Client Emulator
Tool Sandbox
Client Tool Emulator

The client's security stack,
emulated end to end.

Vendor-faithful mock APIs for 23 security tools, wrapped in an adapter platform: credentialed connections, scheduled discovery, a session-reusing gateway, and a correlated asset inventory. Build and break agent workflows safely — before they ever touch a client environment.

One endpoint, any tool — through a connectionlive example
$ curl -s $BASE/api/gateway/con_9f27c1/devices/entities/devices/v2
HTTP/1.1 200 · x-emu-tool: crowdstrike · x-emu-session-reused: true
{ "resources": [ { "hostname": "LT-FIN-001", "serial_number": "5CG2W1014F", "platform_name": "Windows" }, … ] }
# the same serial appears in Qualys, Trellix and Intune — one correlated asset, four sources
0
Tools emulated
across 19 security categories
0
Vendor-faithful endpoints
real paths, auth schemes, field names
0
Emittable event types
HMAC-signed webhook delivery
0
Simulated fleet assets
60 devices · 40 users
How it works

The full adapter loop, from credentials to correlated assets

01
Connect

Add a credentialed connection per tool. A real API key is provisioned behind it — auth is enforced, not painted on.

02
Verify

Heartbeats probe each vendor mock through the gateway. Status reflects what actually answered.

03
Discover

Scheduled fetches pull inventory through one session-reusing endpoint, with per-run history.

04
Correlate

Records from different tools merge into single assets — the matching rule is recorded on every source.

05
Break

Revoke credentials, force outages, inject latency. Watch lifecycle, fetch history and freshness respond.

What's inside

Built like the platforms it stands in for

The emulator mirrors how real asset platforms integrate with security tools — 15 adapters run scheduled discovery against a shared, deterministic fleet, so cross-tool correlation genuinely works.

Vendor-faithful mocks

CrowdStrike, Qualys, Entra, Zscaler and more — real API shapes with deterministic, seeded responses. Same input, same answer, every time.

One gateway, every tool

A single endpoint per connection injects each vendor's auth scheme and reuses live sessions. Issued-vs-reused counters are visible, not implied.

Honest connection lifecycle

Connections move through pending, connected, degraded and error based on real probe outcomes, with a full event trail.

Explainable correlation

Devices merge on serial, MAC, then hostname; users on email. Every merged source keeps the rule that matched it and the raw evidence.

Failure on demand

Per-connection faults (revoked credentials, outage, slowness) and per-tool scenarios (latency, error rates, forced statuses) make chaos testing a first-class feature.

Events and automation

Domain events publish to subscribers with HMAC signatures; scheduled generators keep the environment alive without anyone touching it.

Ready to point an agent at it?

Sign in, add a connection, run a discovery, and query the correlated inventory — the whole loop takes about two minutes.