Web Dashboard Guide¶

The web dashboard keeps scope, assets, tests, findings, evidence, and reports together for one engagement at a time. AI analysis is optional.

Opening the Dashboard¶

The dashboard is served by the Raven server. Once the server is running, either in Docker or as a bare binary (see Install Raven), browse to it:

Docker: http://localhost:8080
Bare binary: http://localhost:8080 by default, or the -p port you started it with

The single-user server binds 127.0.0.1 by default; reach it from another machine over an SSH tunnel rather than exposing it (see Troubleshooting).

Individual Testing Workspace¶

Use Testing to choose a target set, inspect discovered services and findings, and prepare the next check. The workspace does not prescribe the same checklist for every engagement. Run a module or workflow when it fits the selected targets; smart scoping can narrow later steps to the services discovered by earlier ones.

Review the prepared command and execution location before starting it. Open the resulting run to follow output and import evidence. The selected engagement stays with that tab, and saved agent jobs remain attached to their original engagement after a server restart.

Settings groups engagement details, execution, tools and services, AI and privacy, and data recovery. Pairing is optional for Chamber Door managed AI; individual testing and manual prompt exchange work without it. Own-provider engagement analysis is configured under AI and privacy.

Dashboard Home¶

The individual navigation groups pages around the engagement:

Area	Pages
Overview	Engagement summary and activity
Scope & assets	Scope, hosts, screenshots, imports, and Active Directory
Testing	Testing workspace, tools, workflows, agents, and optional AI analysis
Runs	Job status and output
Findings	Findings, notes, credentials, and reusable writeups
Deliver	Reports, portals, and exports
Reference	Cheatsheets, LOTL, methodology, and terminal client
Settings	Configuration grouped by purpose

See Testing Workspace for target selection and the path from choosing a check to reviewing its evidence.

The main dashboard provides an at-a-glance view of your engagement:

Engagement Summary - Name, type, and status
Finding Statistics - Breakdown by severity with visual chart
Recent Activity - Latest findings and updates
Quick Actions - shortcuts to import a scan, run a module, or start a report

Severity Distribution¶

The dashboard prominently displays your finding distribution: - Critical (Red) - Immediate attention required - High (Orange) - Significant risk - Medium (Yellow) - Moderate risk - Low (Blue) - Minor issues - Info (Gray) - Informational findings

Findings Management¶

Findings with source, severity, affected assets, and retest actions in a fictional lab

The findings view is where you triage what the scans turned up:

Features¶

Severity badges - Color-coded for quick identification
Filtering - By severity, status, target, or search term
Sorting - By any column
Bulk actions - Update multiple findings at once
Add Finding - Record something you found by hand
Export - CSV, JSON, or direct to report

Adding a finding manually¶

Not everything comes from a scanner. Add Finding, on the Findings page, records anything you found by hand: title, host, severity, category and description.

The host field is free text rather than a picker, because a manually-raised finding often names something no scan discovered. Leave it blank and the finding is stored against N/A.

Findings entered this way are ordinary findings. They appear in the same tables, count toward the severity totals, and go into reports and exports alongside scanner output, so Raven can be your reporting tool without a round trip through PlexTrac.

Finding Details¶

Click any finding to see: - Full description and evidence - Affected targets - CVSS score and vectors - Remediation guidance - CVE references - Status history

Retest a Finding¶

In individual mode, Retest finding prepares the saved check for review. When Raven recorded the producing run, the preparation shows its command, targets, and execution location. Review it before choosing Run reviewed check.

For a finding entered manually, link the relevant saved background or agent run, or choose a check for its target in Testing. Raven does not invent a runnable command from a finding's prose. Starting or completing a retest does not by itself mark the finding remediated; inspect the new output and evidence.

Status Workflow¶

Open - Newly discovered
Confirmed - Manually verified
False Positive - Not actually vulnerable
Remediated - Fixed by client
Accepted - Risk accepted

Vulnerabilities View¶

Vulnerabilities

The Vulnerabilities view groups discovered issues by severity with at-a-glance counts (Critical / High / Medium / Low / Info), the affected host, CVE, CVSS score, and the source tool (nuclei, nessus, manual, etc.). Filter the tabs to focus on a severity band.

