How mastermjr/viberange-workshop works
VibeRange is a reproducible purple-team forensic workshop and isolated cyber-range blueprint. Participants use the experiment CLI to start a bounded run, execute a prepared Caldera attack against a vulnerable Kubernetes target, and investigate independently collected evidence in CH-UI and Jupyter. The map follows the documented stages from range provisioning and attack preparation through telemetry collection, storage, detection, and reporting. Several subsystem links reflect the README’s architecture description; unsampled implementations are represented by their exact enclosing directories.
Main entry points: schema.sql ClickHouse evidence · viberange_experiment.py Experiment CLI · ludus_vector_attacker Vector transport · ludus_caldera_server Caldera operation
Components 21
Range and isolation
- Ludus range
blueprints/viberange - Range workloads
templates
Experiment control
- Experiment CLI
ansible/roles/ludus_experiment_cli/files/viberange_experiment.py - Run control
ansible/roles/ludus_run_control/files/viberange_run.py
Attack and evidence
- Caldera content
ansible/roles/ludus_caldera_content/files - Caldera operation
ansible/roles/ludus_caldera_server - Attacker host
ansible/roles/ludus_vector_attacker - Kubernetes target
ansible/roles/ludus_k3s_goat - Kubernetes telemetry
ansible/roles/ludus_k3s_goat - Router capture
ansible/roles/ludus_router_evidence - PCAP and Zeek
ansible/roles/ludus_router_evidence/files/finalize_router_evidence.py - Vector transport
ansible/roles/ludus_vector_attacker
Storage and analysis
- ClickHouse evidence
ansible/roles/ludus_clickhouse_ir/files/schema.sql - CH-UI analysis
ansible/roles/ludus_ch_ui - CH-UI content
ansible/roles/ludus_ch_ui/files/seed_ch_ui.py - Jupyter analysis
ansible/roles/ludus_jupyter
Detection and reporting
- Detection rules
ansible/roles/ludus_detection_runner/files/rules - Detection runner
ansible/roles/ludus_detection_runner/files/runner.py - Detection receiver
ansible/roles/ludus_detection_runner/files/receiver.py - Reconstruction report
ansible/roles/ludus_jupyter/files/viberange-reconstruction.ipynb
Other components
- Participant
Connections 21
- Participant → Experiment CLI: controls run
README.md - Ludus range → Range workloads: deploys range
README.md - Experiment CLI → Run control: sets run state
ansible/roles/ludus_experiment_cli/files/viberange_experiment.py - Experiment CLI → Caldera operation: starts operation
ansible/roles/ludus_experiment_cli/files/viberange_experiment.py - Experiment CLI → Router capture: starts capture
ansible/roles/ludus_experiment_cli/files/viberange_experiment.py - Caldera content → Caldera operation: syncs abilities
ansible/roles/ludus_caldera_content/files/sync_content.py - Caldera operation → Attacker host: runs on
README.md - Attacker host → Kubernetes target: attacks
README.md - Kubernetes target → Kubernetes telemetry: produces evidence
README.md - Kubernetes telemetry → Vector transport: ships telemetry
README.md - Attacker host → Vector transport: ships audit
README.md - Router capture → PCAP and Zeek: processes capture
README.md - PCAP and Zeek → Vector transport: spools Zeek evidence
ansible/roles/ludus_router_evidence/files/finalize_router_evidence.py - Vector transport → ClickHouse evidence: transports records
README.md - CH-UI content → CH-UI analysis: seeds dashboards
ansible/roles/ludus_ch_ui/files/seed_ch_ui.py - CH-UI analysis → ClickHouse evidence: queries evidence
README.md - Jupyter analysis → ClickHouse evidence: reconstructs runs
README.md - Detection rules → Detection runner: provides rules
README.md - Detection runner → ClickHouse evidence: queries evidence
- Detection receiver → ClickHouse evidence: stores matches
ansible/roles/ludus_detection_runner/files/receiver.py - Reconstruction report → Jupyter analysis: generates report
README.md