Defenses Plugins
Defenses set up the blue side of a lab. Some plugins strip out built-in protections (so attacks can succeed); others stand up entire EDR/NSM stacks for detection scenarios. Pair these with Attacks and Vulnerabilities to build complete red-vs-blue exercises.
Available plugins
Section titled “Available plugins”| Plugin | What it does | Params | Uses |
|---|---|---|---|
| Remove Windows Defender | Removes Windows Defender antivirus completely. Adds exclusion paths, runs delete scripts as SYSTEM via scheduled tasks, reboots, and verifies the WinDefend service is gone. | — | 1,308 |
| Install Elastic Agent | Deploys Elastic Agent (v8.12.2) on Windows with Fleet enrollment. Fetches an enrollment token from the configured Elastic server, installs, and reboots. | ElasticParentDesiredDomainName InstallImmediately | 172 |
| Install Elastic Server | Deploys the full Elastic Stack v8.12.2 (Elasticsearch + Kibana + Fleet + package registry). Takes 20+ minutes to install — be patient. | ElasticPassword DesiredStaticIPAddress TakeActionBlockThreats InstallImmediately DesiredDomainName | 35 |
| ICS Network Security Monitor | Installs Zeek with CISA ICSNPP parsers to monitor live OT VLAN traffic and produce structured modbus.log, dnp3.log, enip.log, bacnet.log, and s7comm.log decode logs. | MonitorInterface LogDirectory EnabledProtocols LocalNetworks JsonLogs PromiscuousMode ShipLogsToSOHost | 3 |
| Security Onion NSM | Installs Security Onion 2.4 standalone in airgap mode on Oracle Linux 9 — full NSM stack with Zeek + ICS protocol parsers, Suricata IDS, Elasticsearch, Kibana, and Grafana. | MonitorInterface AdminPassword ManagementInterface AdminEmail AllowedAnalystCIDR SuricataRuleset AcceptExternalLogs SOIsoFilename | 3 |
| Install Elastic for Debian | Installs the Elastic Agent on Debian/Ubuntu with Fleet enrollment — auto-discovers the Fleet server from the canvas and enrolls. | ElasticParentDesiredDomainName InstallImmediately | 1 |