> ## Documentation Index
> Fetch the complete documentation index at: https://dsp.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Detection Scenario Platform

> Generate realistic security activity and evidence for repeatable XDR and NDR customer POC validation.

# Detection Scenario Platform (DSP)

**Generate realistic, observable security activity for XDR and NDR customer POC validation.**

DSP helps POC engineers create repeatable security activity when a customer environment is too quiet to produce enough useful detections during an evaluation. It discovers reachable targets, executes controlled scenarios, records what happened, and produces evidence that can be compared with XDR/NDR detections.

<Note>
  DSP proves **what activity it generated**. It does not automatically claim that an alert fired or that an XDR case was successfully correlated. Detection and case outcomes must be verified in the connected security platform.
</Note>

## Fastest path

<Steps>
  <Step title="Install DSP">
    On a Linux host with Python 3.11+, Git, and curl:

    ```bash theme={null}
    curl -fsSL https://raw.githubusercontent.com/xdr-labs/xdr-poc-script/release/v1.4.0-rc/install-dsp.sh | bash
    ```
  </Step>

  <Step title="Configure the first run">
    In the menu choose **Configure environment**, set the authorized target CIDR, select **local**, and use **normal** for the first test.
  </Step>

  <Step title="Run and review">
    Choose **Run scenario**, then **Show latest report** to review what DSP generated.
  </Step>
</Steps>

<CardGroup cols={2}>
  <Card title="Quick Start" icon="rocket" href="/quickstart">
    Use the simplest local-mode path from prerequisites to the first report.
  </Card>

  <Card title="POC Workflow" icon="diagram-project" href="/poc-program">
    See how target discovery, controlled activity, NDR/XDR detection review, and evidence fit together.
  </Card>

  <Card title="Scenario Coverage" icon="radar" href="/scenarios">
    Review the current network, DNS, web, identity, and host-behavior scenarios.
  </Card>

  <Card title="XDR Correlation Demo" icon="link" href="/xdr-correlation-demo">
    Combine DSP evidence, NDR detections, and optional external alerts into an XDR investigation story.
  </Card>
</CardGroup>

## What you need

For the simplest first run, prepare:

* a Linux operator host with **Python 3.11+**, `git`, and `curl`
* an **authorized target CIDR**
* network reachability from the DSP host to that target network
* access to the XDR/NDR console for detection review

Normal DSP execution does **not** require an XDR API token. Webshell mode is optional and should be used only when activity must originate from an authorized host inside the target environment.

## What DSP gives you

<CardGroup cols={2}>
  <Card title="Controlled scenarios" icon="crosshairs">
    Generate repeatable scan, DNS, web, identity, protocol, and host-behavior activity.
  </Card>

  <Card title="Discovery-driven execution" icon="magnifying-glass">
    Start from a CIDR and let DSP use discovered hosts/services to drive scenario execution.
  </Card>

  <Card title="Evidence per run" icon="file-lines">
    Keep structured events, traffic summaries, validation output, reports, and verification templates under one run ID.
  </Card>

  <Card title="Simple coverage profiles" icon="sliders">
    Use `normal` for representative targets or `high` to apply the same per-target volume across more discovered targets.
  </Card>
</CardGroup>

## Current validation boundary

DSP v1.4.0 is documented as **READY WITH KNOWN LIMITATIONS**. Local execution plus real JSP and PHP webshell execution are validated. ASPX/Windows IIS remains preview because real Windows webshell runtime validation is still pending.

<Card title="Check validation status" icon="circle-check" href="/validation-status">
  Review the exact provider and platform boundaries before a customer POC.
</Card>