Agent KB_modules_p11

Subsystem: modules (page 11 of 14)

Previous: KB_modules_p10.md

modules/obs_parser.py

• Doc: modules/obs_parser.py
• Layer: utility
• Language: py
• Symbols:
  • FindingType (class, line 50) class FindingType(StrEnum)
  • Finding (class, line 66) class Finding
  • Observation (class, line 76) class Observation
  • Extractor (class, line 95) class Extractor(ABC)
  • _ExtractorRegistry (class, line 103) class _ExtractorRegistry
  • _IPExtractor (class, line 127) class _IPExtractor(Extractor)
  • _CredentialExtractor (class, line 145) class _CredentialExtractor(Extractor)
  • _ServiceVersionExtractor (class, line 193) class _ServiceVersionExtractor(Extractor)
  • _PathExtractor (class, line 219) class _PathExtractor(Extractor)
  • _UsernameExtractor (class, line 235) class _UsernameExtractor(Extractor)
  • _HashExtractor (class, line 257) class _HashExtractor(Extractor)
  • _CVEExtractor (class, line 283) class _CVEExtractor(Extractor)
  • _DomainExtractor (class, line 299) class _DomainExtractor(Extractor)
  • _EmailExtractor (class, line 318) class _EmailExtractor(Extractor)
  • _ErrorExtractor (class, line 334) class _ErrorExtractor(Extractor)
  • _CloudIdentityExtractor (class, line 355) class _CloudIdentityExtractor(Extractor)
  • _SuccessDetector (class, line 390) class _SuccessDetector
  • ObsParser (class, line 423) class ObsParser
  • get_parser (function, line 500) def get_parser()
  • parse (function, line 508) def parse(output, host, tool)
  • by_type (method, line 83) def by_type(self, ftype)
  • has (method, line 86) def has(self, ftype)
  • extract (method, line 99) def extract(self, text, host)
  • __init__ (method, line 106) def __init__(self)
  • register (method, line 109) def register(self, extractor)
  • run_all (method, line 112) def run_all(self, text, host)
  • extract (method, line 134) def extract(self, text, host)
  • extract (method, line 175) def extract(self, text, host)
  • extract (method, line 198) def extract(self, text, host)
  • extract (method, line 224) def extract(self, text, host)
  • extract (method, line 245) def extract(self, text, host)
  • extract (method, line 271) def extract(self, text, host)
  • extract (method, line 288) def extract(self, text, host)
  • extract (method, line 305) def extract(self, text, host)
  • extract (method, line 323) def extract(self, text, host)
  • extract (method, line 345) def extract(self, text, host)
  • extract (method, line 367) def extract(self, text, host)
  • is_success (method, line 407) def is_success(self, text)
  • __init__ (method, line 431) def __init__(self)
  • register (method, line 450) def register(self, extractor)
  • parse (method, line 454) def parse(self, output, host, tool)
• Depends on: cli/commands/enum.py, core/logging.py
• Imported by: modules/atomic_exploit_bridge.py, modules/intelligence_engine.py, modules/operation.py, modules/planner.py, modules/playbook_engine.py, skills/autonomous_daemon.py, skills/lazyown_mcp.py, tests/integration_autonomous_flow.py, tests/test_core_modules.py, tests/test_daemon_loop.py, tests/test_phase1_data_gaps.py