Hosts & Targets¶

Host inventory with services and finding counts from a fictional lab

Track all discovered systems:

Host inventory - All IPs, hostnames, URLs
Status indicators - Responding, filtered, down
Server fingerprints - Technologies detected
Vulnerability counts - Per-host finding summary
Last seen - Activity tracking

Click any host to open its detail page, which shows the fingerprint, open ports and services, and the vulnerabilities tied to that host:

Host Detail

Scope Management¶

Scope

Define and manage your assessment boundaries:

In-scope targets - What you're authorized to test
Exclusions - Systems to avoid
Import/Export - Bulk scope management
Validation - Ensure targets match scope

Use the Targets and Exclusions fields separately. IP addresses and CIDR networks are supported; an excluded network can narrow a larger allowed network. Save, then review the prepared target list for the check. See CIDR scope and exclusions for an example and the limits of scope review for custom commands.

Reports & Documentation¶

Reports

There are two ways to get a report out of Raven: the basic report, which is built from your engagement data alone, and the AI narrative reports, which draft prose you then edit. The basic report needs no AI and no credits.

Basic report (no AI)¶

Every tier, no credits

The Basic Report tab is the first tab on the Reports page and works on every install, paired or not. It never calls out to Chamber Door, so it also works air-gapped. See Offline Mode.

A deliverable built entirely from what's already in the engagement:

Scope: your in-scope entries and exclusions exactly as you wrote them (a /24 stays a /24)
Methodology: checklist progress per phase, the tooling that actually ran with run counts and timestamps, and any items you skipped along with the reason
Host inventory: hosts with open ports, detected server, and per-host finding counts
Findings: de-duplicated across hosts and grouped by severity, with description, recommendation, CVE/CWE and CVSS where known

Read it in the browser, or download it as a PDF with Download PDF. The same report is available from the terminal:

raven-server reports basic                        # markdown, into <engagement>/reports/
raven-server reports basic --format pdf           # PDF
raven-server reports basic -f pdf -o ./acme.pdf   # PDF, to a path you choose

Because it reads only local data, the same engagement always produces the same report. That's useful when you need to regenerate a deliverable months later.

AI narrative reports¶

These draft the prose a client report needs and draw from your AI credit balance. Use them on top of the basic report, not instead of it.

Report Templates¶

Executive Summary - High-level for management
Technical Report - Detailed findings for IT teams
Full Report - Comprehensive documentation
Custom Templates - Create your own formats

Report Features¶

AI-assisted narratives - draft finding write-ups and executive summaries you then edit
Finding inclusion - Select which vulnerabilities to include
Severity filtering - Focus on what matters
Multiple formats - PDF, DOCX, Markdown, HTML
Template library - Save and reuse templates

PlexTrac Integration¶

Export directly to PlexTrac for: - Writeup import - Finding sync - Narrative generation

AI Analysis¶

AI analysis showing BYO setup, manual exchange, and the optional managed service

AI Analysis offers native BYO engagement-snapshot analysis, a manual copy-prompt/paste-response workflow, and the separate managed advisor and chat. BYO sends a reviewed request directly to the saved provider; manual exchange needs no pairing or API key. Managed workflows require a paired Chamber Door account and available credits. Saving a BYO provider does not redirect managed tool-use loops or report writing.

Known identifiers become placeholders and recognized secrets are redacted on the Raven host. Review the text before sharing it; identifying context can remain. See AI Analysis for provider compatibility, local models, restoration, and privacy limits.

Modules & Scanning¶

Modules

Run security checks directly from the UI:

Available Modules¶

Nuclei Scanner - Template-based vulnerability scanning
DNS Zone Transfer - Test for misconfigurations
Email Security - SMTP checks including open-relay detection
FTP Security - Anonymous access, permissions
Default Credentials - Common password testing
SSL/TLS Analysis - Certificate and cipher checks

Open-relay testing also has a dedicated raven-server smtp-relay command.

Module Features¶

One-click execution - No command line needed
Progress tracking - Real-time status updates
Results integration - Findings auto-imported

Workflows¶

Workflows

Automate common assessment tasks:

Predefined Workflows¶

Web Application Assessment - Full web app testing
Network Discovery - Host and service enumeration
Vulnerability Scan - Comprehensive vuln detection
Credential Testing - Default password checks

Workflow Features¶

Step-by-step progress - Visual execution tracking
Pause/Resume - Control your scans
Parallel execution - Multiple targets simultaneously
Auto-findings - Results automatically captured

Export & Integration¶

Export

Export findings and hosts, or push to another tool:

