Skip to content

Umbryx Core

Umbryx Core is the free, source-available edition of Umbryx — the whole operational platform without the code that deploys and manages attack infrastructure for you. Everything an operator does with their own machines stays here, and so does the entire audit trail.

Projects Core is also referred to as the Community Edition in some materials; the public repository is umbryx-core.

What is included

Everything the engagement workflow needs on machines you already control:

  • Projects, scope and ROE enforcement
  • Hosts, credentials (encrypted per-project), findings, notes, loot, knowledge base
  • Network map and attack graph with Smart Build
  • Attack paths (manual) with MITRE mapping
  • Scans and tooling executed on your attacker machines over SSH: nmap, nuclei, NetExec, httpx, ffuf, DonPAPI
  • Credential validation (SMB/WinRM/SSH/LDAP/MSSQL/RDP) with access edges
  • Playbooks, scheduled runs and trigger-driven automations
  • Reporting: PDF/HTML/Markdown, purple-team report
  • Full RBAC (11 project roles), MFA, audit trail with HMAC fingerprints (SSO/OIDC is an Enterprise feature)
  • C2 integrations (Adaptix, Mythic, Sliver; Cobalt Strike is not supported at this stage — see C2 integrations) and C2 Ops listeners/payload generation
  • Workstation pool in its Community form: register your own machines over SSH and grant/revoke per-user key access — the audit-relevant half of the feature (provisioning new machines is EE)
  • Module system (in-repo Python modules and .rnplugin bundles)

Deployment model

Docker Compose from source (single node): PostgreSQL, Redis, backend, frontend, nginx. Interactive installer (install.sh) or manual .env + docker compose up -d --build. See Installation.

The database schema is identical to EE — upgrading is an image swap (see Editions comparison).

Configuration and security

Core reads the same environment-variable set as EE minus four EE-only variables (see the Configuration reference). Security mechanisms — per-project DEK encryption, JWT sessions, RBAC, audit trail, webhook HMAC — are all present; see Security.

Known limitations

By design (edition boundary, not implementation gaps):

  • No infrastructure provisioning: no Platform Ops catalog/stacks, cloud providers, DNS/SSL automation, managed instances
  • No workstation provisioning (creating machines); registering existing ones is supported
  • No multi-node HA installer recipe (the application itself can still be pointed at an external HA cluster via DB_HOST / REDIS_SENTINEL_*)
  • Image registries administration is available in both editions

Practical limits of the free tier: up to 5 team members per instance, no infrastructure instances, 90-day audit retention, no license key required (BSL 1.1 with a production-use grant).