# Entities

<figure><img src="https://232193438-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwolEZzMm5QD9NoFKutSj%2Fuploads%2FGNUUpH6hJ96ZBuXgIVpk%2Fimage.png?alt=media&#x26;token=895c76d3-8c14-4a99-8d16-785f53735686" alt=""><figcaption></figcaption></figure>

Entities represent distinct objects in the attack surface that can be discovered, analyzed, and exploited. Each entity type has specific properties and unique identifiers that allow the system to track and deduplicate findings across different assessment phases.

Pentest Copilot supports an exhaustive list of entities that are capable to handle any kind of engagement, below are a few important entities:

**Types of Entities**

* **Domain (Root):**&#x52;epresents a DNS domain or subdomain that is part of the target organization's attack surface. It can be either a root domain (e.g., example.com) or a subdomain (e.g., api.example.com).
  * **WebPage:** Represents a specific URL endpoint discovered on a web application. It captures both the structure of URLs (with dynamic parameters) and their raw content for analysis.
* **Subnet (Root):** Represents a network subnet discovered during internal assessment. It defines an IP address range that can contain multiple hosts and is used as a starting point for internal network enumeration.
  * **Host**: Represents an individual computer, server, or device discovered within a network subnet during internal assessment.
* **APKFile (Root)**: Represents an Android application package file that can be analyzed for security vulnerabilities
  * **Activity**: Represents an Android application screen or activity discovered through APK analysis. In Android development, an Activity is a single screen with a user interface, and each APK can contain multiple activities that define the app's functionality and user interaction flows.
* **Trajectory**: Represents a sequence of interactions (actions) that achieve a specific goal on a web application or mobile app. It's used for automated testing and vulnerability discovery by recording and replaying user behaviors. \[Found in external assessments for both Android and Web scans]
  * APIAction: Represents HTTP API calls made during the trajectory
  * BrowserAction: Represents browser-based user interactions eg. clicking a button, filling a form
  * AndroidAction: Represents mobile app interactions e.g. Click, swipe, type, scroll

