Documentation
The guides and reference pages below are generated from the suite's own documents, so they always match the version of the suite this site was built from (version 0.1.0, 48 scenarios and 4 benign controls).
Guides
| Document | What it covers |
|---|---|
| Workflows | Two things that need no agent and no network: a demo that produces a finished report, and a comparison of two result sets with a small history file. Read... |
| Attaching a scenario to an agent or client | This guide shows how to put a scenario in front of the agent you want to test. Read RESPONSIBLE-USE.md first, and use a disposable project, a disposable user account, or... |
| The suite's tools | Five tools sit around the scenario runner (feintkit, see DETECTION-INTEGRATION.md). This page gives the exact commands, flags, exit codes and offline examples of each.... |
| Automation | Four things that need no agent call and no network: replaying the results of a real-agent run after a rule change, a short note per scenario on what a defender can do, a... |
| Wiring a detection product or an agent to the suite | This guide shows how to run scenarios, what to look for, how to record what your security product did, and |
| Marker strings, tokens, and artifacts | Every artifact the suite produces can be recognized and searched for. Use these values when you configure a |
| Scenario categories | Each category is a repository of scenarios. Mappings are to MITRE ATLAS techniques and the OWASP lists; see TTP-MAP.md for the reasoning. The tools around the runner... |
Reference
| Document | What it covers |
|---|---|
| TTP map | Generated by python3 scripts/verify-mappings.py --online --write from docs/scenarios/MAPPINGS.json. |
| Capabilities this project will not add | Feintkit is a defensive test suite. It contains benign, simulated versions of known attack patterns so that a security product, or your own agent, has something... |
Scenario notes
Defender notes, one page per scenario (48 pages).
Translations (machine-made, need human review)
The guide documents are available in six languages. These pages are machine translations that no person has reviewed yet and may contain errors; the English page is authoritative, and every translated page links to it and says so at the top. Command lines, flags and file names stay in English.
The client guide names third-party products. Those names are compatibility facts that cite each vendor's own documentation with a last-verified date; no vendor endorses, or is affiliated with, Feintkit.
Also on this site
- Responsible use and Legal: the usage rules, the disclaimer and the notice, reproduced word for word.
- Quick start, Detection and Safety.
Not published on this site
These ship with the suite but are not published here: the exact specification of every scenario, the security-reporting policy and the name policy. They become available with the first release.