_increase"
    entities: ["ds-payment-db"]
    baselineMultiplier: 3.0

šŸ”— PineLabs Payment System - Professional Topology Visualization

Entity Highlighting:

šŸ“Š PineLabs Payment System - Baseline Behavior Modeling

Traffic Generation Patterns

Pattern Configuration

Select a Traffic Pattern 
# Select a traffic pattern to see YAML configuration
# Each pattern defines different load characteristics:
# - Request rates and timing
# - Database query patterns  
# - Agent coordination scenarios
# - Error rate thresholds

patterns:
  business_hours:
    description: "Standard business operational hours"
    request_rate: "500-1000 req/min"
    peak_hours: "9AM-5PM"
    database_load: "moderate"
    
  weekend:
    description: "Reduced weekend traffic"
    request_rate: "50-200 req/min"
    peak_hours: "11AM-3PM"
    database_load: "low"

šŸ“„ PineLabs Baseline Configuration

scenarios/pinelabs-payments/telemetry/baseline.yaml 
# PineLabs Payment System Baseline Configuration
# Defines normal operational patterns for payment processing with KYC and fraud detection

name: "pinelabs-payments-baseline"
description: "Normal operational telemetry for PineLabs payment system"

# Event generation rates (events per minute) - matches actual event schema
rates:
  AIAGENT_TO_AIAGENT: 12    # Agent coordination (risk scoring, KYC validation)
  AIAGENT_TO_SVC: 18        # Agent calling services (KYC, fraud detection)  
  SVC_TO_DB: 45             # Service database queries (payment, merchant, settlement)
  SVC_TO_SVC: 8             # Service-to-service calls (gateway, reconciliation)

# Business hours schedule (matches traffic patterns)
schedule:
  start_hour: 9             # 9 AM IST
  end_hour: 17              # 5 PM IST
  timezone: "Asia/Kolkata"  # PineLabs timezone
  weekdays_only: true

# Variance configuration (matches banking-timeline-events.jsonl patterns)
variance:
  timing_jitter_ms: 500     # Ā±500ms timing variance
  rate_variance_pct: 20     # Ā±20% rate variance for payment spikes
  latency_base_ms: 75       # Base latency for payment processing
  latency_variance_ms: 150  # Ā±150ms latency variance

# PineLabs entity behavioral patterns (matches topology)
entities:
  agents:
    agent-kyc-processor:
      activity_level: "high"
      interaction_patterns: ["kyc_verification", "document_analysis", "compliance_check"]
      load_pattern: "business_hours"
      database_calls_per_request: 2
    agent-risk-scorer:
      activity_level: "medium"
      interaction_patterns: ["risk_assessment", "fraud_scoring", "mcp_coordination"]
      load_pattern: "24x7"
    agent-txn-reconciler:
      activity_level: "high"
      interaction_patterns: ["transaction_reconciliation", "settlement_processing"]
      load_pattern: "end_of_month"
      
  services:
    svc-onboarding:
      load_pattern: "business_hours" 
      database_calls_per_request: 3
    svc-payment-gateway:
      load_pattern: "24x7"
      database_calls_per_request: 4
    svc-fraud-detection:
      load_pattern: "24x7"
      database_calls_per_request: 2

# Traffic pattern integration (links to pattern selection buttons)
traffic_patterns:
  business_hours:
    rate_multiplier: 1.0
    active_services: ["svc-onboarding", "agent-kyc-processor"]
  end_of_month:
    rate_multiplier: 4.0
    active_services: ["svc-txn-reconciler", "agent-txn-reconciler"]
  weekend:
    rate_multiplier: 0.3
    active_services: ["svc-payment-gateway", "svc-fraud-detection"]
  peak_load:
    rate_multiplier: 8.0
    active_services: ["all"]
12/min
Agent-to-Agent
8/min
Agent-to-Service
15/min
Service-to-Database
Ā±500ms
Timing Jitter