modules/ooficesod0woodo.py

• Layer: utility
• Language: py

modules/operation.py

• Doc: Caldera-style operation lifecycle: create, start, pause, resume, stop, status.
• Layer: utility
• Language: py
• Symbols:
  • OperationStatus (class, line 42) class OperationStatus(StrEnum)
  • OpEvent (class, line 52) class OpEvent
  • OperationStep (class, line 63) class OperationStep
  • Operation (class, line 79) class Operation
  • OperationManager (class, line 180) class OperationManager
  • get_manager (function, line 471) def get_manager()
  • to_dict (method, line 98) def to_dict(self)
  • from_dict (method, line 116) def from_dict(cls, d)
  • save (method, line 134) def save(self)
  • log_event (method, line 143) def log_event(self, step_index, step_name, status, summary, findings_count, error)
  • record_facts (method, line 164) def record_facts(self, findings)
  • __init__ (method, line 183) def __init__(self)
  • list (method, line 187) def list(self)
  • get (method, line 199) def get(self, op_id)
  • create (method, line 206) def create(self, name, target, apt_name, description)
  • plan_from_apt (method, line 225) def plan_from_apt(self, op, playbook_yaml_path)
  • start (method, line 287) def start(self, op_id, executor)
  • pause (method, line 369) def pause(self, op_id)
  • resume (method, line 378) def resume(self, op_id, executor)
  • stop (method, line 386) def stop(self, op_id)
  • status (method, line 396) def status(self, op_id)
  • timeline (method, line 425) def timeline(self, op_id)
  • report (method, line 431) def report(self, op_id)
• Depends on: cli/commands/enum.py, core/logging.py, modules/apt_playbooks.py, modules/obs_parser.py, modules/playbook_engine.py, modules/world_model.py
• Imported by: cli/commands/caldera.py

modules/operator_profiles.py

• Doc: Multi-operator profile management for LazyOwn team server.
• Layer: utility
• Language: py
• Symbols:
  • OperatorProfile (class, line 38) class OperatorProfile
  • OperatorProfileManager (class, line 77) class OperatorProfileManager
  • get_operator_profile_manager (function, line 398) def get_operator_profile_manager()
  • to_dict (method, line 57) def to_dict(self)
  • __init__ (method, line 88) def __init__(self)
  • _ensure_team_ca (method, line 93) def _ensure_team_ca(self)
  • _profile_dir (method, line 124) def _profile_dir(self, username)
  • _profile_path (method, line 127) def _profile_path(self, username)
  • _generate_operator_cert (method, line 130) def _generate_operator_cert(self, username)
  • create_profile (method, line 192) def create_profile(self, username, display_name, role, lhost, lport, listener_port, c2_port, c2_malleable_route...
  • _save_profile (method, line 255) def _save_profile(self, profile)
  • load_profile (method, line 260) def load_profile(self, username)
  • update_profile (method, line 276) def update_profile(self, username)
  • delete_profile (method, line 289) def delete_profile(self, username)
  • list_profiles (method, line 300) def list_profiles(self)
  • touch_activity (method, line 312) def touch_activity(self, username)
  • set_attribute (method, line 319) def set_attribute(self, username, key, value)
  • get_attribute (method, line 328) def get_attribute(self, username, key, default)
  • log_action (method, line 335) def log_action(self, username, action, details)
  • effective_config (method, line 360) def effective_config(self, username)
• Depends on: core/config.py, core/logging.py
• Imported by: cli/commands/automation.py

modules/opsec_scorer.py

• Doc: OPSEC scoring engine — pre-execution noise assessment and gated scoring.
• Layer: utility
• Language: py
• Symbols:
  • RiskLevel (class, line 170) class RiskLevel(IntEnum)
  • GateAction (class, line 180) class GateAction(IntEnum)
  • _risk_bucket (function, line 189) def _risk_bucket(noise)
  • _risk_label (function, line 207) def _risk_label(noise)
  • _risk_level (function, line 219) def _risk_level(noise)
  • OpsecContext (class, line 232) class OpsecContext
  • OpsecScore (class, line 265) class OpsecScore
  • GatedOpsecScore (class, line 303) class GatedOpsecScore
  • OpsecScorer (class, line 331) class OpsecScorer
  • OpsecScorerV2 (class, line 559) class OpsecScorerV2
  • score_command (function, line 811) def score_command(command, payload, rhost)
  • to_dict (method, line 288) def to_dict(self)
  • __init__ (method, line 343) def __init__(self, payload, world_model)
  • evasion_active (method, line 352) def evasion_active(self)
  • traffic_morphing_active (method, line 357) def traffic_morphing_active(self)
  • score (method, line 365) def score(self, command, rhost, phase_override)
  • score_batch (method, line 413) def score_batch(self, commands, rhost)
  • suggest_mitigations (method, line 417) def suggest_mitigations(self, command, detectable_by)
  • _estimate_noise (method, line 426) def _estimate_noise(self, command)
  • _phase_mismatch_penalty (method, line 448) def _phase_mismatch_penalty(self, tool_phase, override)
  • _target_sensitivity_bonus (method, line 470) def _target_sensitivity_bonus(self, rhost)
  • _get_host_purpose (method, line 479) def _get_host_purpose(self, rhost)
  • _evasion_reduction (method, line 498) def _evasion_reduction(self, detectable)
  • _gather_mitigations (method, line 510) def _gather_mitigations(self, detectable, noise)
  • _noise_to_risk (method, line 527) def _noise_to_risk(noise)
  • _detection_risk_label (method, line 532) def _detection_risk_label(detectable, noise)
  • _build_recommendation (method, line 544) def _build_recommendation(risk_level, mitigations)
  • __init__ (method, line 617) def __init__(self, context)
  • assess (method, line 622) def assess(self, command, extra_context)
  • should_allow (method, line 696) def should_allow(self, command)
  • get_trend (method, line 709) def get_trend(self)
  • _noise_to_risk (method, line 739) def _noise_to_risk(noise)
  • _risk_to_gate (method, line 743) def _risk_to_gate(self, risk)
  • _generate_mitigations (method, line 753) def _generate_mitigations(noise, detects)
  • _find_alternatives (method, line 777) def _find_alternatives(cmd)
  • _build_explanation (method, line 796) def _build_explanation(cmd, noise, detects, gate)
• Depends on: cli/commands/enum.py, core/config.py, core/logging.py, modules/db.py, modules/killchain.py
• Imported by: cli/commands/opsec_cleanup.py, cli/commands/security.py, tests/test_opsec_scorer.py, tests/test_opsec_scorer_consolidated.py

modules/orchestrator_config.py

• Doc: Operator configuration for the loop core: pipeline stages and auto verbs.
• Layer: infrastructure
• Language: py
• Symbols:
  • _invalidate (function, line 74) def _invalidate()
  • _payload (function, line 82) def _payload()
  • _section (function, line 92) def _section(payload)
  • _save (function, line 97) def _save(payload)
  • stages (function, line 105) def stages()
  • stage_enabled (function, line 130) def stage_enabled(name)
  • set_stage (function, line 136) def set_stage(name, enabled)
  • effective_verbs (function, line 161) def effective_verbs()
  • verb_config (function, line 218) def verb_config(name)
  • verb_enabled (function, line 227) def verb_enabled(name)
  • upsert_verb (function, line 233) def upsert_verb(name)
  • remove_verb (function, line 290) def remove_verb(name)
  • reset (function, line 315) def reset()
• Depends on: core/config.py, modules/auto_registry.py
• Imported by: cli/commands/lazyops.py, cli/lazy_orchestrator.py, modules/auto_registry.py, modules/lazy_loop.py, modules/loop_ai_bridge.py, tests/test_lazy_orchestrator.py

modules/osint_enrich.py

• Doc: Keyless OSINT enrichment for finding evidence.
• Layer: utility
• Language: py
• Symbols:
  • _cache_path (function, line 47) def _cache_path(sessions_dir)
  • _cache_load (function, line 52) def _cache_load(sessions_dir)
  • _cache_save (function, line 61) def _cache_save(sessions_dir, data)
  • _cached (function, line 69) def _cached(sessions_dir, key, ttl)
  • _store (function, line 77) def _store(sessions_dir, key, data)
  • _get_json (function, line 84) def _get_json(url, params)
  • _post_json (function, line 96) def _post_json(url, payload)
  • _get_text (function, line 110) def _get_text(url, params)
  • cve_lookup (function, line 122) def cve_lookup(cve_id, sessions_dir)
  • reverse_dns (function, line 161) def reverse_dns(ip, sessions_dir)
  • host_geo (function, line 183) def host_geo(ip, sessions_dir)
  • domain_exposure (function, line 198) def domain_exposure(domain, sessions_dir)
  • enrich_evidence (function, line 213) def enrich_evidence(items, sessions_dir)
• Imported by: modules/finding_lifecycle.py, tests/test_finding_lifecycle.py

modules/payload_factory.py

• Doc: Native payload generation framework — stagers, stages, singles, formats.
• Layer: infrastructure
• Language: py
• Symbols:
  • _build_linux_x64_reverse_tcp (function, line 118) def _build_linux_x64_reverse_tcp(lhost, lport)
  • _patch_shellcode_x64 (function, line 190) def _patch_shellcode_x64(raw, lhost, lport)
  • PayloadTemplate (class, line 216) class PayloadTemplate(ABC)
  • ReverseShellPayload (class, line 251) class ReverseShellPayload(PayloadTemplate)
  • WindowsReverseShellPayload (class, line 290) class WindowsReverseShellPayload(PayloadTemplate)
  • MsfvenomPayload (class, line 322) class MsfvenomPayload(PayloadTemplate)
  • ShellcodePayload (class, line 363) class ShellcodePayload(PayloadTemplate)
  • DynamicShellcodePayload (class, line 409) class DynamicShellcodePayload(PayloadTemplate)
  • _parse_escaped_hex (function, line 442) def _parse_escaped_hex(escaped)
  • PayloadFactory (class, line 457) class PayloadFactory
  • format_payload_table (function, line 672) def format_payload_table(payloads)
  • __init__ (method, line 222) def __init__(self, name, platform, arch, description, options)
  • generate (method, line 237) def generate(self)
  • to_dict (method, line 241) def to_dict(self)
  • __init__ (method, line 254) def __init__(self)
  • generate (method, line 272) def generate(self)
  • __init__ (method, line 293) def __init__(self)
  • generate (method, line 305) def generate(self)
  • __init__ (method, line 325) def __init__(self, name, platform, arch)
  • generate (method, line 337) def generate(self)
  • __init__ (method, line 374) def __init__(self, name, platform, arch, description, escaped_hex, patcher)
  • generate (method, line 397) def generate(self)
  • __init__ (method, line 416) def __init__(self, name, platform, arch, description, builder)
  • generate (method, line 436) def generate(self)
  • __init__ (method, line 464) def __init__(self)
  • _register_builtins (method, line 468) def _register_builtins(self)
  • register (method, line 512) def register(self, template)
  • list (method, line 516) def list(self, platform)
  • get (method, line 525) def get(self, name)
  • generate (method, line 529) def generate(self, name, format, output)
  • _apply_format (method, line 575) def _apply_format(data, fmt)
  • list_formats (method, line 664) def list_formats()
• Imported by: cli/commands/misc_migrated.py, cli/commands/payload_generation.py, cli/commands/session_ops.py, lazyown.py, scripts/devtools/core_smoke.py, tests/test_payload_factory.py

modules/phishing_orchestrator.py

• Doc: Smart Phishing Campaign Orchestrator.
• Layer: utility
• Language: py
• Symbols:
  • _derive_credential_key (function, line 57) def _derive_credential_key()
  • _encrypt_credential (function, line 84) def _encrypt_credential(plaintext)
  • _decrypt_credential (function, line 100) def _decrypt_credential(encrypted_b64)
  • _hash_credential_for_log (function, line 116) def _hash_credential_for_log(plaintext)
  • CampaignTarget (class, line 139) class CampaignTarget
  • PhishingTemplate (class, line 154) class PhishingTemplate
  • CampaignResult (class, line 167) class CampaignResult
  • PhishingOrchestrator (class, line 180) class PhishingOrchestrator
  • __init__ (method, line 316) def __init__(self)
  • get_instance (method, line 321) def get_instance(cls)
  • launch (method, line 332) def launch(self, target_domain, template, mode, targets_file, sender_email, sender_password, smtp_host, smtp_port)
  • profile_targets (method, line 441) def profile_targets(self, domain)
  • generate_template (method, line 486) def generate_template(self, name, target_domain, context)
  • clone_landing_page (method, line 533) def clone_landing_page(self, url)
  • get_results (method, line 560) def get_results(self, campaign_id)
  • record_click (method, line 584) def record_click(self, campaign_id, email)
  • record_credentials (method, line 605) def record_credentials(self, campaign_id, email, password)
  • _load_targets_from_file (method, line 644) def _load_targets_from_file(self, filepath)
  • _generate_landing_page (method, line 683) def _generate_landing_page(self, template, target_domain, campaign_id)
  • _setup_harvesting_endpoint (method, line 723) def _setup_harvesting_endpoint(self, campaign_id)
  • _send_email (method, line 735) def _send_email(self, to_email, subject, html_body, smtp_config)
  • _inject_harvester (method, line 769) def _inject_harvester(self, html, page_id)
  • _load_config (method, line 808) def _load_config(self)
• Depends on: core/crypto.py, core/hardening.py
• Imported by: cli/commands/phishing_wizard.py, tests/test_security_hardening_v3.py, tests/test_security_hardening_v5.py

modules/pipeline_engine.py

• Doc: modules/pipeline_engine.py — Declarative YAML pipelines for LazyOwn
• Layer: utility
• Language: py
• Symbols:
  • PipelineError (class, line 89) class PipelineError(Exception)
  • PipelineSchemaError (class, line 93) class PipelineSchemaError(PipelineError)
  • PipelineNotFoundError (class, line 97) class PipelineNotFoundError(PipelineError)
  • PipelineCycleError (class, line 101) class PipelineCycleError(PipelineError)
  • PipelineStep (class, line 111) class PipelineStep
  • PipelineSpec (class, line 152) class PipelineSpec
  • StepResult (class, line 163) class StepResult
  • PipelineRun (class, line 199) class PipelineRun
  • _now_iso (function, line 234) def _now_iso()
  • _new_run_id (function, line 238) def _new_run_id()
  • _is_valid_pipeline_name (function, line 242) def _is_valid_pipeline_name(name)
  • _load_payload (function, line 248) def _load_payload()
  • TemplateResolver (class, line 260) class TemplateResolver
  • ConditionEvaluator (class, line 326) class ConditionEvaluator
  • StepValidator (class, line 341) class StepValidator
  • StepDerivers (class, line 375) class StepDerivers
  • _derive_ping (function, line 412) def _derive_ping(output)
  • _derive_lazynmap (function, line 427) def _derive_lazynmap(output)
  • _derive_searchsploit (function, line 453) def _derive_searchsploit(output)
  • _derive_auto_populate (function, line 472) def _derive_auto_populate(output)
  • _derive_facts_show (function, line 481) def _derive_facts_show(output)
  • IStepRunner (class, line 509) class IStepRunner(ABC)
  • LazyOwnStepRunner (class, line 523) class LazyOwnStepRunner(IStepRunner)
  • _heuristic_success (function, line 587) def _heuristic_success(command, output)
  • PipelineLoader (class, line 626) class PipelineLoader
  • RunArtifactStore (class, line 769) class RunArtifactStore
  • INarratorAdapter (class, line 848) class INarratorAdapter(ABC)
  • _SilentNarrator (class, line 863) class _SilentNarrator(INarratorAdapter)
  • EngagementNarratorAdapter (class, line 868) class EngagementNarratorAdapter(INarratorAdapter)
  • PipelineEngine (class, line 908) class PipelineEngine
  • get_default_engine (function, line 1300) def get_default_engine(onecmd)
  • mcp_pipeline_run (function, line 1314) def mcp_pipeline_run(name, target, background, onecmd)
  • mcp_pipeline_list (function, line 1368) def mcp_pipeline_list()
  • mcp_pipeline_validate (function, line 1385) def mcp_pipeline_validate(name)
  • mcp_pipeline_status (function, line 1414) def mcp_pipeline_status(last_n)
  • cmd_pipeline (function, line 1436) def cmd_pipeline(action, name, target, background)
  • to_context (method, line 180) def to_context(self)
  • to_dict (method, line 213) def to_dict(self)
  • __init__ (method, line 275) def __init__(self, context)
  • render (method, line 278) def render(self, template)
  • resolve (method, line 289) def resolve(self, dotted_path)
  • _stringify (method, line 314) def _stringify(value)
  • is_truthy (method, line 330) def is_truthy(rendered)
  • validate (method, line 352) def validate(predicate, output)
  • register (method, line 389) def register(cls, command, deriver)
  • derive (method, line 396) def derive(cls, command, output)
  • run (method, line 513) def run(self, command, args, target, timeout_s)
  • __init__ (method, line 537) def __init__(self, runner, onecmd)
  • run (method, line 548) def run(self, command, args, target, timeout_s)
  • _run_via_onecmd (method, line 566) def _run_via_onecmd(self, command, args, target, timeout_s)
  • __init__ (method, line 638) def __init__(self, pipelines_dir)
  • pipelines_dir (method, line 642) def pipelines_dir(self)
  • list (method, line 645) def list(self)
  • resolve_path (method, line 658) def resolve_path(self, name)
  • _read (method, line 673) def _read(self, path)
  • load (method, line 683) def load(self, name)
  • _validate (method, line 689) def _validate(self, raw, name, source)
  • __init__ (method, line 778) def __init__(self, runs_dir)
  • runs_dir (method, line 782) def runs_dir(self)
  • open_run (method, line 785) def open_run(self, pipeline_name, run_id)
  • write_plan (method, line 797) def write_plan(self, run_dir, spec)
  • write_step (method, line 814) def write_step(self, run_dir, result)
  • write_summary (method, line 828) def write_summary(self, run_dir, run)
  • narrate (method, line 852) def narrate(self, kind, target, message, payload, severity)
  • narrate (method, line 864) def narrate(self)
  • __init__ (method, line 871) def __init__(self, narrator)
  • narrate (method, line 881) def narrate(self, kind, target, message, payload, severity)
  • __init__ (method, line 927) def __init__(self, runner, loader, artifact_store, narrator, max_nesting)
  • loader (method, line 942) def loader(self)
  • validate (method, line 945) def validate(self, name)
  • run (method, line 949) def run(self, name, target, nesting_stack)
  • _run_command (method, line 1077) def _run_command(self, step, resolver, target)
  • _run_nested (method, line 1126) def _run_nested(self, step, resolver, target, stack, run)
  • _run_hook (method, line 1178) def _run_hook(self, hook_command, target, timeout_s)
  • _make_skipped (method, line 1206) def _make_skipped(step, reason)
  • _build_context (method, line 1221) def _build_context(self, spec, target, step_results, derived_findings, current_step)
  • _merge_findings (method, line 1246) def _merge_findings(derived_findings, result)
  • _narrate_step (method, line 1256) def _narrate_step(self, result, target)
  • _worker (function, line 1344) def _worker()
  • _replace (function, line 282) def _replace(match)
• Depends on: core/logging.py, modules/engagement_hooks.py, skills/autonomous_daemon.py
• Imported by: cli/commands/session_ops.py, modules/playbook_executor.py, skills/autonomous_daemon.py, skills/lazyown_mcp.py, tests/test_pipeline_engine.py

modules/planner.py

• Doc: Fact-based planner — decides the next ability to run.
• Layer: utility
• Language: py
• Symbols:
  • PlanCandidate (class, line 41) class PlanCandidate
  • PlanResult (class, line 54) class PlanResult
  • _gather_facts (function, line 64) def _gather_facts(world_model, obs_parser)
  • _risk_for (function, line 160) def _risk_for(technique_id)
  • _score_step (function, line 225) def _score_step(step, facts)
  • Planner (class, line 260) class Planner
  • get_planner (function, line 446) def get_planner(api_key)
  • TodoItem (class, line 452) class TodoItem
  • TodoList (class, line 460) class TodoList
  • Frontier (class, line 505) class Frontier
  • __init__ (method, line 269) def __init__(self, world_model, obs_parser, api_key)
  • _wm (method, line 279) def _wm(self)
  • _parser (method, line 294) def _parser(self)
  • plan (method, line 313) def plan(self, target, max_candidates)
  • _build_rationale (method, line 374) def _build_rationale(chosen, facts, target)
  • _llm_tiebreak (method, line 387) def _llm_tiebreak(self, target, facts, candidates)
  • to_dict (method, line 413) def to_dict(self, result)
  • __init__ (method, line 468) def __init__(self)
  • todo_add (method, line 472) def todo_add(self, name, requires)
  • todo_done (method, line 478) def todo_done(self, name)
  • next_ready (method, line 489) def next_ready(self)
  • blocks (method, line 497) def blocks(self, tactic)
  • __init__ (method, line 514) def __init__(self, planner, todos)
  • todos (method, line 523) def todos(self)
  • tried (method, line 528) def tried(self)
  • refill (method, line 532) def refill(self, target, max_intents)
  • pop (method, line 551) def pop(self)
  • __len__ (method, line 560) def __len__(self)
• Depends on: core/logging.py, modules/llm_client.py, modules/obs_parser.py, modules/playbook_engine.py, modules/world_model.py
• Imported by: cli/commands/caldera.py, cli/commands/session_ops.py, skills/autonomous_daemon.py, skills/lazyown_mcp.py, tests/test_autonomous_ops.py, tests/test_daemon_loop.py, tests/test_engage_gates.py, tests/test_lazy_parity.py

modules/playbook_engine.py

• Doc: modules/playbook_engine.py
• Layer: utility
• Language: py
• Symbols:
  • PlaybookStep (class, line 101) class PlaybookStep
  • Playbook (class, line 133) class Playbook
  • StepResult (class, line 165) class StepResult
  • PlaybookResult (class, line 173) class PlaybookResult
  • _StixLoader (class, line 185) class _StixLoader
  • _AtomicIndex (class, line 254) class _AtomicIndex
  • _TechniqueSelector (class, line 311) class _TechniqueSelector
  • PlaybookEngine (class, line 375) class PlaybookEngine
  • get_engine (function, line 660) def get_engine(api_key)
  • to_dict (method, line 113) def to_dict(self)
  • from_dict (method, line 128) def from_dict(cls, d)
  • to_dict (method, line 141) def to_dict(self)
  • from_dict (method, line 152) def from_dict(cls, d)
  • __init__ (method, line 188) def __init__(self, json_path)
  • available (method, line 192) def available(self)
  • store (method, line 195) def store(self)
  • techniques_for_tactics (method, line 210) def techniques_for_tactics(self, tactic_shortnames, platform)
  • __init__ (method, line 260) def __init__(self, atomics_path)
  • available (method, line 264) def available(self)
  • build (method, line 267) def build(self)
  • tests_for_technique (method, line 300) def tests_for_technique(self, technique_id, platform)
  • select (method, line 317) def select(self, candidates, world_context, target, phase, api_key, top_n)
  • __init__ (method, line 387) def __init__(self, world_model, obs_parser, api_key, top_n)
  • _world_model (method, line 404) def _world_model(self)
  • _obs_parser (method, line 415) def _obs_parser(self)
  • derive (method, line 427) def derive(self, target, phase, platform, apt_name)
  • execute (method, line 529) def execute(self, playbook, executor, dry_run)
  • save (method, line 590) def save(self, playbook, path)
  • load (method, line 602) def load(self, path)
  • result_summary (method, line 631) def result_summary(self, result)
  • _local_executor (function, line 713) def _local_executor(command, host)
• Depends on: core/logging.py, core/safe_exec.py, modules/llm_client.py, modules/obs_parser.py, modules/world_model.py
• Imported by: cli/commands/caldera.py, cli/commands/mcp_bridge.py, modules/operation.py, modules/planner.py, skills/lazyown_mcp.py, tests/test_core_modules.py

modules/playbook_executor.py

• Doc: Playbook Executor — bridges MITRE ATT&CK playbooks to the pipeline engine.
• Layer: utility
• Language: py
• Symbols:
  • PlaybookTechnique (class, line 36) class PlaybookTechnique
  • PlaybookSpec (class, line 48) class PlaybookSpec
  • PlaybookRunResult (class, line 61) class PlaybookRunResult
  • ITTPMapper (class, line 93) class ITTPMapper(ABC)
  • DefaultTTPMapper (class, line 101) class DefaultTTPMapper(ITTPMapper)
  • PlaybookLoader (class, line 203) class PlaybookLoader
  • _build_pipeline_yaml (function, line 285) def _build_pipeline_yaml(playbook, mapper, platform)
  • PlaybookEngine (class, line 336) class PlaybookEngine
  • playbook_list (function, line 416) def playbook_list()
  • playbook_analyze (function, line 422) def playbook_analyze(name, platform)
  • playbook_generate (function, line 429) def playbook_generate(name, platform)
  • playbook_run (function, line 436) def playbook_run(name, platform, target, onecmd)
  • to_dict (method, line 74) def to_dict(self)
  • resolve (method, line 97) def resolve(self, technique_id, atomic_test, platform)
  • register (method, line 180) def register(cls, technique_id, platform, command)
  • resolve (method, line 185) def resolve(self, technique_id, atomic_test, platform)
  • __init__ (method, line 208) def __init__(self, playbooks_dir)
  • list (method, line 211) def list(self)
  • load (method, line 224) def load(self, name)
  • _validate (method, line 235) def _validate(self, raw, source_path)
  • __init__ (method, line 339) def __init__(self, loader, mapper, pipelines_dir)
  • loader (method, line 350) def loader(self)
  • analyze (method, line 353) def analyze(self, name, platform)
  • generate_pipeline (method, line 378) def generate_pipeline(self, name, platform)
  • run (method, line 390) def run(self, name, platform, target, onecmd)
• Depends on: modules/pipeline_engine.py

modules/polymorphic_engine.py

• Doc: Polymorphic code generation engine — shellcode mutation and obfuscation.
• Layer: utility
• Language: py
• Symbols:
  • MutationConfig (class, line 93) class MutationConfig
  • MutationResult (class, line 126) class MutationResult
  • PolymorphicEngine (class, line 146) class PolymorphicEngine
  • __init__ (method, line 159) def __init__(self, config)
  • mutate (method, line 163) def mutate(self, shellcode, arch)
  • _single_pass (method, line 184) def _single_pass(self, data, arch, pass_num, original_size)
  • _nop_substitution (method, line 231) def _nop_substitution(self, data, arch)
  • _nop_insertion (method, line 253) def _nop_insertion(self, data, arch)
  • _register_reassignment (method, line 262) def _register_reassignment(self, data, arch)
  • _junk_insertion (method, line 282) def _junk_insertion(self, data, arch)
  • _xor_encrypt (method, line 303) def _xor_encrypt(self, data, arch)
  • _multi_xor_encrypt (method, line 309) def _multi_xor_encrypt(self, data)
  • _compress_data (method, line 324) def _compress_data(self, data)
  • _base64_wrap (method, line 330) def _base64_wrap(self, data, arch)
  • _estimate_entropy (method, line 344) def _estimate_entropy(data)
  • decode_xor (method, line 361) def decode_xor(data)
  • decode_multi_xor (method, line 377) def decode_multi_xor(data)
  • generate_decoder_stub (method, line 397) def generate_decoder_stub(self, arch)
  • get_audit_summary (method, line 422) def get_audit_summary(self)
• Imported by: cli/commands/payload_arsenal.py

Next: KB_modules_p12.md