# Icon Catalog

Use only exact `IconKey` values from `scenario.d.ts`.

This file is the readable icon-selection guide. Prefer the most specific icon that matches the entity. Do not fall back to `IconDefault`, `IconCloud`, or `IconServer` when a clearer icon exists.

## Runtime contract

- The graph JSON field is `entity.icon`.
- `entity.icon` must contain an exact logical registry key such as `IconAWS`, `IconGitHub`, or `IconFortiGate`.
- Do not use SVG filenames such as `aws.svg`, `github.svg`, or `FortiGate.svg`.
- Do not use `iconPath` in Scenario JSON. The renderer computes `iconPath` later from the registry.
- Invalid icon keys silently fall back to the default icon at render time, so validate icon values before finalizing.
- If you are not sure which exact key fits, omit `icon` instead of inventing a new one.

Correct:

- `"icon": "IconAWS"`
- `"icon": "IconFortiGate"`

Wrong:

- `"icon": "aws.svg"`
- `"icon": "FortiGate.svg"`
- `"icon": "Aws"`
- `"iconPath": "assets/icons/aws.svg"`
- `"icon": "IconFortinet"`

## Roles and people

- `IconAttacker`, `IconAttackerAlt`, `IconHacker`: attacker or threat actor
- `IconUser`: normal user, maintainer, client
- `IconVictim`: compromised or targeted human actor

## Operating systems and hosts

- `IconKali`: attacker workstation or Kali box
- `IconWindows`, `IconLinux`, `IconWinServer`: operating-system-specific systems
- `IconServer`: generic server when no stronger identity exists
- `IconWorkstation`, `IconMachine`, `IconMobile`: endpoint-style systems
- `IconActiveDirectory`, `IconDC`: Active Directory or domain controller concepts

## Network, cloud, and infrastructure

- `IconCloud`, `IconNetwork`: internet, VPC, network zone, subnet
- `IconRouter`, `IconFirewall`, `IconWAF`, `IconVPN`: network/security appliances
- `IconAWS`, `IconAzure`, `IconGoogle`, `IconLambda`, `IconMetadata`: cloud-specific entities
- `IconSKTelecom`: SK Telecom or SK-branded infrastructure

## Devtools, package, and browser surface

- `IconGit`, `IconGitHub`, `IconNpm`, `IconPackage`
- `IconDocker`, `IconKubernetes`, `IconPipeline`
- `IconAPI`, `IconBucket`, `IconBrowser`

## System internals and data

- `IconTerminal`, `IconPowerShell`
- `IconProcess`, `IconService`, `IconMemory`, `IconKernel`
- `IconRegistry`, `IconScheduler`
- `IconDatabase`, `IconMSSQL`, `IconMySQL`, `IconPostgreSQL`
- `IconCode`, `IconEnv`, `IconVariable`, `IconFolder`, `IconData`

## Credentials and secrets

- `IconCredential`, `IconCreds`
- `IconKey`, `IconToken`, `IconCertificate`, `IconTicket`, `IconHash`, `IconMFA`

## Communication and collaboration

- `IconDNS`, `IconSocks`
- `IconEmail`, `IconMail`
- `IconSlack`, `IconTeams`, `IconDiscord`
- `IconWeb`

## Actions and tools

- `IconSearch`, `IconDownload`, `IconUpload`
- `IconInject`, `IconExploit`, `IconPenetrationTool`
- `IconBurpSuite`, `IconMetasploit`
- `IconAlert`, `IconCheck`, `IconLock`

## Malware, persistence, and attacker-controlled components

- `IconMalware`, `IconBackdoor`, `IconC2`, `IconCobaltStrike`, `IconEDR`
- `IconInfectedCode`, `IconInfectedProcess`, `IconInfectedTerminal`
- `IconInfectedService`, `IconInfectedPackage`, `IconInfectedPipeline`
- `IconInfectedDocker`, `IconInfectedScheduler`

## Exfiltrated or stolen artifacts

- `IconStolenToken`, `IconStolenKey`, `IconStolenCredential`
- `IconStolenCertificate`, `IconStolenDatabase`

## Brand and product icons

- `IconFortiGate`, `IconFortiPAM`, `IconFortiDeceptor`, `IconFortiSIEM`

## Selection rules

- If the label or evidence names a vendor or product and a matching icon exists, use that branded icon.
- If the entity is attacker-controlled or malicious, prefer an infected or malware variant when one fits.
- If the entity is exfiltrated, dumped, or harvested, prefer a stolen variant when one fits.
- Use generic icons only when the evidence truly does not justify a more specific choice.
