SAGA - Lab-Backed Security Engineering
SAGA is the private purple-team platform behind Chaos Gremlin Engineering: a repeatable environment for testing attack paths, validating telemetry, rehearsing defensive workflows, and turning lessons into reusable knowledge.
This page is the public overview. It is intentionally not a live inventory, not a target list, and not an operator runbook.
What SAGA Proves
SAGA exists to make security engineering less theoretical:
| Layer | Public Role |
|---|---|
| Range | Multi-domain Active Directory and application targets used for authorized lab exercises. |
| Automation | Reset-aware workflows for staged attack, detection, evidence capture, and reflection. |
| AI runtime | Local-first model routing, MCP/capability servers, and approval-aware task routing. |
| Knowledge layer | RAG-backed memory linking techniques, writeups, detections, playbooks, and lessons learned. |
| Public surface | Sanitized research notes and architecture summaries published here after review. |
The private operator view keeps exact hostnames, VM IDs, IP addresses, credentials, evidence paths, and live service state inside the LAN documentation layer.
Validated Learning Themes
The lab has been used to exercise and detect the main technique families I care about for Active Directory and hybrid lab operations:
| Theme | Examples |
|---|---|
| Credential access | Kerberoasting, DCSync, pass-the-hash, certificate abuse. |
| Lateral movement | SMB/WinRM paths, MSSQL execution, delegated access paths. |
| Privilege escalation | Resource-based delegation, certificate template abuse, domain compromise chains. |
| Web entrypoints | Vulnerable application exploitation, SQL injection, CI/admin console abuse. |
| Detection engineering | Sysmon, Windows event IDs, Wazuh rules, Zeek/Suricata network evidence, OpenSearch correlation. |
| Operational discipline | Scope gates, reset checks, evidence indexing, redaction, and post-run reflection. |
The point is not to publish a victory scoreboard. The point is to build a system where an attack path can be replayed, detected, documented, linked into memory, and improved on the next run.
Architecture Summary
AI Orchestration
| Component | Public Summary |
|---|---|
| LiteLLM / redaction proxy | Routes model traffic through local-first tiers and blocks sensitive material from cloud fallback. |
| Local inference | Uses local GPU-backed models for routine reasoning, drafting, and summarization. |
| MCP/capability servers | Expose controlled interfaces for project state, lab tooling, RAG lookup, security tools, and approval gates. |
| Skills and playbooks | Map operator intent to the right workflow, validator, and hard limit. |
| Served agents | Provide grounded Q&A and security-research workflows through stable API envelopes. |
Defensive Telemetry
| Component | Public Summary |
|---|---|
| Velociraptor | Endpoint collection and forensic hunting. |
| Sysmon | Process, network, registry, and file-event visibility on Windows targets. |
| Wazuh | SIEM rules and host alerting for lab techniques. |
| Malcolm / Zeek / Suricata | Network evidence, protocol metadata, and signature-based detections. |
| OpenSearch | Correlation and search layer for defensive evidence. |
Knowledge-RAG
The knowledge layer is treated as the lab brain. It links:
- MITRE ATT&CK techniques to lab procedures.
- Offensive steps to defensive telemetry and recommended detections.
- CTF/bug-bounty learnings to reusable playbooks.
- Ingested books, writeups, and references to searchable graph entries.
- Session outcomes to future operator guidance.
The public site only shows curated summaries. The internal experience site keeps the drill-down graph, exact evidence links, and operator workflows.
Public Boundaries
The public SAGA page should stay within these boundaries:
| Do Publish | Do Not Publish |
|---|---|
| Architecture patterns and design decisions. | Exact lab IPs, VM IDs, internal hostnames, or live service state. |
| Sanitized writeups and lessons learned. | Credentials, secret paths, hashes, tickets, or evidence paths. |
| MITRE mappings and defensive ideas. | Step-by-step operator commands for active lab execution. |
| Tooling categories and high-level workflows. | Raw internal status exports or stale generated dashboards. |
For deeper technical reading, use the public sections that are already scrubbed:
Maintained by: kryssar ยท Last reviewed: 2026-08-25