Skip to content

Database and data model

What lives in PostgreSQL (106 tables in both editions — the schema is shared; Core creates EE tables it never writes, which is why edition upgrades are image swaps). Administrator/developer-oriented summary, grouped by domain.

Identity and access

users (roles, TOTP secrets encrypted), global_settings (platform keypair, module state), organizations/teams/membership tables, project_members with the 11 roles, invitations, org plans (EE entitlement cache), oidc_providers / oidc_identities / oidc_auth_states (client secrets encrypted).

Engagement entities

projects (webhook token, org link, env vars), scopes, ROE, hosts, host activities, pivot observations, host claims (deconfliction), creds + cred-host notes, project secrets, loots, findings + templates, notes + attachments, objectives, tasks/remediations/ evidence/identities, timeline events (audit trail), networks/nodes/ edges/regions, attack-path tables, entity links, KB articles, snippets, jobs + playbook runs/custom playbooks/schedules/operation packs, scan and project snapshots, surface watches, decommission reports.

EE runtime (schema shared, writers EE-only)

infra providers/nodes/templates/blueprints/stacks/services/tokens/ links/credentials/agent builds/file shares/operator access/deploy steps/devops log; DNS zones/records; SSL certificates; workstation templates/pool/access/events; managed instances + instance credentials (encrypted).

Cross-cutting

sync_state/sync_events/conflict_records (instance sync), license_tokens/instance_license_state, AI chats/messages/audit, automations + runs, firewall config uploads, notifications, system logs, proxy endpoints/routes, installed plugins, project_encryption_keys (per-project DEKs).

Sensitive columns (encrypted at rest)

Encrypted with the global Fernet key (__enc__: sentinel) or a per-project DEK (__pdek__:):

  • creds.secret (per-project DEK), project_secrets.value_enc
  • confidential-tagged notes.content, sensitive loots.value; loot files on disk
  • C2 integration tokens/passwords in global_settings
  • oidc_providers.client_secret, users.totp_secret
  • infra provider credentials/connection, infra service credentials, instance credentials (EE)
  • platform SSH keypair private half, proxy passwords

Access to decrypted values is permission-gated and audit-logged — see Security overview.

Migrations

Alembic, ~106 revisions, executed automatically on backend startup (upgrade head; skipped in APP_ENV=test). ER-level diagram is not shipped; the source of truth is backend/app/models/ and backend/alembic/versions/.

Practical notes for operators

  • Back up the database and DATA_DIR and .env together — see Backup and restore
  • A read replica can be attached (DATABASE_REPLICA_URL) for read-heavy listing endpoints
  • DATABASE_STATEMENT_TIMEOUT (default 30 s) bounds runaway queries