kryssar.seSecurity engineering and research

SAGA Architecture

SAGA — Autonomous Purple-Team Second Brain

A layered homelab spanning bare metal, three Active Directory domains, a full blue-team detection stack, and a 26-server AI capability bridge — running an autonomous red/blue loop with local-first inference and explicit approval gates for live action.

Phase 5 — Orchestration 3/3 Domains Compromised Blue Team Operational 26 Capability Servers
5Hardware nodes
3/3AD domains owned
9/9Techniques detected
26Capability servers
51Commits / 14 days
System Overview
Hardware
🖥️ [internal-host] · control plane ⚡ [internal-host] · RTX 5070 Ti 🎮 [internal-host] · RTX 4060 🏗️ [internal-host] · Proxmox 8.x 💾 NAS · evidence vault
Attack Lab
CORUSCANT-DC · galactic.empire DS-COMMAND-DC · deathstar ALDERAAN-DC · rebel.alliance DS-WEAPONS-SRV · MSSQL ALDERAAN-CA-SRV · ADCS ESC1 DVWA · DevBox (Jenkins) · WinClient 🗡️ [internal-host] · Kali · VLAN 30
Blue Team
Malcolm NDR · Zeek + Suricata Wazuh 4.9.2 · SIEM Velociraptor 0.76.3 · 8 clients n8n · orchestration Defender Dashboard
AI Bridge
LiteLLM · 5 tiers 26 capability servers llama-server · local inference Ollama · [internal-host]/[internal-host] OpenBao · secrets Knowledge Graph 43+ skills
Auto Loop
🌙 Scope gate · operator-signed 🔴 Red agent · auto-attack container 🔵 Blue agent · reflection runner 📚 KG sync → vault artifacts

Five interconnected layers — each section below drills into one layer

Layer Deep-Dive
🏗️
Hardware & Network

Five-node cluster on a UniFi-managed LAN. VLANs isolate management traffic from the attack lab. Proxmox hypervisor with 64 GB RAM and a Ryzen 9 7900. Two GPU nodes for local inference.

[internal-host] · 32 GB · RTX 4070 [internal-host] · RTX 5070 Ti [internal-host] · RTX 4060 [internal-host] · Proxmox 8.x · 64 GB Synology 925+ NAS UniFi UXG-Max · VLAN 1/20/30
→ Full topology diagram
⚔️
SAGA Attack Lab

Three Active Directory domains in a Star Wars theme (saga-Light successor). Eight attack paths completed across cross-domain trust abuse, ADCS, MSSQL, and a Pro-Lab with vulnerable web stack.

galactic.empire (forest root) deathstar.galactic.empire rebel.alliance + ADCS ESC1 RBCD · Golden Ticket · DCSync DVWA · Jenkins · MSSQL xp_cmdshell 8 attack paths completed
→ Lab Chronicles
🔵
Blue Team Detection Stack

Five detection tools with full coverage across all VMs. 9/9 MITRE techniques detected. Custom Wazuh rules, Velociraptor forensic hunts, and Malcolm NDR for network correlation.

Malcolm NDR · Zeek · Suricata · OpenSearch Wazuh 4.9.2 · rules 100001–100050 Velociraptor 0.76.3 · 8 clients Sysmon · all Windows VMs WEF → Malcolm log pipeline 9/9 techniques detected
→ AI Thinking (detection reflections)
🤖
AI Orchestration Bridge

26 capability servers expose lab systems and research tools to AI agents. LiteLLM routes across 5 inference tiers from cheap summarisation to GPU-heavy strategy. OpenBao manages credentials. 43+ registered skills map natural-language tasks, CTF categories, and authorized research workflows to tools.

LiteLLM · 5 tiers (cheap → strategy) 26 capability servers llama-server · [internal-host] qwen3-8b cge-go-agent · KG + bounty triage Ollama · [internal-host] + [internal-host] OpenBao · KV secrets Knowledge Graph · 18-knowledge-graph/ CTF events · category-split solves 43+ registered skills
→ Architecture decision records
🔄
Autonomous Purple-Team Loop

The operator signs scope before live action. Agents query the knowledge graph, select bounded techniques or research checks, and use approval-aware tools to capture evidence to the vault. Blue-side workflows pull Velociraptor and Wazuh telemetry, score detection via Malcolm NDR, and write reflection artifacts back to the knowledge layer.

Scope gate · operator-signed YAML n8n overnight workflow Auto-attack container · [internal-host] Evidence captured → NAS vault Reflection runner · vault artifacts KG sync · current.yaml update
→ AI Thinking (loop outputs)
🌙 Operator signs scope
  ↓
🔴 Red: query KG → plan TTP
  ↓ scope approved
⚡ Execute on [internal-host]
  ↓
📁 Evidence → NAS
  ↓
🔵 Blue: telemetry pull
  ↓
📊 Malcolm NDR scoring
  ↓
📝 Reflection → vault
  ↓
🔁 KG sync → repeat