How openaev-platform/openaev works
OpenAEV is a cyber adversary simulation platform: teams plan and run exercises, deliver injects through integrations, and review execution outcomes and security coverage. The API exposes campaign, workflow, autonomous-run, and attack-path capabilities; ingestion services build attack-path execution and finding data. Security coverage can be exchanged with OpenCTI, and connector orchestration manages connector instances. The sampled sources also show notification processing, full-text search, and coverage-send job handling. Several capabilities are evident from the README and tree, but unsampled implementation details do not establish their internal call wiring.
Main entry points: SecurityCoverageSendJobService.java Coverage send jobs · xtm_composer Connector APIs · ConnectorOrchestrationService.java Connector orchestration · AttackPathExecutionIngestionService.java Execution ingestion
Components 19
Exercise planning
- Campaign APIs
openaev-api/src/main/java/io/openaev/api/chaining - Autonomous runs
openaev-api/src/main/java/io/openaev/api/autonomous
Simulation analysis
- Attack paths
openaev-api/src/main/java/io/openaev/api/attackpath - Execution ingestion
openaev-api/src/main/java/io/openaev/service/attackpath/ingestion/AttackPathExecutionIngestionService.java - Finding ingestion
openaev-api/src/main/java/io/openaev/service/attackpath/ingestion/AttackPathFindingIngestionService.java - Coverage APIs
openaev-api/src/main/java/io/openaev/api/attack_pattern
External integrations
- Coverage exchange
openaev-api/src/main/java/io/openaev/service/stix/SecurityCoverageService.java - Coverage injects
openaev-api/src/main/java/io/openaev/service/stix/SecurityCoverageInjectService.java - Coverage send jobs
openaev-api/src/main/java/io/openaev/service/SecurityCoverageSendJobService.java - Connector APIs
openaev-api/src/main/java/io/openaev/api/xtm_composer - Connector orchestration
openaev-api/src/main/java/io/openaev/service/connectors/ConnectorOrchestrationService.java - Connector catalog
openaev-api/src/main/java/io/openaev/service/catalog_connectors/CatalogConnectorIngestionService.java
Platform services
- Notification engine
openaev-api/src/main/java/io/openaev/notification/engine/NotificationEngineService.java - Full-text search
openaev-api/src/main/java/io/openaev/search/FullTextSearchService.java - Analytics engine
openaev-model/src/main/java/io/openaev/engine/facade/EngineService.java - Platform data
Other components
- Platform user
- OpenCTI
- Inject integrations
Connections 16
- Platform user → Campaign APIs: plans exercises
- Platform user → Autonomous runs: starts runs
- Platform user → Attack paths: views paths
- Platform user → Coverage APIs: manages coverage
- Platform user → Connector APIs: manages connectors
- Execution ingestion → Platform data: writes executions
- Finding ingestion → Platform data: writes findings
- Coverage send jobs → Platform data: reads and updates jobs
- Coverage send jobs → OpenCTI: reports sent results
- Coverage exchange → OpenCTI: exchanges STIX coverage
- Connector orchestration → OpenCTI: checks composer status
- Connector APIs → Connector orchestration: manages instances
- Connector catalog → Platform data: updates catalog
- Notification engine → Platform data: records events
- Full-text search → Platform data: queries entities
- Analytics engine → Platform data: indexes and searches