AlphaSOC flightsim2.3.0

AlphaSOC flightsim generates malicious network traffic patterns that let security teams evaluate their controls, detection stack, and network visibility. It is designed for testing blind spots by producing activity that resembles behavior analysts and monitoring systems should detect. Its simulations include DNS tunneling, domain-generation-algorithm (DGA) traffic, requests to known active command-and-control (C2) destinations, and other suspicious patterns.

The utility organizes these checks into separate modules, allowing a team to run one scenario or the complete test set. Running flightsim run executes all available modules through the first available non-loopback network interface. Running flightsim run followed by a module name targets a particular test, while flightsim run --help displays the available modules and their usage.

The get command retrieves information for later simulations; currently, it can obtain C2 family names for use with the C2 module. When many modules are run, flightsim obtains destination addresses from the AlphaSOC API, so the test environment requires egress Internet access. Published by AlphaSOC, version 2.3.0 is freeware for amd64 Linux systems and requires snapd.