Skip to main content

Realms

A realm isolates assessment data and configuration by workspace project, environment, or client.

A realm can start as a private draft: prepare it, then publish it to share it with everyone in your workspace. New realms are published immediately by default; turn off Publish new realms immediately in Profile settings to start future realms as private drafts.

At a glance​

  • What it is — an isolated, per-tenant boundary that scopes operations, Tentacles, Cybergraph, artifacts, secrets, and configuration.
  • When to use it — create one to keep a client's, environment's, or project's assessment data and configuration separate from others in the tenant.
  • Inputs — select New Realm. With the creation wizard enabled, Cracken assigns a placeholder name that the wizard's Configure realm step later replaces; with it disabled, you can enter a name or leave it blank for an automatic name.
  • Outputs — a scoped realm for operations, Tentacles, Cybergraph data, artifacts, and secrets, isolated from other realms.
  • Related objects — Operations, Semi-Autonomous Policy, Cybergraph, File System.
  • Common actions — Create, Publish, Switch, Archive, Delete.
  • API / tool links — UI only — no public API.

What is a realm?​

A realm scopes all assessment activity. Everything you do in Cracken happens within a realm:

  • Operations run inside a realm
  • Tentacles are registered to a realm
  • Cybergraph data is realm-scoped
  • Artifacts and secrets belong to a realm
  • Configuration (semi-auto policy, integrations) applies per realm

All data is scoped by realm, so one realm's data is not visible from another. You can run assessments for different clients, environments, or projects in separate realms.

Long term memory mechanism is implemented through Cybergraph and is shared between operations.

Realm vs. tenant​

ConceptScopePurpose
TenantAccount-levelYour company account. Manages billing, team members, and global settings.
RealmProject-levelAn isolated boundary within a tenant. Scopes all assessment data and configuration.

A single tenant can have multiple realms — use separate realms for different clients, environments (staging vs. production), or assessment types. The number of realms a tenant can create is limited by its plan; when you reach the limit, Cracken prompts you to upgrade.

Create a realm​

  1. Open the Realms page.
  2. Select New Realm.

What happens next follows your Show the realm creation wizard preference in Profile settings:

  • Enabled — Cracken creates the realm with the placeholder name Untitled (Untitled 2, Untitled 3, and so on when that name is taken), then opens onboarding at Install tentacle. The wizard's Configure realm step replaces the placeholder with a name derived from the system description you enter there.
  • Disabled — Name your realm opens. Enter a name or leave it blank for the same automatic Untitled name, then select Create realm. Cracken opens the ready realm without onboarding.

Renaming a realm yourself is optional in both cases: open Realm Settings at any time and edit the name.

Draft realms​

In a workspace, a draft is visible only to you until you select Publish. Publishing shares the realm with everyone in your workspace; it never makes the realm public on the internet. Saved secrets become available to workspace users, but their values remain redacted.

New realms are published immediately by default. In Profile settings, turn off Publish new realms immediately to start future realms as private drafts. The setting affects only future realms, so existing drafts and published realms keep their current state.

The default realm grid combines every active realm you can access: your drafts and published realms. Select Drafts to show your active drafts only. Select Drafts & Published to return to the combined grid.

Active drafts and active published realms both count toward your plan's realm limit. Archiving removes a realm from the active grid while preserving its data, and archived realms do not count. Select Archived to view archived realms. Restoring makes the realm active again without changing whether it is a draft or published, and it counts toward the limit again. If the plan is already full, archive another realm or upgrade before restoring. Select Active to return to the active grid after viewing archived realms.

Realm screens​

After you select a realm, Cracken opens the Console by default. You can switch screens from the realm sidebar, and you can change which screen opens first per realm in Realm Settings → Default Screen. The available screens are:

  • Console — the working surface for running operations (the default landing).
  • Dashboard — the Cybergraph dashboard: graph entity panels with a node detail view. Requires Cybergraph access.
  • Knowledge — the realm's Knowledge base.
  • Tentacles — the Tentacles registered to the realm.
  • Automations — scheduled, webhook, and Cybergraph automations. Requires Automations access.
  • Settings — realm settings, including semi-auto policy and secrets.

The Dashboard reads the realm's Cybergraph and lays it out as panels: high-level metrics (entities, relationships, evidence, high-risk counts), an entity map with type distribution, a searchable entity table, and KQL-backed counters for findings, domains, and URLs — shown at the top of this page.

Realm secrets​

Realm secrets store tokens, API keys, passwords, and webhook header secrets at the realm boundary instead of keeping plaintext in operation history or model context.

Open Realm Settings → Secrets to:

  • Add a manual secret with a service slug and one or more fields. Each active secret slug must be unique — a second active secret with the same slug is rejected; replace the existing one instead.
  • Copy a {{secret:<service>.<field>}} reference for use in prompts, tools, or playbooks
  • Replace or delete manual secrets
  • Review detected findings and promote them into saved secrets
  • Configure whether user-provided input is scanned before it enters operation context

The service slug identifies the target service, such as github or api_ninjas. The field identifies the value inside that service, such as token, api_key, or password. Cracken resolves these references only at execution time. Agents and operation history see the reference, not the plaintext value.

The default policy is Block & prompt to save. Cracken scans new operation tasks plus follow-up instruction and action input before they enter operation context, hard-blocks input that contains likely secret material, and offers to save it as a secret or send it anyway. Disable secret scanning bypasses that gate and allows raw user input without the block.

When Cracken blocks a new operation task or instruction message because it contains likely secret material, choose Save as secret to store the detected value and resend with a {{secret:...}} reference, or choose Edit / Send anyway. When Cracken blocks a direct action command, Save as secret stores the value only; direct action commands do not resolve literal {{secret:...}} references, so remove the raw value or explicitly send the original command anyway. Detected findings can also be reviewed from the Secrets tab and remediated back into the originating operation text when source context is available.

Webhook automation header secrets are listed with other realm secrets because they are stored in the same encrypted secret store. Their slugs are reserved by the owning automation and cannot be replaced or deleted from the manual secrets table.

Switch between realms​

Use the realm selector in the sidebar to switch contexts. Switching realms changes all visible data — operations, Tentacles, artifacts, and configuration all reflect the selected realm.

After a live connection is restored, Cracken refreshes server-backed data. If the realm refresh fails, the last-loaded realm cards remain visible; select Retry in the warning to request the current realm list again.

Archive and delete realms​

  • Archive — removes the realm from active view while preserving all data. Archived realms can be restored.
  • Delete — permanently removes the realm and all associated data. This action is irreversible.

Next steps​