Export Formats¶

CSV - Spreadsheet-ready findings
JSON - API and automation friendly
Markdown - Documentation ready
PDF/DOCX - Client deliverables

Integrations¶

Burp Suite - Import scan results
Nessus - Import vulnerability scans
PlexTrac - Direct export to platform

Jobs & Background Tasks¶

Jobs

Monitor long-running operations:

Active jobs - Currently running scans
Job queue - Pending tasks
History - Completed operations
Logs - Detailed output for troubleshooting

Job Controls¶

Cancel - Stop running jobs
Retry - Re-run failed tasks
View output - See detailed results

Remote Agent (RTA)¶

Agents

Deploy a Go-based agent to jumpboxes for remote scan execution:

Agent Deployment - Prepare an executable for the operator host and upload it over SSH, or download it for manual placement
Real-time Streaming - Job output via WebSocket
Credential Capture - Auto-parse hashes from tool output
Tool Detection - Agent discovers available tools (responder, impacket, etc.)
Job Management - Start, stop, and monitor remote jobs

See the Remote Agent (RTA / Jumpbox) guide for deployment and setup.

Notes & Documentation¶

Notes

Capture observations and methodology:

Free-form notes - Markdown supported
Target linking - Associate with specific hosts
Categories - Organize by type
Search - Find notes quickly
Export - Include in reports

Methodology¶

Methodology

The Methodology checklist tracks coverage across the phases of an engagement (Reconnaissance, Enumeration, Vulnerability Assessment, Exploitation, and so on) with per-phase progress. It adapts to the engagement type (the example above has AD testing enabled). Use it to make sure nothing's been skipped before you write up.

Active Directory¶

Active Directory

For internal engagements, import a BloodHound collection (Import page) and Raven surfaces the AD picture: users, computers, and groups, with Kerberoastable and AS-REP-roastable accounts and high-value targets called out. Attack-path context feeds the advisor and your write-ups.

Credentials Library¶

Credentials Library

The Credentials Library collects domain credentials and captured hashes in one place: what's been captured, what's been cracked, and what's usable for authenticated tooling. Captured hashes and configured credentials are tracked separately.

Credential handling for AI

Stored credentials and captured hashes are excluded from AI engagement context; recognized secret formats are redacted from included text. This does not detect every possible secret format. Review the prepared request and save relevant privacy rules. See AI Analysis.

Configuration¶

AI and privacy settings with provider-specific controls

In individual mode, Settings groups engagement and installation configuration by purpose. Register client shortnames, office names, and other sensitive terms under AI & privacy so they join the identifier substitutions used for AI.

Layout¶

Choose Engagement, Execution, Tools & services, AI & privacy, or Data & recovery. Where available, choose This engagement or This installation to see which settings you are editing.

Each area's Save button saves that area's fields. Save each area you change; saving Execution does not save unsaved privacy rules. Native BYO provider settings have their own save control and apply across engagements. The existing Team configuration retains its separate layout and full-form save behavior.

Local redaction preview using saved rules and fictional text

The local preview makes no model request. Save relevant privacy rules first, then use fictional text to inspect replacements. A provider connection test is a separate action: it makes a small provider request without engagement data and may incur provider charges.

API key precedence¶

Keys can be set globally and overridden per engagement:

Engagement value	What is used
Set	The engagement value
Blank	The global value
Cleared	The global value

These inheritance rules apply to the tool/service keys in the engagement form. To stop an inherited key being used, clear it for This installation too. Native BYO provider keys use their separate provider settings, not this table.

Changes take effect on the next tool run. If a tool reports a missing key, confirm that you saved Tools & services for the intended engagement or installation.

Reference¶

Raven bundles offline reference material you can reach without leaving an engagement:

Living Off The Land: LOLBAS / GTFOBins / LOOBins lookups plus native-binary attack modules with copy-ready commands.
Offensive Tools: a categorized reference of common offensive tooling and usage.
Cheatsheets: quick-reference command cheatsheets.
Findings Library: reusable finding templates to drop into an engagement.

Tips & Best Practices¶

Efficient Workflow¶

Import scans first - Nessus, Nuclei, etc.
Use AI consolidation - Reduce duplicates
Triage by severity - Critical/High first
Add evidence - Screenshots, proof
Generate report - Use templates

Organization¶

Tag findings - By technique, service, priority
Link related items - Build attack chains
Take notes - Document methodology

Performance¶

Use filters - Don't load everything
Archive old engagements - Keep things fast
Export regularly - Backup your work