Pentest agents that leave an auditable evidence trail.

Security validation falls apart when findings and logs split.

A pentest agent can produce a useful FINDING like finding-017, but the value disappears once that finding lives in a report draft, its supporting LOG_EVENT data lives in a separate logging system, and red-team replay data becomes a disconnected dashboard nobody reconciles. When severity is high and status is still open, the security team needs one place to see the finding, the evidence backing it, and the related log-884 privilege-misuse events without stitching three tools together during triage.

Graph intelligence on ingest

Incoming data becomes queryable graph context.

ASSESSMENT_RUN payloads nest TARGET, FINDING, EVIDENCE, and LOG_EVENT records as sandbox agents produce them. RushDB types severity, status, and tactic on arrival, so a finding like finding-017 stays queryable by severity while its nested EVIDENCE and sibling LOG_EVENT entries remain traversable from the same assessmentRunId.

Suggested relationship analysis requires an LLM configured for the project. Suggestions stay in draft form until you approve them, so inferred domain meaning never mutates the graph silently. You can also add explicit relationships through the SDK or API.

Data model

One flexible graph for the workflow.

Start with the payload shape your product already produces. RushDB stores it as Records, infers typed properties, and keeps nested or approved domain relationships queryable.

{
  "assessmentRunId": "rt-sandbox-42",
  "environment": "sandbox",
  "authorizationId": "auth-2026-06",
  "TARGET": [{
    "targetId": "web-app-sandbox",
    "systemType": "training-web-app",
    "FINDING": [{
      "findingId": "finding-017",
      "category": "access-control",
      "severity": "high",
      "status": "open",
      "EVIDENCE": [{ "evidenceId": "ev-017", "kind": "log_summary" }]
    }],
    "LOG_EVENT": [{ "eventId": "log-884", "tactic": "privilege-misuse", "severity": "high" }]
  }]
}

Working example

Commit a finding. Visualize the related abuse events.

An authorized sandbox agent records one access-control finding with evidence. The red-team UI reads open findings and groups related log events by tactic and severity.

ASSESSMENT_RUN rt-sandbox-42
  TARGET web-app-sandbox
  FINDING finding-017 severity: high status: open
  EVIDENCE ev-017 kind: log
  LOG_EVENT log-884 tactic: privilege-misuse severity: high

{
  "labels": ["LOG_EVENT"],
  "where": {
    "ASSESSMENT_RUN": { "assessmentRunId": "rt-sandbox-42" }
  },
  "select": { "events": { "$count": "$record" } },
  "groupBy": ["$record.tactic", "$record.severity"],
  "orderBy": { "events": "desc" }
}

[
  { "tactic": "privilege-misuse", "severity": "high", "events": 12 },
  { "tactic": "suspicious-session", "severity": "medium", "events": 7 }
]

TypeScript SDK

Commit findings and query abuse telemetry from one graph.

The agent writes only authorized sandbox observations. The same RushDB records power evidence review, red-team event visualization, and defensive reporting.

from rushdb import RushDB

db = RushDB('RUSHDB_API_KEY')

db.records.import_json({
    'label': 'ASSESSMENT_RUN',
    'data': {
        'assessmentRunId': 'rt-sandbox-42',
        'environment': 'sandbox',
        'authorizationId': 'auth-2026-06',
        'TARGET': [{
            'targetId': 'web-app-sandbox',
            'systemType': 'training-web-app',
            'FINDING': [{
                'findingId': 'finding-017',
                'severity': 'high',
                'category': 'access-control',
                'status': 'open',
                'summary': 'Test principal reached an admin-only workflow in the sandbox.',
                'EVIDENCE': [{'evidenceId': 'ev-017', 'kind': 'log', 'summary': 'Correlated sandbox logs and UI state.'}],
            }],
            'LOG_EVENT': [{'eventId': 'log-884', 'tactic': 'privilege-misuse', 'severity': 'high'}],
        }],
    },
})

open_findings = db.records.find({
    'labels': ['FINDING'],
    'where': {'ASSESSMENT_RUN': {'assessmentRunId': 'rt-sandbox-42'}, 'status': 'open'},
    'limit': 50,
})

Implementation blueprint

Build the authorized security-validation path.

Use this sequence to keep pentest findings, evidence, triage, and red-team visualization grounded in one defensive datasource.

Relevant docs

Read the exact primitives behind this pattern.

These links point to the RushDB docs pages that map directly to this blueprint: ingestion, labels, properties, values, SearchQuery, relationships, semantic search, MCP, or deployment.

How it works

Build the smallest useful workflow first.

Know where it fits.

Questions developers ask.