## List of all entities

<table><thead><tr><th width="180">Entity</th><th>Description</th></tr></thead><tbody><tr><td>Activity</td><td>Android app screen (activity) tied to APK analysis and navigation flows.</td></tr><tr><td>ADOBJ</td><td>Generic Active Directory object with DN/GUID, privileges, and ACEs for attack-path mapping.</td></tr><tr><td>AnonymousLogin</td><td>Credential pair representing anonymous or guest access where it was accepted.</td></tr><tr><td>APKFile</td><td>Android package (APK) used as the root target for mobile analysis.</td></tr><tr><td>Application</td><td>Logical application asset in attack-surface modeling (distinct app identity in ASM).</td></tr><tr><td>ASN</td><td>Autonomous System Number associated with discovered network infrastructure.</td></tr><tr><td>BrowserSession</td><td>Captured browser state: cookies, storage, auth metadata, and recorded browser actions.</td></tr><tr><td>Certificate</td><td>TLS/X.509 material: CN, SANs, validity, and related serving endpoints.</td></tr><tr><td>CertificateAuthority</td><td>Enterprise AD CS certificate authority configuration (web enrollment, permissions, exposure).</td></tr><tr><td>CertificateTemplate</td><td>AD CS certificate template definition (EKUs, enrollment flags, and misconfiguration context).</td></tr><tr><td>CloudResource</td><td>Exposed cloud endpoint or object (URL, access level, provider, scan metadata).</td></tr><tr><td>Delegation</td><td>Kerberos delegation relationship or finding (constrained/unconstrained style trust abuse surface).</td></tr><tr><td>Device</td><td>External asset or host fingerprint: OS, addresses, hostname, CPE, and discovery context.</td></tr><tr><td>Disk</td><td>Storage volume or mount surfaced during internal assessment for further file-level inspection.</td></tr><tr><td>Domain</td><td>DNS domain or subdomain: scope anchor with optional paths, DX/DNS metadata, and crawl settings.</td></tr><tr><td>DomainEscalation</td><td>Cross-domain or trust abuse scenario (trust direction/type, success, affected domains).</td></tr><tr><td>Employee</td><td>Person record from OSINT (name, role, contact, location, linked socials).</td></tr><tr><td>File</td><td>File artifact (path/type/content or URL-flag) tracked with a deduplication key.</td></tr><tr><td>Generic</td><td>Catch-all node wrapping a single scalar <code>value</code> when no specialized type applies.</td></tr><tr><td>GithubAccount</td><td>GitHub profile/account node for social/OSINT correlation.</td></tr><tr><td>Goal</td><td>High-level testing goal for crawling/automation (domain, APK, session, or parent linkage).</td></tr><tr><td>GraphQLSchema</td><td>Introspected GraphQL schema tied to a web URL for API security testing.</td></tr><tr><td>Group</td><td>Security group (membership, tiering, privileges, ACL/control edges) in the internal model.</td></tr><tr><td>GPO</td><td>Group Policy Object (paths, affected objects, control/abuse-relevant metadata).</td></tr><tr><td>Host</td><td>Internal assessment host: hostname/IP, OS, DC flags, delegation, and compromise state.</td></tr><tr><td>InternalSubnet</td><td>Subnet or network segment used in external/ASM-style internal network modeling.</td></tr><tr><td>IPAddress</td><td>Single IP asset with liveness, ports, services, CPE, and sighting timestamps.</td></tr><tr><td>IPRange</td><td>CIDR or ranged network block with geo/hosting/asn context (lightweight non-Entity helper type in code).</td></tr><tr><td>LinkedinAccount</td><td>LinkedIn profile/account node for OSINT.</td></tr><tr><td>MailServer</td><td>MX host record (address and priority) for a domain’s mail infrastructure.</td></tr><tr><td>MediumAccount</td><td>Medium profile/account node for OSINT.</td></tr><tr><td>Memory</td><td>Short- or long-term agent memory blob linked to a parent entity for context retention.</td></tr><tr><td>NetworkHost</td><td>Network-visible host abstraction in ASM (host-level discovery complementing IP/Device).</td></tr><tr><td>PasswordFiles</td><td>Recovered credential material from files (username, hash, cracked password when available).</td></tr><tr><td>Secret</td><td>Normalized credential or sensitive artifact (identifiers + typed secrets + metadata).</td></tr><tr><td>Service</td><td>Network service on an IP (name, port, protocol, banner) driving follow-on checks.</td></tr><tr><td>ServiceName</td><td>Kerberos service principal / SPN-style record with delegation-related attributes.</td></tr><tr><td>Session</td><td>Interactive session identifier with user binding and active/inactive state.</td></tr><tr><td>S3Bucket</td><td>Object storage bucket with permissions, ownership, and enumeration summary.</td></tr><tr><td>SMB</td><td>SMB relationship or SMB-oriented finding distinct from a named share (<code>SMBShare</code>).</td></tr><tr><td>SMBShare</td><td>Discovered SMB share name with assessed access level.</td></tr><tr><td>SocialAccount</td><td>Platform-agnostic social profile (username, URL, stats, verification, enrichments).</td></tr><tr><td>Subnet</td><td>Internal engagement subnet (CIDR/name/gateway/DHCP context) for host discovery.</td></tr><tr><td>Technology</td><td>Stack or product fingerprint (e.g. framework/CMS) on an asset.</td></tr><tr><td>TestCase</td><td>Structured security test definition (ideas, indicators, CWE, severity, execution traces).</td></tr><tr><td>TestCaseSet</td><td>Batch container of test cases with category and optional downstream tester dispatch.</td></tr><tr><td>TGS</td><td>Kerberos service ticket (TGS) material with SPN, user, and expiry metadata.</td></tr><tr><td>TGT</td><td>Kerberos Ticket-Granting Ticket for a user/realm with expiry and encrypted payload.</td></tr><tr><td>Trajectory</td><td>Ordered list of actions (browser/API/mobile) summarizing a user flow for replay and deduped testing.</td></tr><tr><td>TwitterAccount</td><td>Twitter/X profile/account node for OSINT.</td></tr><tr><td>User</td><td>Domain or internal user with sam/name, membership, session/privilege edges, and compromise flag.</td></tr><tr><td>Vulnerability</td><td>Reported finding with target, CWE/CVE, CVSS, narrative, references, and verification state.</td></tr><tr><td>WebApplication</td><td>Web app surface (URL, title, tech, behaviors) grouping pages and behaviors.</td></tr><tr><td>WebPage</td><td>Concrete URL (dynamic-parameter pattern, content, screenshots) as the unit of web testing.</td></tr><tr><td>WebPageGroup</td><td>Deduplicated cluster of related <code>WebPage</code> records processed as a single batch.</td></tr><tr><td>WhoisData</td><td>Registrar/WHOIS fields for a domain (lifecycle, registrant hints, name servers, status).</td></tr><tr><td>Wordlist</td><td>Wordlist file path used for cracking or spraying workflows.</td></tr></tbody></table>