---
title: "MITRE Caldera"
description: "Reference for the Tracecat MITRE Caldera integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## Add link to operation

Action ID: `tools.caldera.add_operation_link`

Queue an ability on an existing Caldera operation.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="ability_executor" type="string" required>

Executor name to run the ability with (e.g. windows, linux, darwin).

</ParamField>

<ParamField path="ability_id" type="string" required>

Ability ID to add to the operation.

</ParamField>

<ParamField path="operation_id" type="string" required>

Operation ID to update.

</ParamField>

<ParamField path="paw" type="string" required>

Agent PAW that should run the ability.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## Caldera health check

Action ID: `tools.caldera.health_check`

Query the Caldera REST API health endpoint.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## Create adversary

Action ID: `tools.caldera.create_adversary`

Create a new Caldera adversary profile.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="description" type="string" required>

Description of the adversary.

</ParamField>

<ParamField path="name" type="string" required>

Name for the adversary.

</ParamField>

<ParamField path="atomic_ordering" type="array[string]">

Ordered list of ability IDs for the adversary playbook.

Default: `[]`.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

<ParamField path="plugin" type="string">

Plugin that owns the adversary.

Default: `"stockpile"`.

</ParamField>

<ParamField path="tags" type="array[string]">

Optional tags to assign.

Default: `[]`.

</ParamField>

## Create Linux ability

Action ID: `tools.caldera.create_linux_ability`

Create a Caldera stockpile ability that runs on Linux agents.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="command" type="string" required>

Shell command to execute on the agent.

</ParamField>

<ParamField path="description" type="string" required>

Ability description.

</ParamField>

<ParamField path="name" type="string" required>

Ability name.

</ParamField>

<ParamField path="tactic" type="string" required>

MITRE ATT&amp;CK tactic (e.g. discovery, collection).

</ParamField>

<ParamField path="technique_name" type="string" required>

MITRE ATT&amp;CK technique name.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

<ParamField path="delete_payload" type="boolean">

Delete payloads from the agent after execution.

Default: `true`.

</ParamField>

<ParamField path="payloads" type="array[string]">

Optional payload files required by the ability.

Default: `[]`.

</ParamField>

<ParamField path="privilege" type="string">

Privilege level required to run the ability (blank for default).

Default: `""`.

</ParamField>

<ParamField path="repeatable" type="boolean">

Whether the ability can run repeatedly on the same agent.

Default: `false`.

</ParamField>

<ParamField path="technique_id" type="string | null">

Optional MITRE ATT&amp;CK technique ID (e.g. T1059.004).

Default: `null`.

</ParamField>

<ParamField path="timeout" type="integer">

Command timeout in seconds.

Default: `60`.

</ParamField>

## Create operation

Action ID: `tools.caldera.create_operation`

Create a Caldera operation from an existing adversary profile.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="adversary_id" type="string" required>

Adversary ID whose abilities should be executed.

</ParamField>

<ParamField path="name" type="string" required>

Operation name.

</ParamField>

<ParamField path="auto_close" type="boolean">

Whether to automatically close the operation when finished.

Default: `false`.

</ParamField>

<ParamField path="autonomous" type="integer">

Autonomous mode value (0 = manual, 1 = full autonomous).

Default: `1`.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

<ParamField path="group" type="string">

Optional group assignment for the operation.

Default: `""`.

</ParamField>

<ParamField path="jitter" type="string">

Sleep jitter value (format min/max seconds).

Default: `"2/4"`.

</ParamField>

<ParamField path="obfuscator" type="string">

Obfuscator to use for commands.

Default: `"plain-text"`.

</ParamField>

<ParamField path="objective_id" type="string">

Objective ID the operation should satisfy.

Default: `"495a9828-cab1-44dd-a0ca-66e58177d8cc"`.

</ParamField>

<ParamField path="planner_id" type="string">

Planner ID to use when scheduling the operation.

Default: `"aaa7c857-37a0-4c4a-85f7-4e9f7f30e31a"`.

</ParamField>

<ParamField path="source_id" type="string">

Source ID for fact collection.

