Rhombus Core · RACC
Operate your mission stack. Don't assemble it.
A full SOC stack of sensors, SIEM, threat intel, malware lab, deception and training range is usually a months-long integration project. With Rhombus it's a catalog of mission packages that one operator deploys, checks, patches, resets and sustains from a browser, with no internet connection.
Architecture
Three planes, one system of record.
Control plane
Rhombus Application Control Console
Orchestration, lifecycle, validation, sustainment, compliance and audit. It talks to the hypervisor through a backend contract, so the operator experience is the same whatever the hardware.
Access plane
Browser-delivered workspaces
Analysts reach every tool through their browser with single sign-on. Nothing gets installed on analyst laptops, and access follows role.
Mission plane
Hardened mission services
Monitoring, analytics, intel, malware analysis, deception and range services run on hardened STIG/FIPS images, in isolated network segments per function.
Foundation
Infrastructure as code
Every service is built from version-controlled code, so every kit is repeatable and every change is traceable. A per-kit identity and answer file sets the domain, branding and scenario selection.
Capabilities by lifecycle stage
What the console does, stage by stage.
Deploy
Mission packages, not integration projects
Scenario catalog
Mission packages such as the Incident Response Kit or Malware Analysis Lab deploy as a whole, with dependency ordering handled for you.
Parallel, observable deployment
Multiple deployments run side by side. A live view shows each phase, elapsed time and an ETA.
Extensible catalog
Add custom VMs from hardened base templates, define custom scenarios with build waves, and scale instances in or out.
Validate
Proof it works, not just that it powered on
Validation testing
Checks across core services, identity, analyst workspaces, sensors, threat intel and the console itself.
Validate & self-heal
Failed critical checks re-run their install automatically.
Acceptance report
Export a Kit Validation & Acceptance Report as a PDF.
Operate
One console, every role
Role-based access
Analyst, administrator and platform-admin roles, with single sign-on or directory login and a logged break-glass account.
Audit trail
Every deploy, reset and destroy is logged with user and time. Live job output can be exported.
Guardrails
Destructive actions need typed confirmation. Core infrastructure is protected behind a support authorization.
Health dashboards
Host, VM, service, capture-tap ingest and GPU dashboards built in.
User management
Create, disable and reset kit directory users and groups from the console.
REST API
Documented OpenAPI interface for integration and automation.
Sustain
Patched and current, air-gapped
Offline sustainment bundles
Signed, checksummed quarterly bundles applied via upload or USB. They apply atomically, with a rollback point kept for the update repositories.
Patch management
Nightly update scans on every VM. Patch or patch-and-reboot per VM or in bulk, with a PDF record.
Compliance scans
On-demand compliance scans against each VM’s DISA STIG profile, with a downloadable evidence package.
Diagnostics
A single-action diagnostic package for remote triage by support.
Reset
Back to known-good between missions
Factory reset
Rebuild mission services to the delivered baseline as a single job, typically 70–90 minutes for a full reset.
Core preserved
Identity, DNS, routing and orchestration are never touched by a reset. Custom VMs are preserved.
Honest by design
We tell you what it does, and what it doesn't.
Deployment takes minutes to about an hour per service depending on what it is, not "one click". STIG scans report findings; they don't silently change your configuration. A factory reset restores the delivered baseline; it isn't a media wipe. Compliance scan scores support your accreditation; they aren't a certification.
Operators trust a platform that states its limits. That's how the console itself is written.
Field guides
Field guides to every day after deployment.
- How to Reset a Fly-Away Kit to a Known-Good BaselineHow to return a fly-away kit to a known-good baseline between missions: rebuild mission machines from code, protect core services and check the result.
- Kit Acceptance Testing: Proving a Deployable Kit's Sensors WorkHow to validate a deployable cyber kit and produce an acceptance test report: check every service, prove the sensors see traffic and record sign-off.
- Offline Patching for Air-Gapped Fly-Away Kits, With RollbackHow to patch an air-gapped fly-away kit offline: signed update bundles, verification before anything changes, and a rollback point for every apply.
- STIG Evidence for a Deployable Kit's RMF PackageHow to produce DISA STIG scan evidence for a deployable kit: ARF results, STIG Viewer imports, documented deviations and a PDF your assessor can file.
See the full lifecycle in 90 minutes.
Our end-to-end briefing takes a Rhombus kit from power-on through detection, investigation, evidence export and reset to baseline. It runs on real hardware, fully offline.