cmu-sei/GHOSTS

What is it?

Key features

• 01Simulates NPC user activity across desktop applications, browsers, and network services.
• 02Provides Windows, Universal (cross-platform), and Lite clients for different environments.
• 03Includes a web management UI built with Angular for machines, groups, timelines, and scenarios.
• 04Generates NPC personas with names, careers, and social networks.
• 05Integrates with n8n for scheduled workflows and with Grafana for activity dashboards.
• 06Runs as a Docker Compose stack with PostgreSQL and a REST API.

Use cases

• Populating cyber training environments with realistic user activity.
• Generating background noise during red team assessments.
• Creating network traffic for blue team detection and analysis practice.
• Building cognitive range environments with autonomous NPCs.

Quick start

1. 1

   Create a working folder

   mkdir ghosts && cd ghosts
2. 2

   Download the Docker Compose file

   curl -O https://raw.githubusercontent.com/cmu-sei/GHOSTS/master/src/Ghosts.Api/docker-compose.yml
3. 3

   Copy .env.example to .env and set POSTGRES_PASSWORD

4. 4

   Start the stack

   docker compose up -d

Things to know

• !The README says GHOSTS 9 is under active development, so expect changes in minor releases until 10.0.
• !Running the full stack needs Docker and a PostgreSQL password set in .env.
• !Each machine you want to simulate needs a separately installed client.

In collections

Topics

FAQ

What is GHOSTS?

A C#-based NPC framework that simulates realistic user activity on computers and networks for cyber training, exercises, and research. GHOSTS is an orchestration framework for non-player characters (NPCs) that behave like human users on computer systems. Each simulated user performs activity across applications, networks, and workflows, generating realistic network traffic and leaving behind artifacts that resemble real use. It is aimed at cyber training, exercises, research, and simulation environments where background user activity is needed.

Is GHOSTS free to use? What license does it have?

GHOSTS is open source under the Other license. Check the license terms before using it in commercial products.

Is GHOSTS still maintained?

Actively maintained. The last commit to GHOSTS was on Nov 3, 2026.

What can I use GHOSTS for?

Populating cyber training environments with realistic user activity. Generating background noise during red team assessments. Creating network traffic for blue team detection and analysis practice. Building cognitive range environments with autonomous NPCs.

How do I install GHOSTS?

Create a working folder: mkdir ghosts && cd ghosts Download the Docker Compose file: curl -O https://raw.githubusercontent.com/cmu-sei/GHOSTS/master/src/Ghosts.Api/docker-compose.yml Copy .env.example to .env and set POSTGRES_PASSWORD Start the stack: docker compose up -d

Where can I get GHOSTS?

The source code and installation instructions are on GitHub: https://github.com/cmu-sei/GHOSTS