Fact sources corruption

[mgonzcast]

Not sure if this is a bug, I attach two pictures. I am running caldera 5.0.3

I have noticed a strange behaviour with the facts source. Since I have setup an operation for testing Oilrig emulation I take the last operation and re run it. Well, everytime I check the fact sources, a new fact source seems to be created apart of the real one with strange data. You can see that apart of the Oilrig Test Fact source a bunch of Oilrig Test fact sources has been created with timeline names, probably kind of temporary files?

[deacon-mp]

When an operation is run and abilities are executed. New facts are gathered based on the results of those abilities. So a new fact source is generated per Operation.

This is useful in the reporting aspect. Say you do enumeration and you get some usernames. These are added as facts to the operation and can be used in later abilities in that operation.

Instead of manually adding these as white cards for the next operation or a re-run that new fact source is made available under the operation name.

There could be better ways to do this. But the intent of creating and providing a fact source(white cards in essence) prior to an operation is to better represent or provide INITIAL known data. Remember you can run an adversary/operation in many different environments that have there nuances like IP ranges, usernames etc. (This would be more in the simulation aspect)

Does this help to answer the question or am I missing the Ah Ha piece to your question?

[mgonzcast]

Ahh ok! Makes sense then. I had the idea that the fact sources where sort of configuration file for an operation

[uruwhy]

@mgonzcast did you need anything else regarding this issue or shall I close it?