From cyber-range-design
Design, architect, and implement high-fidelity cyber ranges for training and exercises. Based on SEI/CERT methodology with modern extensions for cloud, zero-trust, and AI-driven simulation. Triggers on "cyber range", "exercise environment", "training range", "simulation environment", or requests for range zones, NPC traffic, ICS/SCADA/OT integration, range resets, or fidelity assessment. Modes: DESIGN (architecture), IMPLEMENT (build guidance), EXERCISE (execution planning).
How this skill is triggered — by the user, by Claude, or both
Slash command
/cyber-range-design:cyber-range-designThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Design, build, and operate high-fidelity virtualized cyber ranges that maximize training value through realistic adversary simulation and enterprise environment replication.
Design, build, and operate high-fidelity virtualized cyber ranges that maximize training value through realistic adversary simulation and enterprise environment replication.
Designing realistic cyber range exercises from scratch is a complex, multi-discipline challenge. Teams struggle with zone architecture, fidelity tradeoffs, NPC traffic generation, and infrastructure sizing -- leading to ranges that are either too simplistic to provide training value or too complex to maintain and reset reliably.
A cyber range is a fully interactive virtual instance of enterprise IT infrastructure dedicated to cyberwarfare training. Realism is the primary driver of training value -- ranges must support "train as you fight" principles.
| Fidelity Level | Characteristics | Training Value |
|---|---|---|
| Low | Basic networking, minimal services, no traffic | Limited -- trivial to detect adversary |
| Medium | Core services, basic policies, scripted traffic | Moderate -- builds tool familiarity |
| High | Production-replica configs, realistic NPCs, proper noise | High -- develops operational intuition |
| Ultra | Threat intel-driven TTPs, adaptive adversary AI, full telemetry | Elite -- nation-state operator development |
+---------------------------------------------------------------+
| OUT OF GAME |
| +-------------+ +-------------+ +-------------+ |
| | CORE | | WHITE | | ACCESS | |
| | INFRA ZONE | | ZONE | | ZONE | |
| | Hypervisor | | (Exercise | | (Participant| |
| | Storage | | Admin) | | Interface) | |
| | Network | | Automation | | Web Portal | |
| +-------------+ | Timeline | | VM Access | |
| +-------------+ +-------------+ |
| +-------------+ |
| | METRICS | |
| | Scoring | |
| | Analytics | |
| +-------------+ |
+---------------------------------------------------------------+
+---------------------------------------------------------------+
| IN GAME |
| +--------+ +---------+ +--------+ |
| | RED |<----->| GREY |<----->| BLUE | |
| | Attack | | Sim | | Defend | |
| | Infra | | Internet| | Enter- | |
| | C2 | | DNS/ISP | | prise | |
| +--------+ +---------+ +--------+ |
+---------------------------------------------------------------+
| Zone | Purpose | Trust Level | Key Components |
|---|---|---|---|
| Core Infrastructure | Hypervisor/storage/network substrate | Privileged | ESXi/Proxmox, SAN/NAS, physical switches |
| White (Exercise Admin) | Timeline orchestration, event injection | Privileged | Automation APIs, scenario engine, inject controller |
| Access | Participant interface to range VMs | Semi-trusted | Web portal, Guacamole/SPICE, file transfer, chat |
| Metrics/Evaluation | Scoring, feedback, ROI measurement | Privileged | Scoring engine, analytics, dashboards |
| Red (Adversary) | Attack infrastructure | Adversarial | C2 frameworks, exploitation tools, IP rotation |
| Grey (Simulated Internet) | Public Internet simulation | Neutral | DNS roots/TLDs, ISP simulation, web content |
| Blue (Defender) | Scaled enterprise replica | Target | AD, workstations, servers, security stack |
For zero-trust environments, add an explicit Identity Zone: IdP (SAML/OIDC), Certificate Authority (PKI), Federation Services, MFA Infrastructure (TOTP/FIDO2).
Critical dependency ordering for range deployment:
Phase 1: Foundation
1.1 Core Infrastructure Zone (hypervisor, storage, network)
1.2 Exercise Admin (White) Zone (automation, IaC)
Phase 2: Identity & Network Core
2.1 Blue Zone Phase 1 (L3 routing, DNS, AD/LDAP)
2.2 Identity Zone if applicable (IdP, CA)
Phase 3: Internet Simulation
3.1 Grey Zone (root DNS, TLD servers, ISP routing, web content)
Phase 4: Enterprise Services
4.1 Blue Zone Phase 2 (apps, security stack, workstations, firewall lockdown)
Phase 5: Adversary Infrastructure
5.1 Red Zone (C2, exploitation tooling, IP diversity)
Phase 6: Participant Interface
6.1 Access Zone (portal, VM access, comms)
6.2 Metrics Zone (scoring, dashboards)
| Factor | On-Premise | Cloud |
|---|---|---|
| Initial cost | High (hardware) | Low (pay-as-you-go) |
| Setup time | Weeks-months | Hours-days |
| Isolation | Physical air-gap possible | Logical isolation only |
| Scalability | Limited by hardware | Effectively unlimited |
| Compliance | Easier for classified | May require GovCloud |
Without background traffic, adversary activity is trivially detectable.
| Traffic Type | Implementation | Fidelity Impact |
|---|---|---|
| Web browsing | Selenium/Playwright bots | Medium |
| SMTP traffic generation | Medium | |
| File access | SMB/NFS activity scripts | Medium |
| Application use | Protocol-specific generators | High |
| LLM-driven NPCs | Behavioral AI simulation | Ultra-high |
| Level | Scope | Time | Use Case |
|---|---|---|---|
| VM snapshot revert | Single VM | Seconds | Quick undo |
| Team enclave reset | All VMs in team | Minutes | Between rounds |
| Full range reset | Entire range | 30-60 min | Exercise restart |
| Golden image redeploy | Full rebuild | Hours | Major changes |
See reference.md for complete sizing tables, cost models, tool catalogs, ICS/SCADA integration details, image strategy, exercise checklists, skill set requirements, and platform configurations.
See resources/ directory:
architecture/zone-templates.md - Zone architecture templates and diagramsinfrastructure/sizing-calculator.md - Compute/storage/network sizing guidanceimplementation/iac-examples.md - Terraform/Ansible examples for range deploymentimplementation/docker-deployment.md - Docker-based range deployment with working examplestraffic-generation/npc-strategies.md - NPC simulation approaches and toolingexercises/planning-templates.md - Exercise planning and execution templatesSee templates/ directory:
range-design-document.md - Comprehensive range design document templateexercise-plan.md - Exercise planning templateroi-assessment.md - Range ROI and effectiveness assessment templateSee scripts/ directory:
health-check.py - Range health verification scriptreset-orchestrator.py - Automated range reset coordinationProvides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.
npx claudepluginhub dmaynor/dmaynor-skills-marketplace --plugin cyber-range-design