MITRE Caldera™ for OT plugin: plugin: DNP3

A MITRE Caldera™ for OT plugin supplying Apache Caldera with DNP3 protocol TTPs mapped to MITRE ATT&CK® for ICS v14. This is part of a series of plugins that provide added threat emulation capability for Operational Technology (OT) environments.

Full DNP3 plugin documentation can be viewed as part of fieldmanual, once the Caldera server is running.

Installation

To run Caldera along with DNP3 plugin:

1. Download Apache Caldera as detailed in the Installation Guide
2. Install the dnp3 plugin in Caldera's plugin directory: caldera/plugins
3. Enable the dnp3 plugin by adding - dnp3 to the list of enabled plugins in conf/local.yml or conf/default.yml (if running Caldera in insecure mode)

Caldera Version

This plugin is compatible with Caldera v4.2.0 and v5.0.0. The latest version of Caldera can be checked out using the following method:

git clone --recursive https://github.com/apache/caldera.git

Usage

1. Install and enable the plugin as described above.
2. Optionally, create a fact source to store attributes of the target system. An example is provided here.
3. Start the Caldera server
4. Create a new Operation, optionally using the fact source from step 2.
5. Use "Add Potential Link" to run a specific ability from this plugin. Fact values can can be entered manually, or selected from a fact source.

Virtual OT Simulators

To help you test the DNP3 plugin without any additional hardware requirements, MITRE provides open-source simulators that act as software targets.

Grid Watch

Grid Watch is a simulated electrical grid outstation that mimics the behavior of a real-world DNP3 device, letting you test the DNP3 plugin without physical hardware.

To get started, follow the instructions here.