FAQ

What is Umbryx? A self-hosted platform for red-team infrastructure and operations lifecycle management: scope and ROE, hosts and credentials, scans and tooling that run on your attacker machines, findings and evidence, reporting — and (EE) deploying and tearing down the attack infrastructure itself. See What is Umbryx.

What is the difference between Core and EE? Core is the full operational platform on machines you bring yourself, source-available, no license. EE adds the infrastructure side (Platform Ops catalog/stacks/providers, DNS/SSL, workstation and managed-instance provisioning, HA recipe) behind a signed license. Full matrix: Core vs EE.

How do I install it? Docker Compose, single node, ~10 minutes: Getting started and Installation.

Does Umbryx run scans itself? No. Tooling (nmap, nuclei, NetExec, …) runs on attacker machines you register, over SSH. The platform drives them and ingests results.

How do I create a project and invite the team? Sidebar → New project; Members panel inside the project; roles are per-project (11 of them). See Projects and Access control.

How are credentials protected? Encrypted at rest with a per-project data-encryption key wrapped by the instance's Fernet key; revealing requires the credentials.read_secret permission and is audit-logged. Loot files are encrypted on disk. Details: Security overview.

What happens to my data if an EE license lapses? Nothing is deleted. After a grace period the instance enters wind-down: viewing, export and teardown keep working, mutations return 402 until a renewed license is applied.

How do I back up and restore? Database dump + data/ directory + .env (the encryption key) — together. Procedure: Backup and restore.

How do I update an installation? ./update.sh — the supported path (timestamped backups, rollback tags, health-checked restart; migrations run automatically on startup). Quick and dirty: git pull && docker compose up -d --build (or pull for image deploys) when you accept skipping the backups.

The app can't connect to the database — where do I look? docker compose ps and backend logs first; common causes are a changed DB_PASSWORD against an initialized volume, or pointing DB_HOST at a VIP that isn't up (HA). See Troubleshooting.

Can it run air-gapped? Yes — offline bundle for the platform, offline license activation for EE (activation request .c2v.json → signed .lic → offline channel; the licensing page calls it C2V for short). See EE installation.

Is there an API? Yes — ~640 endpoints, JSON, Bearer/cookie auth, X-Total-Count pagination. Overview: API reference.