Map, share, and automate attack paths.
Attack paths are the unit. RAGE makes them portable: enumerate them faster on an engagement, find them before an attacker does, and hand them to the tools and agents that act.
A live RAGE graph: a foothold is discovered, edges are derived to a
fixpoint, and the escalation path to role-org-admin lights up.
Attack paths, as shared infrastructure
Every environment has the same hard question: from here, what can I reach? RAGE answers it in a form tools agree on: identities, resources, and the capability edges between them, each backed by the evidence it was derived from. Model it once; everyone builds on it.
Higher-quality pentests
Enumerate every reachable objective from a foothold - faster and more thorough than mapping IAM by hand.
- Full escalation chains, not spot checks
- Provenance you can cite in the report
- Automate traversal instead of grinding policies
Fix paths before they're used
See the routes to your crown jewels the way an attacker would, and cut them off while they're still theoretical.
- Rank the high-risk paths to real objectives
- Spot where permissions and resources fan out
- Reduce permission sprawl at the edges that matter
One format to build on
A stable, machine-readable graph to read, write, and act on - so tooling composes instead of reinventing collection.
- Emit RAGE from your own collector
- Traverse a standard graph, any language
- Feed attack paths to agents that act
Read it in three lines
The whole format is a switch on rec["kind"]. Pick your language.
for line in open("graph.rage.ndjson"):
rec = json.loads(line) # switch on rec["kind"]
jq 'select(.kind=="edge" and .type=="CanImpersonate")' graph.rage.ndjson
grep '"kind":"edge"' graph.rage.ndjson | wc -l # count edges
Collect, exchange, explore
Collect
Thunderstorm maps your environment and emits a .rage.ndjson graph.
Exchange
RAGE is the open format in the middle. One file, versioned taxonomy, an open corpus.
Read the formatExplore
Blaze Lite opens any .rage.ndjson and walks the attack paths visually. Ships with Thunderstorm.
The middle is the standard: a producer writes it, a consumer reads it.
Three layers, three change policies
The formatfrozen at 1.0
One NDJSON file. Line 1 is a manifest; every other line is a kind-tagged record. The provenance chain runs evidence → fact → edge/finding.
Read the formatThe taxonomyversioned and open
10 node classes / 105 node types, 80 edge types in 9 categories, with states, walkability and weight.
Browse the taxonomyThe corpusupdated continuously
Provider mappings and collection recipes, 2,433 derivation rules, and the Exposure DB of 1,048 sites.
Explore the corpusThe standard, counted
Live from the registries in this repository.