šŸšØ Attack Campaign Modeling

šŸ”„ Attack Timeline Visualization

T+0s a1b2c3d
feat: Initialize reconnaissance phase
Orchestrator agent begins probing evaluator agent endpoints for trust establishment
reconnaissance unusual-freq
šŸ‘¤ agent-orchestrator
šŸ“Š +15 requests
T+45s e4f5g6h
feat: Establish agent trust protocol
Collusion initialization via /collab/init endpoint with parameter injection vectors
trust-init param-inject
šŸ¤ multi-agent
šŸ”— +3 endpoints
T+2m15s i7j8k9l
exploit: Risk assessment manipulation
Attempted override of risk scoring mechanisms through payload size anomalies
manipulation payload-anomaly
āš ļø threat-actor
šŸ“¦ +2.3MB payload
T+4m15s m0n1o2p
critical: Direct database manipulation
Privilege escalation successful - unauthorized direct access to payment database achieved
critical priv-escalation data-access
šŸ’€ malicious-agent
šŸ—„ļø +1.2K records
šŸšØ BREACH DETECTED

Multi-Vector Coordination

4 Attack Vectors 80% Injection Probability 3.5x Payload Amplification

Inter-Agent Collusion Campaign

scenarios/banking/telemetry/attacks/inter-agent-collusion.yaml 
# Inter-Agent Collusion Attack Timeline
name: "inter-agent-collusion"
description: "AI agents colluding to bypass security controls"
duration_minutes: 8
attack_start_offset: "3m13s"

# Attack phases
timeline:
  - phase: "reconnaissance"
    start: "0s"
    duration: "45s"
    events:
      - type: "agent_communication"
        source: "agent-banking-orchestrator"
        target: "agent-banking-evaluator"  
        frequency: "every_15s"
        anomalies: ["UNUSUAL_FREQUENCY"]
        
  - phase: "manipulation"
    start: "2m15s" 
    duration: "120s"
    events:
      - type: "agent_communication"
        source: "agent-banking-orchestrator"
        target: "agent-banking-evaluator"
        path: "/assess/risk?override=true"
        frequency: "every_30s"
        anomalies: ["PARAMETER_INJECTION", "PAYLOAD_SIZE_ANOMALY"]

# Anomaly injection rules
anomalies:
  PARAMETER_INJECTION:
    probability: 0.8
    applies_to: ["path", "query_params"]
    
  PAYLOAD_SIZE_ANOMALY:
    probability: 0.6
    multiplier: 3.5  # 3.5x normal payload size

āš™ļø Execution Engine

Real-Time Monitoring

0
Events Generated
0
Current Rate/sec
0
Anomalies Injected
0s
Execution Time
Ready to Execute

Performance Charts

Execution Controls

šŸ“ˆ Output & Analysis

Detection & Analysis Charts

MITRE ATT&CK Coverage

Export & Validation

87.3%
Detection Rate
23
Vulnerabilities Found
156
MITRE Techniques
99.1%
Data Integrity

Sample Output Data

Generated Events Sample (JSONL) 
{"appGuid":"app-pinelabs-001","communicationType":"SVC_TO_DB","errorRate":"0.008","eventType":"normal","latencyMs":82.34,"protocol":"JDBC","requestId":"req-pinelabs-kyc001","scenarioName":"pinelabs-payments","severity":"INFO","sourceId":"svc-onboarding","sourceIp":"10.10.145.67","statusCode":"200","targetId":"ds-payment-db","timestamp":"2025-08-04T10:15:32+05:30","traceId":"kyc-trace-001"}
{"anomalyDescription":"Injected override=true into KYC verification API call","anomalyType":"PARAMETER_INJECTION","appGuid":"app-pinelabs-001","communicationType":"AIAGENT_TO_SVC","eventType":"anomaly","latencyMs":187.92,"protocol":"HTTPS","protocolData":{"path":"/agent/kyc/summary?override=true&bypass=admin"},"requestId":"req-pinelabs-attack1","scenarioName":"pinelabs-payments","scenarioStep":"Bypass KYC verification controls","securityContext":{"principal":"kyc-agent@pinelabs.com"},"severity":"CRITICAL","sourceId":"agent-kyc-processor","sourceIp":"10.10.28.194","statusCode":"200","targetId":"svc-onboarding","timelineKey":"T2","timestamp":"2025-08-04T10:17:45+05:30","traceId":"attack-kyc-002"}
{"appGuid":"app-pinelabs-001","communicationType":"AIAGENT_TO_AIAGENT","eventType":"normal","latencyMs":124.56,"protocol":"HTTPS","protocolData":{"path":"/agent/coordinate","method":"POST"},"requestId":"req-pinelabs-coord1","scenarioName":"pinelabs-payments","severity":"INFO","sourceId":"agent-kyc-processor","sourceIp":"10.10.89.123","statusCode":"200","targetId":"agent-risk-scorer","timestamp":"2025-08-04T10:18:12+05:30","traceId":"coord-trace-003"}

šŸ“š Configuration Guide - SMARE Forge YAML/JSON Schema

šŸŽÆ Overview

This guide explains all configuration attributes for SMARE Forge scenarios. All configurations can be written in either YAML or JSON format based on the Golang struct definitions.

