Defenses Plugins
Defenses set up the blue side of a lab. Some plugins remove built-in protections so attacks can succeed. Others set up whole EDR/NSM stacks for detection scenarios. Pair them with Attacks and Vulnerabilities to build complete red-vs-blue exercises.
Available plugins
Section titled “Available plugins”| Plugin | What it does | Params | Uses |
|---|---|---|---|
| Remove Windows Defender | Removes Windows Defender antivirus completely. Adds exclusion paths, runs delete scripts as SYSTEM via scheduled tasks, reboots, and verifies the WinDefend service is gone. | None | 1,308 |
| Install Elastic Agent | Deploys Elastic Agent (v8.12.2) on Windows with Fleet enrollment. Fetches an enrollment token from the configured Elastic server, installs, and reboots. | ElasticParentDesiredDomainName InstallImmediately | 172 |
| Install Elastic Server | Deploys the full Elastic Stack v8.12.2 (Elasticsearch + Kibana + Fleet + package registry). Expect the install to take 20+ minutes. | ElasticPassword DesiredStaticIPAddress TakeActionBlockThreats InstallImmediately DesiredDomainName | 35 |
| ICS Network Security Monitor | Installs Zeek with CISA ICSNPP parsers to monitor live OT VLAN traffic and produce structured modbus.log, dnp3.log, enip.log, bacnet.log, and s7comm.log decode logs. | MonitorInterface LogDirectory EnabledProtocols LocalNetworks JsonLogs PromiscuousMode ShipLogsToSOHost | 3 |
| Security Onion NSM | Installs Security Onion 2.4 standalone in airgap mode on Oracle Linux 9. The full NSM stack includes Zeek with ICS protocol parsers, Suricata IDS, Elasticsearch, Kibana, and Grafana. | MonitorInterface AdminPassword ManagementInterface AdminEmail AllowedAnalystCIDR SuricataRuleset AcceptExternalLogs SOIsoFilename | 3 |
| Install Elastic for Debian | Installs the Elastic Agent on Debian/Ubuntu with Fleet enrollment. It finds the Fleet server on the canvas automatically and enrolls. | ElasticParentDesiredDomainName InstallImmediately | 1 |