> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/exploit-graph/entities.md).

# Entities

Entities are the objects stored in the Exploit Graph. They represent scope, discovered assets, identities, testing context, and findings.

The exact entity labels vary by assessment type and enabled capabilities. Operators normally need the groups below rather than the complete internal graph schema.

## Scope and Asset Entities

| Entity                               | Meaning                                                                  |
| ------------------------------------ | ------------------------------------------------------------------------ |
| **Domain**                           | Web assessment root domain or discovered subdomain.                      |
| **IPAddress / Device / NetworkHost** | Discovered network address or externally visible host.                   |
| **Subnet**                           | Network assessment scope reported by an agent or created by discovery.   |
| **Host**                             | Computer, server, domain controller, or device on the target network.    |
| **Service**                          | Network service identified by port, protocol, product, or banner.        |
| **WebApplication / WebPage**         | Web application and its discovered URLs.                                 |
| **CloudResource**                    | Provider resource, endpoint, identity, policy, or other cloud inventory. |
| **Repository**                       | Source repository and associated code-assessment context.                |
| **APKFile**                          | Uploaded Android package when mobile assessment is enabled.              |

## Identity and Access Entities

| Entity                                         | Meaning                                                                                   |
| ---------------------------------------------- | ----------------------------------------------------------------------------------------- |
| **User / Group**                               | Directory identity and its memberships or privileges.                                     |
| **BrowserSession**                             | Recorded account context, browser state, and login actions for authenticated web testing. |
| **Secret / Credential / Ticket**               | Password, token, key, hash, Kerberos ticket, or other reusable authentication material.   |
| **CertificateAuthority / CertificateTemplate** | AD CS configuration relevant to certificate-based attack paths.                           |

Treat identity and credential properties as sensitive. Access to the graph does not imply permission to copy them outside the workspace.

## Testing and Finding Entities

| Entity                     | Meaning                                                                       |
| -------------------------- | ----------------------------------------------------------------------------- |
| **Goal**                   | A testing objective produced for a target or user flow.                       |
| **Trajectory**             | An ordered browser, API, or mobile interaction flow.                          |
| **TestCaseSet / TestCase** | Generated tests and their execution evidence.                                 |
| **Vulnerability**          | A finding with target, severity, evidence, remediation, and validation state. |

### Trajectory Types

A **single-API trajectory** has exactly one API request in its recorded flow. A **multi-API trajectory** has two or more API requests. Either can also include browser steps. A browser-only trajectory has no API requests.

Multi-API trajectories are tested in one of two prepared forms:

* **Cleaned multi-API**: a recorded flow reduced to the requests that matter;
* **Grouped multi-API**: related requests grouped automatically into one business flow.

Discovery creates trajectories. The Web Assessment phase tests the ones selected in **Trajectory scope**. See [Web Assessment Phase](/enterprise/how-to-trigger-a-web-assessment/web-assessment-phase.md#what-gets-tested).

## How to Use Entity Details

Open an entity to inspect its properties and connected relations. During triage, confirm:

* the entity belongs to the approved root scope;
* timestamps and module references match the run being reviewed;
* a browser session or identity matches the role described by the finding;
* credential or compromise state is handled according to the cleanup plan;
* the incoming and outgoing relations form a plausible path.

Use [Relations](/enterprise/exploit-graph/relations.md) to understand how the graph connects these objects. Use [Attack Paths](/enterprise/modules/attack-paths.md) for normal finding triage; the raw graph is primarily for deeper investigation.