Glossary¶
Product terminology as used in the code and UI.
| Term | Meaning in Umbryx |
|---|---|
| Engagement | Synonym for a project — one assessment/red-team job |
| Scope | The allowed target set: CIDRs/hostnames/domains/URLs, with exclusions, entry points and reachable-via-host relations; enforced by the ROE guard |
| ROE | Rules of Engagement: allowed/forbidden activities, approval requirements, work hours, scan-rate cap |
| Loot | Collected artifacts: files (encrypted on disk) and text artifacts (hashes, secrets) |
| Cred | A credential record; domain creds match all hosts in a domain |
| Vault (project secrets) | Named secrets with revoke/generate lifecycle, separate from creds |
| Access edge | Graph edge recording validated access (cred × host) or imported relations (BloodHound AdminTo/HasSession) |
| Attack path | Manual tree of steps (action/condition/milestone/pivot) with MITRE mapping |
| Attack graph | Auto-generated canonical graph of hosts, cred links, access and pivot edges |
| Smart Build | One-click map construction from operational data, with stale-edge decay |
| Tier-0/1/2 | Prioritization zones on the graph (domain controllers and equivalents in tier-0) |
| Watch | Scheduled light scan diffing the attack surface against a baseline |
| Purple | MITRE ATT&CK coverage view/report for purple-team purposes |
| Playbook | Named DAG of connector steps; single/batch/scheduled runs |
| Automation | Trigger-driven rule (event/schedule/cascade) with conditions and steps; may call playbooks |
| Operation pack | Reusable saved set of playbook steps |
| Job | One execution unit (scan, exec, validation) with live output and structured results |
| Executor | A machine the platform runs commands on: an attacker SSH target or a workstation with the executor flag |
| Workstation | An operator machine. Pool = registered manually (both editions); provisioning from templates is EE |
| Attacker host | A host marked attacker-side; scans originate from these |
| Pivot observation | A recorded tunnel (SOCKS/route/port-forward) with route CIDRs; usable as execution source |
| Redirector | Edge component forwarding traffic to a C2 team server (EE stacks) |
| Dropper | Payload hosting service (pwndrop); EE publishes generated agents there |
| Managed instance | EE k8s pool service claimed into a project |
| Stack | An EE deployment unit of infrastructure services (C2 + redirectors + …) |
| DEK / KEK | Per-project Data Encryption Key wrapped by the global Key Encryption Key |
| Candidate | A potential finding extracted from tool output, pending confirmation |
| Burn host | Mark a host compromised; opens the OPSEC teardown checklist |
| Deconfliction | Advisory claims showing which operator works on which host |
| Closure Wizard | Guided project close with decommission report |
| Presence | Live "who is where" indicators over the WebSocket |
| Snapshot | Captured group of project data (notes/findings/hosts/graph) restorable later |
| Intensity profile | Scan noise/speed preset (stealth/normal/aggressive) |
| Heartbeat | EE license renewal: signed daily check-in with the license server |
| C2V | Client-to-vendor activation request file for offline licensing |
| Wind-down | EE state after license expiry + grace: read/export/teardown only |