Map vs Attack Graph vs Attack Path¶
Umbryx has three visual surfaces about the same engagement, and the fastest way to use the product well is to stop confusing them. Each answers a different question, is owned by someone different, and is fresh in a different way.
| Network Map | Attack Graph | Attack Path | |
|---|---|---|---|
| Question | What does the environment look like? | Where are we, and how deep? | How do we tell the story? |
| Nature | Topology documentation | Live map of compromise | Report narrative |
| Who writes it | You (or Smart Build) | Nobody — it derives itself | You |
| Source of truth | Hosts, scans, manual edits | Credentials, access checks, pivots | Operator's plan |
| Freshness | On demand (Smart Build, edits) | Live (WebSocket) | When you edit |
| Goes into the report | As a diagram | As evidence (PNG export) | As the attack story |
Network Map — the environment¶
A curated picture of the infrastructure: multiple named maps per project, regions, manually positioned nodes, overlays (threats, sessions, access, pivots, roles). Smart Build infers the topology from hosts and scan data, and you adjust the result. The map is documentation: it should look the way you need to explain the environment.
Record here: tunnels (Add Pivot), zones, anything the client should see as "their network".
Attack Graph — the compromise¶
A self-building map of what the operation has actually achieved. Nobody edits it: every node and edge is derived from operational facts:
- credentials you hold become cred nodes — the keys of the engagement
- validated access draws verified edges; inferred access stays dashed until confirmed
- pivot observations draw routes to the segments behind a tunnel
Columns are depth from the attacker: how many hops stand between your box and each host. Clicking a node shows how we got here (the chain attacker → credential → host) and what it opens. DA paths highlight the shortest chains to domain-admin-capable hosts.
The Frontier toggle dims everything confirmed and rings what is still unproven — unvalidated credentials and inferred access — with a panel of concrete next steps. Access facts older than 14 days fade (the pivot may be gone). The graph updates live over WebSocket, and the PNG button exports a snapshot for the report.
Attack Path — the story¶
A deliberate tree of steps (action / condition / milestone / pivot) with statuses, confidence and MITRE techniques. It is written by the operator, often before the steps are real, and it becomes the narrative of the final report. A path can start as a hypothesis, get executed, and end verified — or fail and explain why.
How they work together¶
- The Attack Graph links into the other two: a host panel jumps to the Network Map focused on that host; a DA path can be handed to Attack Path as the skeleton of the story
- The Network Map documents where pivots live; the graph turns the same pivots into reachability
- The Attack Path narrates; the graph proves the narrative with facts (and disproves it when an edge turns out inferred)
Rule of thumb¶
If you're asking "what is there?" — open the Map. If you're asking "where are we?" — open the Graph. If you're asking "what do we write in the report?" — open the Path. When a client asks why you claim access to host X, the answer is a chain on the Attack Graph — not a line someone drew on a map.