šŸ“ Scenario Configuration

scenario.yaml 
scenario:
  name: "banking-compromise"
  description: "PineLabs payment system attack"
  duration: "24h"
  start_time: "2024-01-15T00:00:00Z"
  
  # Scenario metadata
  tags: ["banking", "payment", "fraud"]
  severity: "HIGH"
  complexity: "ADVANCED"
  
  # Execution parameters
  parallel_execution: true
  failure_threshold: 0.3
  cleanup_on_exit: true

šŸ—ļø Infrastructure Configuration

infrastructure.yaml 
infrastructure:
  services:
    - name: "payment-gateway"
      type: "REST_API"
      endpoints: ["/api/payments", "/api/validation"]
      port: 8080
      health_check: "/health"
      
    - name: "fraud-detection"
      type: "AI_AGENT"
      model: "bert-fraud-v2"
      confidence_threshold: 0.85
      
  databases:
    - name: "transactions-db"
      type: "POSTGRESQL"
      schema: "banking_v2"
      connection_pool: 20
      
  agents:
    - name: "kyc-processor"
      capabilities: ["DOCUMENT_ANALYSIS", "ID_VERIFICATION"]
      memory_limit: "2Gi"

šŸŽÆ Baseline Configuration

baseline.yaml 
baseline:
  normal_behavior:
    transaction_patterns:
      - pattern: "daily_transactions"
        count_range: [1000, 5000]
        time_distribution: "business_hours"
        
      - pattern: "kyc_verifications"
        success_rate: 0.95
        avg_processing_time: "2m"
        
    communication_flows:
      - from: "payment-gateway"
        to: "fraud-detection"
        frequency: "per_transaction"
        protocol: "HTTPS"
        
  anomaly_detection:
    sensitivity: "MEDIUM"
    learning_period: "7d"
    alert_threshold: 3.0

āš”ļø Attack Campaign Configuration

attack_campaign.yaml 
attack_campaign:
  name: "advanced_payment_fraud"
  phases:
    - phase: "reconnaissance"
      duration: "2h"
      techniques: ["T1082", "T1083", "T1087"]
      
    - phase: "initial_access"
      duration: "30m"
      techniques: ["T1190", "T1566"]
      success_criteria: "api_access_gained"
      
    - phase: "persistence"
      duration: "1h"
      techniques: ["T1078", "T1053"]
      
  attack_vectors:
    - vector: "parameter_injection"
      target: "kyc_verification_api"
      payload: "bypass=admin&override=true"
      
    - vector: "model_poisoning"
      target: "fraud_detection_model"
      technique: "adversarial_examples"

šŸ“Š Telemetry Configuration

telemetry.yaml 
telemetry:
  collection:
    metrics:
      - name: "transaction_latency"
        type: "HISTOGRAM"
        buckets: [50, 100, 250, 500, 1000, 2500, 5000]
        
      - name: "fraud_detection_accuracy"
        type: "GAUGE"
        update_frequency: "1m"
        
    traces:
      sampling_rate: 0.1
      max_spans: 1000
      exporters: ["jaeger", "datadog"]
      
    logs:
      level: "INFO"
      structured: true
      fields: ["timestamp", "trace_id", "severity", "message"]
      
  analysis:
    detection_rules:
      - rule: "anomalous_transaction_volume"
        condition: "transaction_count > baseline_avg * 3"
        action: "ALERT"
        
      - rule: "suspicious_parameter_injection"
        pattern: ".*bypass.*|.*override.*"
        action: "BLOCK"

šŸ“‹ Entity Types Reference

Entity Type Description
REST_APIHTTP/REST API endpoints
AI_AGENTAI/ML powered agents
DATABASEDatabase systems
MESSAGE_QUEUEMessage brokers
LOAD_BALANCERTraffic distributors
CACHECaching layers
USER_INTERFACEWeb/mobile frontends
EXTERNAL_SVCThird-party services

āš”ļø Attack Types Reference

Attack Type Description
PARAMETER_INJECTIONMalicious parameter manipulation
MODEL_POISONINGML model adversarial attacks
PRIVILEGE_ESCALATIONUnauthorized access elevation
DATA_EXFILTRATIONSensitive data theft
API_ABUSEAPI misuse and exploitation
PROMPT_INJECTIONLLM prompt manipulation
CREDENTIAL_STUFFINGStolen credential reuse
BUSINESS_LOGIC_BYPASSApplication logic exploitation

šŸ“„ Download Configuration Templates

Entity Details

×

šŸ“š Configuration Guide - SMARE Forge YAML/JSON Schema

šŸŽÆ Overview

This guide explains all configuration attributes for SMARE Forge scenarios. All configurations can be written in either YAML or JSON format based on the Golang struct definitions.

