<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Attack Simulation Lab

## Lab Templates

| Template | Components | RAM Required |
|---|---|---|
| `minimal` | Elastic + Linux target | 8 GB |
| `standard` | Elastic + Wazuh + Windows/Linux targets | 16 GB |
| `full-lab` | Full stack with AD, NDR, CALDERA | 32 GB |

## Network Layout

| VLAN | Subnet | Purpose |
|---|---|---|
| Management | `10.0.0.0/24` | CALDERA, Navigator, analyst workstation |
| Targets | `10.0.1.0/24` | Windows, Linux, AD DC hosts |
| Monitoring | `10.0.2.0/24` | SIEM, EDR manager, NDR sensors |

## Docker Images

| Component | Image | Port |
|---|---|---|
| Elasticsearch | `docker.elastic.co/elasticsearch/elasticsearch:8.15.0` | 9200 |
| Kibana | `docker.elastic.co/kibana/kibana:8.15.0` | 5601 |
| Wazuh Manager | `wazuh/wazuh-manager:4.9.0` | 1514 |
| CALDERA | `mitre/caldera:latest` | 8888 |
| Zeek | `zeek/zeek:latest` | 47760 |
| Suricata | `jasonish/suricata:latest` | — |

## Agent Script

```bash
# Provision full lab
node agent.js provision --template full-lab --output lab.json

# Check health
node agent.js health-check --config lab.json

# Verify log flow
node agent.js verify-logs --siem-url http://localhost:9200 \
  --expected-sources sysmon,wazuh,zeek,suricata

# Teardown
node agent.js teardown --config lab.json
```
