What an adversary profile is

In Morgana Arsenal (MITRE Caldera-based), an Adversary is a structured profile that represents attacker behavior using a curated sequence of abilities mapped to ATT&CK techniques. The profile is used by an operation to execute a controlled chain of actions against target systems and produce measurable outcomes.

How Merlino generates adversaries

Merlino builds adversaries from the technique chains derived in the workbook. Instead of starting in Caldera and manually selecting abilities, Merlino uses its datasets (coverage tables, CTI links, technique selections, and prioritization logic) to produce a complete, ordered chain. The output is then published to Morgana Arsenal as a ready-to-run profile.

• Technique chain creation: Merlino generates ATT&CK-aligned chains based on your selected scope and context.
• Ability mapping: each technique in the chain is mapped to available abilities in Morgana Arsenal.
• Ordering and structure: abilities are ordered into an execution sequence suitable for operations.
• Objective alignment: profiles are tagged and linked to objectives to support repeatable campaigns and governance.
• Publishing: Merlino pushes the final profile to Morgana Arsenal via integration, making it immediately available.

What gets created automatically

Auto-generated adversaries are not placeholders. They are complete, operational entities that can be used immediately in an operation:

• Adversary name and description: consistent naming aligned to the chain purpose and scenario.
• TTP list (Tcodes): technique IDs included in the profile for traceability.
• Abilities: the full ability set mapped from the technique chain.
• Ordered execution plan: a pre-built chain that can be executed without manual sequencing.
• Objectives and metadata: structured attributes that support scheduling, reporting, and reuse.

Why it matters

Building adversary profiles manually is time-consuming and often inconsistent across engagements. Auto-generation standardizes the process and accelerates delivery: you can go from CTI-driven scoping in Merlino to a runnable adversary emulation profile in Morgana Arsenal with minimal effort. This makes Purple Teaming faster, more repeatable, and easier to scale across multiple targets and environments.

Typical workflow

1. Select scope in Merlino: choose techniques, priorities, and chain logic based on CTI and your model.
2. Generate chain: Merlino produces the ordered ATT&CK chain and maps to available abilities.
3. Publish to Morgana Arsenal: adversary profile is created automatically and becomes available immediately.
4. Run operations: use the profile in Morgana Arsenal operations (or from Merlino Tests & Operations).
5. Sync results back: outcomes feed Merlino validation metrics and reporting views.

Note: Auto-generation relies on the technique-to-ability mapping available in Morgana Arsenal. Where multiple abilities exist for the same technique, Merlino uses its chain logic and configuration to select a consistent execution path.