Attack Range
v5.0.0 open-sourceThe section your link pointed to isn't on Attack Range's page any more, so we've brought you to the top.
Splunk Attack Range builds instrumented cloud environments on AWS, Azure, or GCP, simulates attacks, and forwards data into Splunk for detection development and testing.
Summary
Attack Range is an open-source lab-building tool that spins up instrumented cloud environments on AWS, Azure, or GCP, simulates attacks against them, and forwards the resulting telemetry into Splunk for detection development and testing. It runs as a Docker Compose stack providing a web app, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., and optional CLI, so a Splunk instance and Windows/Linux hosts (plus optional Kali or Zeek) can be built via Terraform and Ansible without installing those tools locally; WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. handles connectivity and sharing access with teammates. It is built for detection engineers who need real attack telemetry to write and validate Splunk detections, using bundled Atomic Red Team and PurpleSharp roles to generate that data. First committed in 2019, the project has 68 contributors and 160 commits in the past year across 14 releases, with its last release 193 days ago.
Splunk Attack Range builds instrumented cloud environments on AWS, Azure, or GCP, simulates attacks, and forwards data into Splunk for detection development and testing.
How Attack Range helps
Which Splunk detections actually fire when a real attack technique runs against Windows or Linux hosts?
builds the lab, runs Atomic Red Team or PurpleSharp techniques against it, and forwards the resulting logs into Splunk so the detection can be checked against genuine telemetry instead of a synthetic sample
Does a detection still hold up once a login, a scheduled task, or a lateral-movement technique actually happens on the hosts it watches?
replays the technique through the bundled roles and lets the analyst compare the search results against the raw events Splunk received, rather than trusting the rule in isolation
Who else on the team can see the attack telemetry and reproduce the same test?
issues additional WireGuard client configs against the same running range so teammates connect to the identical Splunk instance and hosts instead of rebuilding their own
What does a given attack technique actually leave behind in the logs before a detection is written for it?
runs the technique through Atomic Red Team or PurpleSharp against the live hosts and forwards every resulting event into Splunk, so the raw telemetry can be inspected before any search is built against it
Can a detection be tested against Windows, Linux, and a mixed environment without standing up separate infrastructure for each?
builds the requested hosts from templates on AWS, Azure, or GCP through Terraform and Ansible, so the same attack simulation can be pointed at whichever operating systems the detection needs to cover
Languages
Command line
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for Attack Range, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail Attack Range puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
3 entries
No entries match these filters.
- February 20261
- July 20251
- January 20231
Project health
Issue, contributor and maintainer activity in splunk/attack_range, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 5 −8 vs prior 12 months
- Maintainers 2 +0 joined · −1 left, last 12 months
- Bus factor 1 committers behind half the commits
- Community-filed 100% of issues opened, last 12 months
- Median time to close 25 days first maintainer reply 23 days
- Open backlog 7 of 331 issues ever filed
- Issues opened / month 0 · 0 communitymaintainers
- Open backlog 7
- Contributors / month 0
- Commits / month 0
- Stars 2,558
- other 100%
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →