API docs by Redocly

Redteam API (5.3.4)

Download OpenAPI specification:

URL: https://mantis-platform.io License: Proprietary — © AMOSSYS

The Redteam API controls the automated red-team platform running inside a lab. Use it to inspect attacker sessions and to play actions on a running lab: run custom shell commands, execute Atomic Red Team tests, upload files, and read the attack report.

Base URL (per lab)

Unlike the Scenario API, the Redteam API is reached per lab, through the platform gateway proxy:

https://app.<your-domain>/proxy/<lab-id>/api/redteam

Get <lab-id> from the Scenario API (GET /scenario/run_lab returns it, or list labs via GET /runner/). Fill both values in the Servers selector above.

Authentication

Requests go through the OIDC-authenticated gateway, so pass the same Authorization: Bearer <token> header as for the Scenario API — see the Authentication guide.

Execution model (asynchronous)

Command execution is asynchronous. POST /command (and POST /atomic) queue work and return an identifier immediately; you then poll GET /command/{id} until its status is terminal and read its output. Commands run against an existing attack session (a foothold), identified by its identifier from GET /attack_sessions.

See the Red-team operations guide for an end-to-end walkthrough.

Version

Get component version.

Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/version"

Response samples

Content type
application/json
"string"

Read Attacks

Authorizations:
OpenIdConnect
query Parameters
Status (string) or Status (null) (Status)

Filter the results by status.

Ordered (boolean) or Ordered (null) (Ordered)
Default: false

If true, return the results in execution order.

Name (string) or Name (null) (Name)

Filter the results by name.

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/attack"

Response samples

Content type
application/json
[
  • {
    }
]

Restoration

Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/restoration"

Response samples

Content type
application/json
null

Report

Generate attack report.

Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/report"

Response samples

Content type
application/json
[
  • {
    }
]

Read Attack

Authorizations:
OpenIdConnect
path Parameters
attack_id
required
integer (Attack Id)

Identifier of an attack in the knowledge base.

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/attack/<attack_id>"

Response samples

Content type
application/json
{
  • "idAttack": 0,
  • "status": "string",
  • "created_date": "",
  • "started_date": "",
  • "last_update": "",
  • "commands": { },
  • "values": "string",
  • "output": { },
  • "sources": [
    ],
  • "iocs": [
    ],
  • "infrastructure": { },
  • "docker_id": "string",
  • "worker": {
    },
  • "user_activity": {
    },
  • "custom_attack": {
    }
}

Execute Attack

Authorizations:
OpenIdConnect
path Parameters
attack_id
required
integer (Attack Id)

Identifier of an attack in the knowledge base.

Responses

Request samples 

curl -X POST "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/attack/<attack_id>/play"

Response samples

Content type
application/json
{
  • "idAttack": 0,
  • "status": "string",
  • "created_date": "",
  • "started_date": "",
  • "last_update": "",
  • "commands": { },
  • "values": "string",
  • "output": { },
  • "sources": [
    ],
  • "iocs": [
    ],
  • "infrastructure": { },
  • "docker_id": "string",
  • "worker": {
    },
  • "user_activity": {
    },
  • "custom_attack": {
    }
}

Get Latest User Activity

Retrieve the latest UserActivity based on the highest user_activity_id.

Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/user_activity/latest"

Response samples

Content type
application/json
{
  • "idAttack": 0,
  • "status": "string",
  • "created_date": "",
  • "started_date": "",
  • "last_update": "",
  • "commands": { },
  • "values": "string",
  • "output": { },
  • "sources": [
    ],
  • "iocs": [
    ],
  • "infrastructure": { },
  • "docker_id": "string",
  • "worker": {
    },
  • "user_activity": {
    },
  • "custom_attack": {
    }
}

Register User Activity

Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X POST "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/user_activity/register"

Response samples

Content type
application/json
{ }

Get Logs

Display all Docker logs (start and stop workers), and return a dict where keys are attack IDs (or a docker ID if not associated with an attack) and values are worker docker logs.

Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/logs"

Response samples

Content type
application/json
{
  • "property1": [
    ],
  • "property2": [
    ]
}

Get Worker Logs

Display a specific Docker logs, and return a dict where keys are attack IDs (or a docker ID if not associated with an attack) and values are worker docker logs.

Authorizations:
OpenIdConnect
path Parameters
attack_id
required
integer (Attack Id)

Identifier of an attack in the knowledge base.

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/logs/<attack_id>"

Response samples

Content type
application/json
[
  • "string"
]

Clean Redteam Platform

Quick platform reset :

  • Knowledge database reset
  • Destroy all attack workers
Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X DELETE "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/platform"

Response samples

Content type
application/json
{
  • "message": "string"
}

Get Tactics

List all attack tactics (based on MITRE ATT&CK).

Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/tactic"

Response samples

Content type
application/json
[
  • {
    }
]

Get Workers

List all attack workers known by this platform.

Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/worker"

Response samples

Content type
application/json
[
  • {
    }
]

Get Worker

Authorizations:
OpenIdConnect
path Parameters
worker_id
required
string (Worker Id)

Identifier of a red-team worker.

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/worker/<worker_id>"

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "title": "string",
  • "title_fr": "string",
  • "description": "string",
  • "cve": [
    ],
  • "version": "string",
  • "side_effects": "string",
  • "topics": "string",
  • "repeatable": true,
  • "mitre_data": {
    },
  • "attack_mode": "string",
  • "bas_compat": false,
  • "options": [ ],
  • "destination_port": 0
}

Get Attack Sessions

Display informations known by attacker about hosts and attack session.

Authorizations:
OpenIdConnect

Responses

Request samples 

curl "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/attack_sessions" \
  -H "Authorization: Bearer $TOKEN"

Response samples

Content type
application/json
{
  • "attack_sessions": [
    ]
}

Get Infrastructures

Display informations known by attacker about hosts and attack session.

Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/attack_infrastructures"

Response samples

Content type
application/json
{
  • "attack_infrastructures": [
    ]
}

Get Knowledge

Display informations known by attacker about hosts and attack session.

Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/attack_knowledge"

Response samples

Content type
application/json
{
  • "hosts": [
    ],
  • "network_interfaces": [
    ],
  • "services": [
    ],
  • "softwares": [
    ],
  • "credentials": [
    ],
  • "payloads": [
    ],
  • "files": [
    ],
  • "ad_groups": [
    ]
}

Add Data To Knowledgedb

Add informations in knowledge database to generate new attack.

Authorizations:
OpenIdConnect
Request Body schema: application/json
required
topic_name
required
string (Topic Name)

Knowledge topic (RabbitMQ routing key).

topic_data
required
Array of any (Topic Data)

Entries to add for this topic; each is published to the worker.

Responses

Request samples

Content type
application/json
{
  • "topic_name": "string",
  • "topic_data": [
    ]
}

Response samples

Content type
application/json
{
  • "status": "string"
}

Get Commands

Authorizations:
OpenIdConnect

Responses

Request samples 

curl -X GET "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/command"

Response samples

Content type
application/json
[
  • {
    }
]

Send Command

Authorizations:
OpenIdConnect
Request Body schema: application/json
required
command
required
string (Command)
identifier
required
string (Identifier)
title
string (Title)
Default: "CUSTOM EXECUTION"

Responses

Request samples

Content type
application/json
{
  • "command": "string",
  • "identifier": "string",
  • "title": "CUSTOM EXECUTION"
}

Response samples

Content type
application/json
{
  • "idResultCommand": 0
}

Get Command

Authorizations:
OpenIdConnect
path Parameters
idResultCommand
required
string (Idresultcommand)

Identifier returned by POST /command (or POST /atomic).

Responses

Request samples 

curl "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/command/42" \
  -H "Authorization: Bearer $TOKEN"
# -> { "id": 42, "status": "success", "command": "whoami", "output": "nt authority\\system", ... }

Response samples

Content type
application/json
{
  • "id": "string",
  • "uid": "string",
  • "title": "string",
  • "mitre_tag": "string",
  • "status": "string",
  • "command": "string",
  • "output": "string",
  • "description": "string",
  • "attack_session_id": "string",
  • "target_ip": "string"
}

Execute Atomic

This methods adds Atomic tests to the list of custom commands to execute, and returns the list of attack result IDs.

Caller of this API can then request the /get_command with an attack result ID to get the command status.

Authorizations:
OpenIdConnect
query Parameters
attack_session_identifier
required
string (Attack Session Identifier)

Identifier of the target attack session (from GET /attack_sessions).

Request Body schema: multipart/form-data
required
upload_file
required
string <binary> (Upload File)

Responses

Request samples 

# Run an Atomic Red Team test file against an attack session.
# Returns a list of command ids; poll GET /command/{id} for each.
curl -X POST "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/atomic?attack_session_identifier=<attack-session-identifier>" \
  -H "Authorization: Bearer $TOKEN" \
  -F "upload_file=@T1053.003.yaml"

Response samples

Content type
application/json
[
  • "string"
]

Upload

Authorizations:
OpenIdConnect
query Parameters
identifier
required
string (Identifier)

Identifier of the target attack session (from GET /attack_sessions).

Request Body schema: multipart/form-data
required
upload_file
required
string <binary> (Upload File)

Responses

Request samples 

curl -X POST "https://app.mantis-platform.io/proxy/LAB_ID/api/redteam/upload?identifier=<attack-session-identifier>" \
  -H "Authorization: Bearer $TOKEN" \
  -F "upload_file=@./payload.exe"

Response samples

Content type
application/json
{
  • "idResultCommand": 0
}