Kill Chain Designer — compose full-attack Cymulate FKC Campaign / Advanced Assessment
cymulate_killchain_designerDesigns Cymulate kill-chain campaigns/assessments across 11 phases, enriching each with MITRE mapping, detection points, and Mermaid diagrams from tradecraft for operator review.
Instructions
LOCAL composition tool. Does NOT call the Cymulate API. Composes a full-chain adversary emulation (11 phases from initial access to impact) as a Cymulate Full Kill-Chain Campaign OR Advanced Scenarios assessment. Enriches each phase via knowledge-rag queries pulling realistic tradecraft from LOLBAS, hacktricks, RTFM, and Falcon detection queries. Produces Mermaid diagram of the full chain, MITRE mapping per stage, and detection points per stage. HARD BLOCK: creates a NEW campaign/assessment only. NEVER modifies default Cymulate templates. Never auto-submits — always presents to operator for review first.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| skip_phases | No | Phases to skip (e.g. ["reconnaissance", "impact"]) — useful if scoping to specific chain segment | |
| actor_profile | Yes | Adversary to emulate. Each profile brings its own biases (evasion style, tooling, timing). | |
| campaign_name | Yes | Campaign name — will be prefixed with "custom-" to avoid collision with defaults | |
| custom_stages | No | Only used if actor_profile=custom. List the phases you want, in order. | |
| output_format | No | fkc_campaign = Full Kill-Chain Campaign (POST /v1/apt-wrapper/start) — best for multi-stage. advanced_assessment = Purple Team assessment (POST /v1/purple-team/assessment) — more flexible. | fkc_campaign |
| include_mermaid | No | ||
| target_environment | Yes | Target environment context |