Glossary

Terms used across this documentation and the platform. Product and tool names link to their role in the system.

Platform terms

Lab (pod) : One student's disposable environment: three containers (Kali, meta, DVWA) on a private OVN network. Called a "pod" in the code (pod_id, pods table). See Containers & Networks.

Scenario : A guided exercise. Four exist, with internal IDs 01, 06, 09, 11, shown to students as Scenarios 1 to 4. See Lab Scenarios.

Milestone : A scored step within a scenario. A milestone is PASS or FAIL; passing all of a scenario's milestones completes it.

Manual Check : The student-triggered scoring call (POST /pods/{id}/verify/...), as opposed to the automatic 3-second poller. One per task: a failed check locks the task to instructor review (manual_check_attempts).

Flag task : A final task that scores on a correct flag typed into the lab page alone (Scenario 1 and 2 Task 5, PURE_FLAG_MILESTONES).

Lab surface : The right-hand pane of the two-pane lab page: terminal, dvwa (embedded DVWA) or siem (terminal plus SIEM modal), chosen per scenario.

MFA / TOTP : Multi-factor authentication with time-based one-time passwords: a 6-digit code from an authenticator app, required for every account at sign-in since SEC-03.

STUCK (release) : The state where the host keeps skipping a release commit that failed to apply before; recorded in ~/cyberrange-data/rollback/STUCK and cleared with pull_release.sh --retry-bad.

Golden image : A prebuilt LXD image (kali-base, meta-base, dvwa-base) that every lab is cloned from, so each student gets an identical clean environment.

Reaper : The background task that destroys labs past their scenario's time limit (30 to 60 minutes, checked every 60 seconds) and cleans up stuck ones. See Provisioning.

Flag : A per-student secret string planted in a lab, generated as an HMAC keyed by COHORT_FLAG_SECRET. Used by the flag-submission scoring path; the flag-only tasks use a readable per-student code (for Scenario 1, a personal FLAG{S01_M5_…} token in a file planted on Kali; see Scenario 1).

Rubric : The criteria, points, MITRE technique and NIST phase for a milestone, seeded in milestone_rubrics.

Detection evidence : Optional Wazuh confirmation attached to a score (only Scenario 3 Milestone 1, rule 5710), recorded as detection_score.

Roles

Student : Runs labs and is scored. Default role. See Student.

Instructor : Monitors labs, reviews student submissions, grades. See Instructor.

Admin : Manages users and platform health, can force-destroy labs. See Admin.

App role : One of student, instructor, admin (Keycloak realm roles). Distinct from Keycloak's internal roles, which never grant platform access.

Components and products

Portal : The Next.js web application students and staff use. See Frontend.

BFF (backend-for-frontend) : The portal's server-side proxy (proxyToApi) that calls the API with the user's token so the browser never calls the API directly.

Provisioning API : The FastAPI service that creates and scores labs and manages users. See Backend.

Bridge : The Python WebSocket service that gives the browser a shell via lxc exec. See Terminal Access.

Keycloak : The identity provider (authentication and roles). Runs inside the guacamole container.

Wazuh : The SIEM. A manager-only deployment; agents run on meta and dvwa. Students triage its alerts in Scenario 3.

DVWA : Damn Vulnerable Web Application, the deliberately insecure web target for Scenario 2, run at security level Low.

Kali / meta / dvwa : The three lab machines: the Kali attacker box, the meta vulnerable Linux target (Tomcat, SSH, FTP; user msfadmin), and the DVWA web target.

"guacamole" container : The HTTP gateway container running nginx and Keycloak. The name is historical; it does not run Apache Guacamole. See Open Questions D12.

Cloudflare Tunnel : The outbound connection (cloudflared) that publishes the site without opening any inbound port on the host.

Infrastructure

LXD : The container/VM manager that runs all containers. Controlled through its API and lxc CLI.

OVN : Open Virtual Network, the SDN that provides each lab's isolated network and the peering to monitoring.

lxdbr0 / vmbr1 : The host LXD bridge (10.115.77.0/24) and the OVN uplink bridge (10.93.10.0/24).

mon-net / mgmt-net / pod-N-net : The monitoring network (Wazuh), the management network (gateway), and the per-lab networks (10.0.(50+N).0/24).

OCI : Oracle Cloud Infrastructure, the hosting provider. The VM is an Ampere A1 (aarch64) on the Always Free tier. See Oracle Cloud Setup.

Ampere A1 : The ARM-based OCI instance shape the platform runs on (2 OCPU, 12 GiB).

Security and standards

RBAC : Role-based access control, here the mapping of the three app roles to allowed routes and actions. See Roles & RBAC.

Introspection : OAuth2 token introspection (RFC 7662): the API asks Keycloak whether a token is active on every request, rather than verifying a signature locally.

PKCE : Proof Key for Code Exchange, an OAuth2 protection used in the portal's authorization-code login.

Owner check : A guard (require_owner) that returns 404 for a lab the caller does not own, hiding its existence.

MITRE ATT&CK : The adversary technique catalog; scenarios carry a technique tag (for example T1046, T1190).

STRIDE : A threat-modeling framework (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) used on the Threat Model page.

OWASP Top 10 : A standard list of web risks; not tagged in the code, referenced on scenario pages only as the closest fit.

Documentation conventions

Needs Verification / Unknown : A claim that cannot be confirmed from the repository and depends on the live host. Collected in Open Questions.

Discrepancy (D1 to D17) : A place where older documentation and the code disagree; the code is treated as the source of truth. Listed in Open Questions.

Finding (F1 to F18) : A security weakness from the defensive review, with severity and a fix. Listed in Findings.

Planned / Not Yet Implemented : A capability that is designed or partially present but not wired up (for example hybrid flag submission for non-final milestones, which has no portal UI).