How b-3llum/ice-9 works
ice_9 is a MITRE ATT&CK-aligned red-team campaign platform. Operators manage campaigns through the CLI or React dashboard; campaign phases run integrated tools, findings and intel are recorded, and teams can plan or autonomously select phases. Results are exposed through REST and live events and can feed reporting. The graph combines README-described capabilities with sampled API, dashboard, autopilot, LLM, and storage behavior; unsampled subsystem connections are shown only where documented.
Main entry points: api.py REST API · phases ATT&CK phase engine · store.py Campaign and intel store · orchestrator.py Campaign autopilot
Components 21
Operator interfaces
- Web dashboard
dashboard/src/App.tsx - Dashboard API client
dashboard/src/api/client.ts - Live event stream
dashboard/src/hooks/useEventStream.ts - Campaign CLI
ice_9/cli.py
Campaign execution
- ATT&CK phase engine
ice_9/phases - Tool runner
ice_9/tools/execution.py - Intel extraction and profiling
ice_9/intel - Subject simulation
ice_9/intel/simulation.py
AI and intel
- Campaign autopilot
ice_9/ai/orchestrator.py - AI agent team
ice_9/ai/team.py - Model router
ice_9/ai/router.py - LLM client
ice_9/ai/llm.py - RAG knowledge base
ice_9/ai/rag
Persistence and reporting
- Campaign and intel store
ice_9/db/store.py - Report generation
ice_9/reporting/generator.py - Audit logging
ice_9/core/audit.py
Other components
- Operator
- Offensive tools
- LLM providers
Connections 28
- Operator → Web dashboard: uses
- Operator → Campaign CLI: runs
- Web dashboard → Dashboard API client: requests data
- Dashboard API client → REST API: REST calls
- Web dashboard → Live event stream: subscribes
- Live event stream → REST API: opens SSE
- Campaign CLI → ATT&CK phase engine: runs phases
- REST API → ATT&CK phase engine: dispatches phases
- REST API → AI agent team: dispatches AI
- REST API → Tool runner: dispatches tools
- ATT&CK phase engine → Tool runner: runs tools
- Tool runner → Offensive tools: invokes
- ATT&CK phase engine → Intel extraction and profiling: extracts findings
- Campaign autopilot → AI agent team: asks and analyzes
- Campaign autopilot → ATT&CK phase engine: selects and runs
- Campaign autopilot → Campaign and intel store: reloads campaign
- Campaign autopilot → Audit logging: records actions
- AI agent team → Model router: routes tasks
- Model router → LLM client: selects provider
- LLM client → LLM providers: sends prompts
- AI agent team → RAG knowledge base: uses knowledge
- ATT&CK phase engine → Campaign and intel store: persists campaign state
- Intel extraction and profiling → Campaign and intel store: stores intel
- Subject simulation → Campaign and intel store: uses subject profiles
- REST API → Event bus: publishes events
- Event bus → Live event stream: streams events
- Report generation → Campaign and intel store: reads campaign results
- Campaign CLI → Report generation: generates reports