Skip to content

Workstations and connections

Operator machines and how the platform reaches the outside world. Availability: base features in both editions; provisioning is EE.

Workstations

Workstations

Three sub-tabs:

  • Workstations — machine cards with lifecycle status (planned → provisioning → ready), provider, SSH reachability; actions: provision, restart, destroy, delete, force-delete, event log (auto-refreshing during transitions). Provisioning from templates is EE.
  • Templates (EE) — create workstation templates, request machines from them; plan-gated (Team and above)
  • Pool & access — org-admin surface: register your own machines over SSH, then grant/revoke per-user SSH access backed by the platform keypair. Works in both editions — an audit trail with holes would be worthless.

Executor flag — any pool machine can become a scan/exec target (ws:<id>), scoped to one project or all. Toggled from Connections or the workstations API; grants/revoke events are audited.

Action log — opt-in per machine: a shell hook posts every executed command (user, cwd, exit code, client IP) to the platform; the feed is admin-visible and doubles as engagement attribution.

Terminal telemetry (2026-10) — on top of the command log, per machine:

  • PTY recording. When enabled, login shells on the machine run under a script(1) wrapper and the full terminal stream is pulled to the platform over the same management channel (nothing new is exposed on the machine). The shell hook marks each executed command inside the stream with an invisible terminal escape sequence, so the recording is cut into per-command segments — the output of a command is captured alongside the command itself.
  • Terminal sessions. Commands and recordings are correlated by terminal (tty) into sessions: start, activity, end. Opening the same terminal again (tty reuse) closes the old session; sessions go idle after 30 minutes of silence.
  • Nested SSH. A command that starts an SSH jump is recorded as a hop in the session. A command line proves intent, not a landing — hops stay marked unconfirmed until terminal output supports them. Uncertainty is shown explicitly rather than guessed away.
  • Auto-enrichment. Output of known tools (nmap, netexec, secretsdump, hydra, GetUserSPNs/GetNPUsers, ntlmrelayx, psexec/wmiexec/smbexec/atexec, responder, smbclient, whatweb, ip addr, ip route, ss, dig, nslookup) is parsed into structured observations. Unambiguous facts (an open port, a DNS answer, a discovered host) merge into the project automatically — filling gaps, never overwriting existing data. Anything requiring interpretation (credentials, access context) stays a draft observation for an operator to approve. Re-running the same command creates no duplicates; every enriched entity links back to the exact command and session it came from.
  • Secrets in commands. Operators type credentials into commands (-p pass, -hashes :LM:NT, user:pass@host). Such material is masked everywhere with a broad audience — the timeline for everyone, and command details / observation provenance for roles without the credential-secret permission (viewers, clients). The raw command is available to roles entitled to see credential secrets, and parsed hashes/passwords never enter project fields on their own — they stay inside a draft observation until an operator confirms them.
  • Deconfliction. Activity, jobs and manual claims feed the engagement map on hosts. Claims now also cover ranges (CIDR blocks) and tasks (free-text scope) with a TTL. The platform warns when operators engage the same host, scan overlapping ranges, or work inside a range claimed by a colleague — warnings are advisory and never block an operator.

Connections

Infra → Connections consolidates all outbound execution settings:

  • Attacker SSH targets — the executor machines used by scans, bulk runs and pivots (host, port, credential, jump/SOCKS proxy, exec proxy). See Attacker SSH
  • Egress proxies — outbound proxy pool with per-category routing (AI, notifications, provisioning, C2, DNS, pivots, SSH), round-robin/failover, health checks, and the outbound floor (HTTP_PROXY-style)
  • Executor machines — pool machines with status, auth type, an executor badge, a Test reachability probe and the executor on/off switch

Expected behavior

  • Key grants/revokes update authorized_keys on the machine within seconds and are audit-logged
  • The executor switch immediately includes/excludes the machine as a scan target

Limitations

  • Registration requires SSH reachability and credentials; the platform does not create machines in Core
  • Action logging and PTY recording are per-machine opt-in
  • PTY recording covers login shells; terminal multiplexer panes (tmux/zellij/screen) record the visible pane only — commands in all panes are still captured by the shell hook. Full per-pane capture is planned via the workstation agent (see Planned)
  • The output of a command is attached when the next command closes the segment; the very last command of a session is picked up on the following harvest