Metta
An information security preparedness tool for adversarial simulation using Redis/Celery, Python, and Vagrant.
What is Metta?
Metta is an open-source information security preparedness tool that performs adversarial simulation to test host-based and network-based security defenses. It parses YAML files containing attack actions and uses Celery to queue and execute them sequentially in Vagrant virtual machines. This helps organizations proactively identify weaknesses in their security instrumentation.
Security professionals, red teams, and blue teams responsible for testing and improving organizational security defenses through realistic attack simulations.
Developers choose Metta for its integration with MITRE ATT&CK frameworks, flexible scenario building via YAML, and self-hosted Vagrant environments that provide safe, isolated testing without relying on external services.
Overview
An information security preparedness tool to do adversarial simulation.
Use Cases
Best For
- Testing host-based security instrumentation against known attack techniques
- Simulating adversarial actions organized by MITRE ATT&CK phases
- Building custom security testing scenarios with YAML-defined actions
- Running sequential attack commands in isolated Vagrant environments
- Integrating Celery and Redis for scalable, queued security task execution
- Self-hosting security simulation tools without cloud dependencies
Not Ideal For
- Teams needing quick, ad-hoc security tests without virtual machine setup
- Organizations lacking Vagrant and VirtualBox infrastructure
- Projects requiring real-time, interactive red teaming with GUI interfaces
Pros & Cons
Pros
Actions are organized by MITRE ATT&CK phases, enabling structured security testing as shown in the README's folder structure like MITRE/Discovery.
Supports creating complex attack chains via YAML files with purple_actions arrays and scenario definitions, allowing customizable simulations.
Uses Vagrant with VirtualBox to create safe, isolated VMs for simulation, minimizing risk to production systems.
Leverages Celery and Redis to queue and run actions sequentially, enabling hands-off, scalable security testing.
Cons
Requires installing and configuring Vagrant, VirtualBox, Redis, and Celery, which the brief README defers to setup.md and a wiki, indicating complexity.
The README's 'Gotchas' section notes that quotes and shell characters must be escaped in commands, leading to potential errors in action execution.
Tightly coupled with Vagrant and VirtualBox, limiting portability to other virtualization or cloud platforms without significant modification.
Frequently Asked Questions
Related Projects
Atomic Red TeamSmall and highly portable detection tests based on MITRE's ATT&CK.
CalderaAutomated Adversary Emulation Platform
APTSimulatorA toolset to make a system look as if it was the victim of an APT attack
Network Flight Simulator (flightsim)A utility to safely generate malicious network traffic patterns and evaluate controls.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.