RedStrikeby Encyfr

Get Started

Core Concepts

The RedStrike data model: organizations, targets, scans, findings, and how they relate to each other.

2 min read

Understanding five objects is enough to use RedStrike effectively: organizations, targets, scans, findings, and members. This page defines each and shows how they fit together.

TL;DR

An organization owns everything. Targets are the assets you test. A scan runs tools against a target and produces findings. Findings are deduplicated and tracked over time. Members have roles that control what they can do.

The object model

Organization
├── Members (roles: owner, admin, analyst, viewer)
├── Targets (domains, IP ranges, cloud accounts)
│    └── Scans (a run of tools against a target)
│         └── Findings (issues, verified & deduplicated)
└── Integrations (Slack, Jira, webhooks)

Organizations

An organization is the tenant boundary. All data — targets, scans, findings, integrations, and members — belongs to exactly one organization, and data never crosses that boundary. Most companies need a single org; agencies may create one per client.

Targets

A target is something you test. RedStrike supports three kinds:

Target typeExamplesVerification
Web / hostapp.example.com, 10.0.0.5DNS TXT or file
Network range203.0.113.0/24Domain/ASN ownership
Cloud accountAWS, Azure, or GCPIAM role / service principal

Targets carry a verified flag. External scans require verified ownership.

Scans

A scan is a single run of one or more tools against a target using a chosen profile. Scans move through phases:

  1. Queued — waiting for a worker.
  2. Discovery — enumerating hosts, ports, and services.
  3. Scanning — running the profile's tools.
  4. Verifying — confirming which findings are exploitable.
  5. Complete — results are ready.

Scans can be one-off or scheduled (for example, nightly or weekly).

Findings

A finding is a single issue on a single asset. RedStrike deduplicates findings across scans, so the same vulnerability seen on Monday and Wednesday is one finding with history — not two. Each finding has:

  • A severity (Critical, High, Medium, Low, Info).
  • A status (New, Verified, Accepted, Dismissed, Fixed).
  • Evidence, reproduction steps, and remediation.

Because findings persist across scans, RedStrike can tell you when something was first seen, when it was verified, and when it was fixed — the timeline auditors and engineers both want.

Members and roles

Every user is a member of one or more organizations with a role that controls their permissions. See Roles & Permissions for the full matrix.

Next