Cybrary ForgeCYBRARY / FORGE
Back to Cybrary Forge
← Forge Ranges

Build a range from your own topology

Export a file from the tools you already run, and the import pipeline compiles it into a training range. The result is labeled honestly — a representative training range, never a clone of production — and every element the evidence could not supply is listed in a fidelity report rather than hidden. We publish exactly which formats and producer versions are tested; anything still in qualification says so.

Import a scan or diagram Start an import

Three roads in, in order of precision

  1. 1. Scan report — most precise

    An Nmap XML report is parsed here in your browser, fact by fact, with the time and vantage each observation came from. Nothing is guessed.

  2. 2. Inventory export

    A CSV from your CMDB is exact about the machines it lists, but says nothing about what is listening or how anything is connected.

  3. 3. Diagram — least precise

    A picture or drawing file is read by a language model. It is fuzzy by nature: a drawing shows intent, not running configuration, so every device, address, link and service it produces is a draft for you to check. Everything it invents is labeled, and anything it could not make out is listed rather than guessed.

Tested format matrix

Asset inventory (CSV)

Supported

.csv — machine names, addresses, owners, criticality

Qualified: Any spreadsheet or CMDB export; the mapping report shows how each column was read

  • Device names and addresses
  • Owners and criticality
  • Grouping columns you map yourself
  • Network links between devices
  • Listening services

Nmap scan report (XML)

Supported

.xml — from nmap -oX

Qualified: Nmap 7.80, 7.92, 7.94 and 7.95

  • Hosts, addresses and hardware addresses
  • Listening services with product and version banners
  • OS estimates, kept as estimates
  • Subnet masks, gateways and routes
  • Physical links and interface names
  • Firewall rules, NAT, installed software or patch level
  • Identities, shares and group membership

Network diagram — picture or PDF

Least precise

.png .jpg .webp .pdf — a Visio or Lucidchart export, or a photo of a whiteboard

Qualified: Read by a language model, not parsed. The least precise way in: a drawing shows what somebody drew, not what is running.

  • Device boxes, their labels and any addresses written on them
  • Named subnets, VLANs and zones
  • Lines between devices, as drawn
  • Any guarantee of accuracy — every device, address and link is a draft to check
  • Anything the drawing is out of date about
  • Regions it cannot make out, which are listed instead of guessed

Drawing tool file — draw.io, SVG, GraphML

Least precise

.drawio .svg .graphml .xml — the drawing tool's own export

Qualified: Also read by a model, from the file's text rather than pixels. More reliable than a photograph, still an interpretation.

  • Shape labels and text that pixels would blur
  • Named subnets and zones
  • Connector endpoints, as drawn
  • Proof that a drawn link or service actually exists
  • Effective policy, routing or configuration

runZero processed assets (JSON)

In qualification

.json — asset and service export

Qualified: In testing against current runZero exports

  • Assets and services with richer identity than a raw scan
  • Final qualification is not complete — not yet offered

NetBox snapshot

In qualification

.json — multi-object export

Qualified: In testing against current NetBox schemas

  • Documented topology: devices, interfaces, cables, prefixes, VLANs
  • Final qualification is not complete — not yet offered

Cisco controller bundles · Check Point policy + Gaia

In qualification

vendor configuration exports

Qualified: Next after runZero and NetBox

  • Interface configuration, routes and policy objects parsed into a constrained model
  • Never executed on a real host shell
  • Not yet offered

Nessus scan (enrichment)

In qualification

.nessus / .xml

Qualified: Later — enriches an estate that already exists

  • Vulnerability observations layered onto imported devices
  • Not a standalone source of topology
  • Not yet offered

How an import runs

A diagram is the easiest file to supply and the least trustworthy one to build on. If you have both, import the scan or inventory first and use the drawing only to fill in the segments and links a scan cannot see.

  1. 1. Export from your own tools

    For a scan, run nmap -oX report.xml against the scope you are authorized to touch. For an inventory, export CSV from your CMDB or spreadsheet. Collecting the data is your side of the fence — Forge never scans your network.

  2. 2. Start an estate import

    Choose the purpose (representative training, topology practice, configuration practice), name the tenant and project, and attest that you are authorized to import the data. Files are read by content, not by extension.

  3. 3. Privacy review before anything is kept

    Credentials, private keys, tokens and personal details are detected and removed. You can apply consistent pseudonyms to names, domains and addresses; the remapping is encrypted and separately authorized.

  4. 4. Reconcile devices yourself

    Candidates from different sources sit side by side with their evidence. You merge, split or exclude — nothing is merged automatically on an IP or hostname alone, because a DHCP lease change may be a different device.

  5. 5. Review topology and gaps

    The map shows what your evidence actually shows, with an explicit list of what is missing: masks, gateways, routes, link endpoints. A suggested training network is a proposal you edit, never a hidden default.

  6. 6. Map to Forge capabilities

    Each device gets a template and each service a fidelity tier — full behavior, banner only, or metadata. Anything the platform cannot honor is named, not silently approximated.

  7. 7. Validate, preview, publish

    A temporary preview estate runs the same engine as ordinary labs. The fidelity report lists every synthesis decision and excluded asset, approval binds that exact revision, and publishing creates an immutable version your cohorts stay pinned to.

What an import never does

  • Never contacts the imported addresses on a real network — customer public IPs stay virtual.
  • Never imports a working production credential or password hash; flagged secrets block publication.
  • Never merges devices on an address or hostname alone.
  • Never calls the result an exact copy, and never hides a dropped route or unsupported feature.
  • Never executes imported scripts, macros or vendor restore files.
  • Raw uploads are deleted after seven days; failed uploads after twenty-four hours.
Start an import