šŸ“ Scenario Configuration

scenario.yaml 
scenario:
  name: "banking-compromise"
  description: "PineLabs payment system attack"
  duration: "24h"
  start_time: "2024-01-15T00:00:00Z"
  
  # Scenario metadata
  metadata:
    author: "security-team"
    version: "1.0.0"
    tags: ["payment", "compromise", "APT"]
    severity: "critical"
    
  # Execution settings
  settings:
    parallel_execution: true
    max_workers: 10
    retry_attempts: 3
    timeout: "30m"

šŸ¢ Infrastructure Configuration

infrastructure.yaml 
infrastructure:
  services:
    - id: "payment-api"
      type: "service"
      properties:
        host: "api.pinelabs.com"
        port: 443
        protocol: "https"
        criticality: "high"
        
  databases:
    - id: "customer-db"
      type: "database"
      properties:
        engine: "postgresql"
        version: "14.2"
        encrypted: true
        
  agents:
    - id: "monitoring-agent"
      type: "agent"
      properties:
        role: "collector"
        interval: "30s"

šŸ›”ļø Baseline Configuration

baseline.yaml 
baseline:
  normal_behavior:
    - entity_id: "payment-api"
      patterns:
        request_rate: "1000-1500/min"
        response_time: "50-200ms"
        error_rate: "< 0.1%"
        
  relationships:
    - source: "user"
      target: "payment-api"
      interaction:
        protocol: "https"
        frequency: "continuous"
        data_flow: "bidirectional"
        
  telemetry:
    metrics:
      - name: "api_requests_total"
        type: "counter"
        labels: ["endpoint", "status"]
    traces:
      - service: "payment-api"
        sampling_rate: 0.1

āš”ļø Attack Configuration

attack.yaml 
attacks:
  campaigns:
    - id: "lateral-movement"
      phases:
        - name: "initial-access"
          techniques:
            - mitre_id: "T1078"
              description: "Valid Accounts"
              target: "payment-api"
              
        - name: "persistence"
          techniques:
            - mitre_id: "T1098"
              description: "Account Manipulation"
              
  indicators:
    - type: "network"
      value: "suspicious-domain.com"
      severity: "high"
      
  timeline:
    - timestamp: "+1h"
      action: "reconnaissance"
    - timestamp: "+2h"
      action: "initial-compromise"

šŸ“Š Telemetry Configuration

Metrics

metrics:
  exporters:
    - type: "prometheus"
      endpoint: "/metrics"
      interval: "10s"
      
  custom_metrics:
    - name: "payment_processed"
      type: "histogram"
      buckets: [0.1, 0.5, 1, 5]
      unit: "seconds"

Traces

traces:
  exporters:
    - type: "otlp"
      endpoint: "otel:4317"
      
  sampling:
    strategy: "adaptive"
    initial_rate: 0.1
    max_rate: 1.0

Logs

logs:
  format: "json"
  level: "info"
  
  outputs:
    - type: "elasticsearch"
      index: "smare-logs"
      
  enrichment:
    - add_fields:
        scenario_id: "${SCENARIO_ID}"
        phase: "${CURRENT_PHASE}"

šŸ”§ Advanced Configuration Options

Entity Properties Reference

Attribute Type Description
id string Unique identifier
type enum service|database|agent|cache|infra
properties map Custom key-value properties
criticality string low|medium|high|critical
tags []string Metadata tags
dependencies []string IDs of dependent entities

Attack Technique Properties

Attribute Type Description
mitre_id string MITRE ATT&CK technique ID
target string Target entity ID
duration duration Attack duration
intensity float 0.0 to 1.0 scale
indicators []IOC Generated IOCs
cleanup bool Auto-cleanup after execution

šŸ’” Usage Examples

Complete Scenario Example

Quick Start Templates

šŸ”§ Entity Details

Click on any node or edge to view details