PAGES
← all tools
◆ Security Validation (BAS & Automated Pentest)

atomic-operator

0.9.0 open-source

atomic-operator is a Python package used to execute Atomic Red Team tests (Atomics) across multiple operating system environments locally and remotely.

source ↗ website ↗ rss ↗ What is a cyber toolchain?

Summary

atomic-operator is an open-source Python package and command-line tool that runs Atomic Red Team tests against Windows, macOS and Linux systems, locally or on remote hosts, to check whether detection and defensive controls catch known adversary techniques. It can pull down the atomic-red-team test repository itself, select tests by technique or keyword, accept input arguments from the command line or a config file, and execute against AWS as well as endpoint targets, which makes it a fit for detection engineers and red teamers validating MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage rather than for general vulnerability scanning. Its README frames it as a way to run atomic-red-team's tests at scale rather than one at a time by hand. It is no longer maintained: the repository has been archived by its owner, with no commits in the past year and its last release dated 971 days ago, so it should be evaluated as a frozen snapshot rather than an actively developed project.

atomic-operator is a Python package used to execute Atomic Red Team tests (Atomics) across multiple operating system environments locally and remotely.

How atomic-operator helps

Which of my defensive controls actually fire when a specific MITRE ATT&CK technique is attempted?

runs the matching atomic-red-team test against the target system and leaves the resulting activity for your detection stack to catch or miss, showing you the gap directly

Can I validate detection coverage across a whole fleet instead of one box at a time?

takes a list of remote Windows, macOS, or Linux hosts and executes the same selected tests against each, rather than requiring the tests to be run by hand one host at a time

Which techniques do I even have tests available for, and how do I find the right one?

searches across the downloaded atomic-red-team test set by technique ID or keyword and returns the matching tests to choose from

Do my cloud defenses catch adversary behavior in AWS, not just on endpoints?

executes atomic tests against an AWS target in the same way it does for endpoints, so alerts can be checked against cloud-based technique emulation

How do I run the same test with different parameters without rewriting it each time?

accepts input arguments from the command line or a config file and substitutes them into the test at run time, so the same technique can be exercised under different conditions

Do I need to manually clone and manage the atomic-red-team test repository myself?

pulls the atomic-red-team repository down on its own, so the test content is in place before any technique is selected and run

all 5 features, with the evidence for each →

Languages

Not documented

Features

5 capabilities

Built from atomic-operator's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What atomic-operator offers you

  • Command-line interface1
All capabilities 5 capabilities
Prerequisite Management shipped Retrieve and verify prerequisite information required for running atomic tests. 2 releases · first seen Feb 2022

Also counts toward: Command-line interface

release

  • run get_prereqs retrieves prerequisite information for Atomic tests. 0.8.0 · Feb 2022 · source · release history
  • run check_prereqs executes only the prerequisite checks for Atomic tests without running the main command. 0.8.0 · Feb 2022 · source · release history
Flexible Argument Input shipped Accept test input arguments from both command line flags and configuration files. 1 release · first seen Mar 2023

release

  • input_arguments parameter now accepts values from both command line and config file 0.9.0 · Mar 2023 · source · release history
Privilege Elevation Support shipped Support for remote connections that require elevated privileges via the elevation_required parameter. 1 release · first seen Feb 2022

release

  • elevation_required parameter added to support remote connections requiring elevated privileges. 0.8.0 · Feb 2022 · source · release history
Test Cleanup Operations shipped Execute cleanup routines associated with atomic tests to restore the environment. 1 release · first seen Feb 2022

release

  • run cleanup performs cleanup operations for Atomic tests. 0.8.0 · Feb 2022 · source · release history
Configuration File Isolation shipped Restrict test execution to definitions contained within a specific configuration file. 1 release · first seen Jan 2022

release

  • Adds the config_file_only parameter to restrict execution to tests defined in a single config file 0.7.0 · Jan 2022 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for atomic-operator, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail atomic-operator puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

4 entries

  1. March 20231
  3. February 20221
  5. January 20221
  7. December 20211
    Show

    4 entries

    1. 0.9.0 Mar 6, 2023 · release notes

      Adds input_arguments support and keyword search for atomic-operator cli.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.9.0 https://github.com/swimlane/atomic-operator.git
# already have the repo? check out this version:
$ git checkout 0.9.0
      • input_arguments parameter now accepts values from both command line and config file
      • New ability to search all atomics based on a keyword or string

      2 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Moving execution logic to atomic-operator-runner package separates responsibilities from this package
      • !Switching project build system to Poetry may break existing dependency setups
    2. 0.8.0 Feb 10, 2022 · release notes

      atomic-operator v0.8.0 introduces run subcommands and remote elevation support

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.8.0 https://github.com/swimlane/atomic-operator.git
# already have the repo? check out this version:
$ git checkout 0.8.0
      • run check_prereqs executes only the prerequisite checks for Atomic tests without running the main command.
      • run get_prereqs retrieves prerequisite information for Atomic tests.
      • run cleanup performs cleanup operations for Atomic tests.
      • elevation_required parameter added to support remote connections requiring elevated privileges.

      4 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The run command no longer accepts the previous parameter set; only check_prereqs, get_prereqs, or cleanup are allowed as subcommands.
    3. 0.7.0 Jan 11, 2022 · release notes

      atomic-operator 0.7.0 adds config_file_only parameter to run only tests from a specific config file

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.7.0 https://github.com/swimlane/atomic-operator.git
# already have the repo? check out this version:
$ git checkout 0.7.0
    4. 0.6.0 Dec 17, 2021 · release notes

      Adds --help CLI support and help() method to AtomicOperator class

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.6.0 https://github.com/swimlane/atomic-operator.git
# already have the repo? check out this version:
$ git checkout 0.6.0
      └──▷ TRY IT
      View CLI usage instructions and available flags
      $ atomic-operator --help
      Display inline documentation for the AtomicOperator class in a Python environment
      python 
      AtomicOperator.help()
      • Adds --help flag to the command line interface

      1 detail in Everything

    Project health

    Issue, contributor and maintainer activity in swimlane/atomic-operator, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 10 of 31 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 10
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 156
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Threat coverage

    Content for the last year of exploited CVEs and attack reports.

    atomic-operator has content for 304 of the 982 threats tracked in the last year, 0 of them exact.

    exact0names the CVE
    related304names the technique or product
    tracked982threats in the last year

    See the threats, and how similar tools compare threat by threat, with Researcher and Business.

    See plans → Already subscribed? Sign in →

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback