Cybergraph

The Cybergraph is how Cracken records what it learns during an assessment. Instead of flat text or disconnected rows, every entity is a typed node and every relationship between entities is a typed edge, scoped to a realm.

At a glance

• What it is — Cracken's graph model of an assessment: entities as typed nodes, relationships between them as typed edges, scoped to a realm.
• When to use it — Whenever an operation needs to track discovered hosts, services, findings, credentials, or exploits and how they relate, instead of flat text.
• Inputs — Entities and relationships extracted automatically by the agent during operations, or fed in from connected Integrations; manual edits (description, archive/restore) from the node details sheet.
• Outputs — Nodes and edges carrying lifecycle/freshness state and change history, with evidence links back to the operation ledger; the source data for report generation and re-testing baselines.
• Related objects — Operations, Monitors — Cybergraph signal, Automations — Cybergraph automations, Integrations.
• Common actions — Edit (node description), Archive, Restore, Remove from operation, Clear All (requires cybergraph:delete).
• API / tool links — UI only — no public API documented on this page.

Why a graph

A graph keeps the relationships between findings explicit instead of leaving them implied in prose:

• Every entity has its own identity and type, so the agent can reason about a specific host or finding rather than a text chunk that mentions it.
• Relationships are stored, not inferred — the agent navigates real connections (a domain that contains a port, a service that talks to an IP) instead of keyword similarity.
• Context is scoped by traversing the relevant subgraph, so the agent can ask "what do we know about this host" and get exactly the connected nodes.

Graph structure

The node and edge types are fixed enums in the codebase. The agent extracts entities into these types as it works.

Node types

The graph models these entity types:

Category	Node types
Network & hosts	IPAddress, Netblock, AS, Device, Port, Service
DNS & domains	Domain, DNSName, Website, URL, MXRecord, NSRecord
Identities	Person, Username, EmailAddress, Credential, Company
Findings & exploitation	Vulnerability, Finding, Exploit
Artifacts & evidence	Evidence, Document, File, Hash, Phrase

Each type carries its own properties — for example IPAddress has ipv4address and internal, Vulnerability has cve_id, severity, and cvss_score, and Service has banner and port_number.

Edge types

Relationships use three types:

Edge type	Meaning
CONTAINS	Ownership, parent-child, structural containment — e.g. Domain → IPAddress, IPAddress → Port, Netblock → IPAddress.
COMMUNICATION	Network traffic, connections, data flow — e.g. Service → IPAddress. Carries protocol, port, and direction.
TECHNIC	MITRE ATT&CK technique references — e.g. Exploit → Vulnerability. Carries mitre_id, tactic, and technique_name.

Views

The Cybergraph renders at two levels — the realm Cybergraph (everything mapped across the realm) and the operation Cybergraph (the slice tracked by a single operation) — each with its own view modes. Both share a Current / All scope toggle. When the backend provides a disclosure schema, they also expose a tier filter to narrow nodes by tier.

Realm Cybergraph

The realm view offers three tabs over the same data:

• Graph — the force-directed node-and-edge canvas. Pan, zoom, search, and click any node to open its details.
• Tree — a hierarchical breakdown of nodes and their CONTAINS relationships, useful for walking the structure top-down.
• Table — a flat, sortable list of every node for quick scanning and selection.

A Clear All action sits beside the scope toggle. It permanently deletes the realm Cybergraph's nodes, edges, and operation graph memberships, requires the cybergraph:delete permission, and is not an archive action.

Operation Cybergraph

The operation view toggles between two layouts of that operation's graph slice:

• 1D — a hierarchical tree of the operation's nodes (the default).
• 2D — the force-directed graph canvas.

A fullscreen control expands the view. The same scope toggle applies, and the tier filter is available when the backend provides a disclosure schema.

Graph views

The force-directed canvas — the realm Graph tab and the operation 2D layout — has a Graph view picker that restyles the same graph for different questions. Switching a view only changes how nodes are colored, sized, and arranged; it never changes the underlying data:

• Overview (default) — colored by category, sized by connectivity.
• Vulnerabilities — severity drives color, CVSS drives size.
• Risk rings — a radial layout where ring distance encodes disclosure tier. Available only when the backend provides a disclosure schema.
• Asset map — colored by node type, clustered by detected community.
• Communities — colored and grouped by detected community.
• Freshness — current, stale, and archived nodes at a glance.

Five built-in graph views are always available; Risk rings is added when disclosure tiers are available. Built-in views cannot be edited or deleted. Tenant administrators and owners can create realm-wide saved graph views from any built-in or saved view:

• In the realm Graph tab, choose Customize on a built-in view or Edit view on a saved view.
• In an operation's 2D graph, use the graph-view picker to apply built-in or saved realm views. Create, edit, and delete saved graph views only from the realm Graph tab.
• Save changes updates a saved graph view, Save as new creates another view, and Delete removes a saved view. Concurrent edits are detected before update or deletion.

Managing saved graph views requires the realm management capabilities exposed by cybergraph:create and cybergraph:delete. Switching between views only requires Cybergraph read access. The Configure playbook can also create an objective-specific saved graph view after it inspects the realm's graph; the view remains editable from the realm Graph tab.

Current / All scope

Both views share a scope toggle:

• Current — hides archived graph records, showing only the live graph.
• All — includes archived records so they can be reviewed and restored.

Node freshness and lifecycle

Every node carries a lifecycle (active or archived) and a freshness signal derived from when it was last seen. These combine into a single state badge:

• Active — fresh and live.
• Stale — live but not seen recently.
• Archived — removed from Current views but retained with full provenance.
• Unknown — freshness can't be determined.

Node details

Clicking any node opens a details sheet that shows:

• Node name and type
• Lifecycle and freshness state
• Node-specific properties (for example CVSS score, finding type, FQDN, or IP address)
• Connected nodes in a compact subgraph preview when the node has descendants
• Change history for edits, archive, restore, and operation-link changes
• Evidence links back to the operation ledger record that created or changed the node

From the sheet you can edit a node's description, remove it from a single operation's view, archive stale or invalid nodes, and restore archived nodes later.

Working with the graph

Human steering

The agent reasons within the graph, but you control the scope:

• Narrow the view — focus on a branch or attack path so the agent's context is that subgraph, with less noise.
• Widen the view — expand scope to see connections across the attack surface.
• Current / All scope — Current hides archived graph records; All includes them for review and restore.
• Archive and restore — archiving hides stale or superseded nodes from Current views without deleting their provenance; restore returns a node to Current.
• Remove from operation — remove a node from one operation's graph slice without deleting it from the realm Cybergraph.
• Clear All — permanently delete the realm Cybergraph's nodes, edges, and operation graph memberships. This requires the cybergraph:delete permission and is not an archive action.
• Review provenance — follow evidence and change-history links back to the exact operation record that produced or modified the data.

Agent reasoning

The agent uses the graph to plan its next move, remember what it already tried, recall what it knows about a host or service, and traverse Vulnerability and Finding nodes back to their evidence when generating a report.

During and after an assessment

As the agent works, new discoveries create nodes, tests create edges between them, and results update node properties — the graph grows in real time as the operation runs. When the assessment finishes, the completed graph is the source for report generation and a baseline for re-testing.

External tool output and connected security tools feed the same graph. See Integrations for connecting your vulnerability scanners, code- and cloud-security tooling, and asset sources so their findings land in the Cybergraph.

Next steps

• Operations — the operations that read and write the Cybergraph as they run.
• Monitors — fire an operation when a matching entity is added or changed.
• Integrations — feed external findings and asset data into the graph.