Relational Attack Graph Exchange

Map, share, and automate attack paths.

RAGE captures who-can-reach-what across your environment as one provenance-backed graph. A single NDJSON file any tool can produce, traverse, or reason over.

Attack paths are the unit. RAGE makes them portable: enumerate them faster on an engagement, find them before an attacker does, and hand them to the tools and agents that act.

MemberOf CanImpersonate CanInvoke CanModifyCode CanExecuteCommand CanReadSecret ExecutesAs CanDecrypt CanReadData CanReadData CanEscalateTo CanImpersonate sa-ci-deploy grp-engineers role-build topic-events fn-imagebuilder vm-runner secret-registry sa-admin kms-prod db-customers bucket-crown role-org-admin

A live RAGE graph: a foothold is discovered, edges are derived to a fixpoint, and the escalation path to role-org-admin lights up.

Attack paths, as shared infrastructure

Every environment has the same hard question: from here, what can I reach? RAGE answers it in a form tools agree on: identities, resources, and the capability edges between them, each backed by the evidence it was derived from. Model it once; everyone builds on it.

red team

Higher-quality pentests

Enumerate every reachable objective from a foothold - faster and more thorough than mapping IAM by hand.

  • Full escalation chains, not spot checks
  • Provenance you can cite in the report
  • Automate traversal instead of grinding policies
blue team

Fix paths before they're used

See the routes to your crown jewels the way an attacker would, and cut them off while they're still theoretical.

  • Rank the high-risk paths to real objectives
  • Spot where permissions and resources fan out
  • Reduce permission sprawl at the edges that matter
tools & agents

One format to build on

A stable, machine-readable graph to read, write, and act on - so tooling composes instead of reinventing collection.

  • Emit RAGE from your own collector
  • Traverse a standard graph, any language
  • Feed attack paths to agents that act

Read it in three lines

The whole format is a switch on rec["kind"]. Pick your language.

for line in open("graph.rage.ndjson"):
    rec = json.loads(line)   # switch on rec["kind"]
jq 'select(.kind=="edge" and .type=="CanImpersonate")' graph.rage.ndjson
grep '"kind":"edge"' graph.rage.ndjson | wc -l   # count edges

Collect, exchange, explore

producer

Collect

Thunderstorm maps your environment and emits a .rage.ndjson graph.

Download Thunderstorm
the standard

Exchange

RAGE is the open format in the middle. One file, versioned taxonomy, an open corpus.

Read the format
consumer

Explore

Blaze Lite opens any .rage.ndjson and walks the attack paths visually. Ships with Thunderstorm.

Download Blaze Lite

The middle is the standard: a producer writes it, a consumer reads it.

Three layers, three change policies

01

The formatfrozen at 1.0

One NDJSON file. Line 1 is a manifest; every other line is a kind-tagged record. The provenance chain runs evidence → fact → edge/finding.

Read the format
02

The taxonomyversioned and open

10 node classes / 105 node types, 80 edge types in 9 categories, with states, walkability and weight.

Browse the taxonomy
03

The corpusupdated continuously

Provider mappings and collection recipes, 2,433 derivation rules, and the Exposure DB of 1,048 sites.

Explore the corpus

The standard, counted

Live from the registries in this repository.

105
node types · 10 classes
80
edge types · 9 categories
2,433
derivation rules
1,048
exposure sites
219
resource mappings
106/53/60
aws / gcp / azure
16
condition tokens
5
edge states
move · open · esc close