Skip to content

Sandbox environment integration

The Inject Exercise Platform (IXP) allows integration with sandbox virtual machines (VMs) to facilitate hands-on exercises for trainees. This integration enables instructors to capture and analyze the commands executed by trainees within the VM, providing valuable insights into their actions and decision-making processes.

Sandbox exercises

To facilitate an exercise with sandbox integration, follow the steps outlined below:

1. Exercise initiation (Instructor view)

  1. In the Exercise Panel, create an exercise and select "Enable log collection" inside the dialog.
  2. Assign trainees to teams within the exercise.
  3. If the exercise is not on-demand, start the exercise.

2. Exercise execution (Trainee view)

  1. Enter the exercise.
  2. Open the "Sandbox configuration" dialog from the sidebar, and download the provided config.env file.
  3. Move the config.env file into your local client configuration directory and rename it to .env.
  4. Start the sandbox environment using the provided Docker Compose configuration.
  5. Solve the exercise tasks shown in the IXP interface while executing commands in the attacker container of the sandbox environment.

3. Command log analysis (Analyst view)

  1. Analyze the captured command logs in the Analyst view. The logs are shown in the Activity Log and on the Cause and Effect page alongside other trainee activities, and in a dedicated Command Logs page.

Test command logging

To test the command logging functionality, you can use the following curl command to send a test log entry to the IXP backend. Make sure to set the environment variables INJECT_HOST and INJECT_TEAM_TOKEN with the appropriate values from your config.env file before running the command:

curl -X POST "$INJECT_HOST" \
     -H "team-token: $INJECT_TEAM_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
          "@timestamp": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'",
          "cmd": "echo \"This is a test command.\"",
          "cmd_source": "curl",
          "working_directory": "'"$PWD"'",
          "container": "-",
          "username": "'"$USER"'"
     }'

Disclaimer

Each user assigned to an exercise has their own INJECT_TEAM_TOKEN. Keep in mind that users assigned to an exercise as instructors can enter the trainee view of any team, even though they are not assigned to that team. In such cases, the INJECT_TEAM_TOKEN retrieved from the Sandbox Configuration dialog will be different from the token assigned to the team members.

Additionally, administrators with an active elevated session can enter the trainee view of any exercise, even if they are not assigned to that exercise as instructors. However, using elevated sessions to participate in exercises is highly discouraged. Elevated sessions are intended for platform maintenance and managing restricted resource only. To participate in an exercise to which you don't have access, use elevation to grant yourself access, then log out of elevation and participate with your normal session.

In cases where an elevated session is used, the INJECT_TEAM_TOKEN retrieved from the Sandbox Configuration dialog will be empty. As a workaround, such administrators can retrieve the INJECT_TEAM_TOKEN from the exercise details in the Exercise Panel, as they have access to all exercises.