Default: `"ed32b9c3-9593-4c33-b0db-e2007315096b"`.

</ParamField>

<ParamField path="state" type="string">

Initial operation state (e.g. running, paused, finished).

Default: `"paused"`.

</ParamField>

<ParamField path="use_learning_parsers" type="boolean">

Whether to enable learning parsers during the run.

Default: `true`.

</ParamField>

<ParamField path="visibility" type="integer">

Visibility score for the operation.

Default: `51`.

</ParamField>

## Create Windows ability

Action ID: `tools.caldera.create_windows_ability`

Create a Caldera stockpile ability that runs on Windows agents.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="command" type="string" required>

Exact PowerShell command to execute.

</ParamField>

<ParamField path="description" type="string" required>

Ability description.

</ParamField>

<ParamField path="name" type="string" required>

Ability name.

</ParamField>

<ParamField path="tactic" type="string" required>

MITRE ATT&amp;CK tactic (e.g. discovery, execution).

</ParamField>

<ParamField path="technique_name" type="string" required>

MITRE ATT&amp;CK technique name.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

<ParamField path="delete_payload" type="boolean">

Delete payloads from the agent after execution.

Default: `true`.

</ParamField>

<ParamField path="payloads" type="array[string]">

Optional payload files required by the ability.

Default: `[]`.

</ParamField>

<ParamField path="privilege" type="string">

Privilege level required to run the ability (blank for default).

Default: `""`.

</ParamField>

<ParamField path="repeatable" type="boolean">

Whether the ability can run repeatedly on the same agent.

Default: `false`.

</ParamField>

<ParamField path="technique_id" type="string | null">

Optional MITRE ATT&amp;CK technique ID (e.g. T1059.001).

Default: `null`.

</ParamField>

<ParamField path="timeout" type="integer">

Command timeout in seconds.

Default: `60`.

</ParamField>

## Get ability

Action ID: `tools.caldera.get_ability`

Retrieve a Caldera ability by ID.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="ability_id" type="string" required>

Ability ID to fetch.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## Get adversary

Action ID: `tools.caldera.get_adversary`

Retrieve a Caldera adversary by ID.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="adversary_id" type="string" required>

Adversary ID to fetch.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## Get agent

Action ID: `tools.caldera.get_agent`

Retrieve a Caldera agent by PAW.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="paw" type="string" required>

Agent PAW identifier.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## Get link result

Action ID: `tools.caldera.get_operation_link_result`

Retrieve the result payload for a specific Caldera link.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="link_id" type="string" required>

Link ID to fetch.

</ParamField>

<ParamField path="operation_id" type="string" required>

Operation ID that contains the link.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## Get operation

Action ID: `tools.caldera.get_operation`

Retrieve a Caldera operation by ID.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="operation_id" type="string" required>

Operation ID to fetch.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## Get operation link

Action ID: `tools.caldera.get_operation_link`

Retrieve a specific link from a Caldera operation.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="link_id" type="string" required>

Link ID to fetch.

</ParamField>

<ParamField path="operation_id" type="string" required>

Operation ID that contains the link.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## List abilities

Action ID: `tools.caldera.list_abilities`

List all Caldera abilities.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## List adversaries

Action ID: `tools.caldera.list_adversaries`

List Caldera adversaries.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## List agents

Action ID: `tools.caldera.list_agents`

List all Caldera agents (alive or dead).

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## List operation links

Action ID: `tools.caldera.list_operation_links`

List links for a specific Caldera operation.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="operation_id" type="string" required>

Operation ID to inspect.

</ParamField>

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## List operations

Action ID: `tools.caldera.list_operations`

List all Caldera operations.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>

## List payloads

Action ID: `tools.caldera.list_payloads`

List uploaded payloads from Caldera.

Reference: [https://caldera.readthedocs.io/en/latest/The-REST-API.html](https://caldera.readthedocs.io/en/latest/The-REST-API.html)

### Secrets

Required secrets:

- `caldera`: required values `CALDERA_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">

Caldera API base URL (e.g. http://localhost:8888/api/v2).

Default: `null`.

</ParamField>
