cartography

The microsoft module is the top-level umbrella for Microsoft tenant, SaaS, and security control plane data ingested via Microsoft Graph. It contains two primary sub-modules:

• entra: Contains Entra ID identity objects such as users, groups, OUs, applications, service principals, and app role assignments.
• intune: Contains Intune managed devices, detected apps, and compliance policies.

Note: microsoft is the canonical top-level module name. While entra is still accepted as a backward-compatible alias for module selection and ontology source configuration, it is recommended to use microsoft.

The AIBOM module maps AI agent inventory from raw Cisco AIBOM 1.0.0rc4 reports onto production container images already present in Cartography.

Key graph entities include:

• AIBOMSource: The primary scanned-target node.
• AIBOMComponent: Represents source-scoped components detected within a scanned image. Each component maintains a stable logical_id to allow correlation of the same conceptual component across multiple scanned sources while preserving per-source identity.

Cartography is a Python-based tool designed to consolidate infrastructure assets and their relationships into an intuitive graph view. It uses a Neo4j database to power this graph, allowing users to visualize dependencies between service assets.

Key use cases include:

• Asset Reporting: Generating reports for service owners.
• Attack Path Discovery: Helping Red Teamers identify potential vulnerabilities.
• Security Improvement: Enabling Blue Teamers to identify areas for security hardening.
• Automation: Using APIs for automated security analysis and exploration.

The SnipeIT integration in Cartography maps tenants, users, and assets into a Neo4j graph. The schema uses specific relationships to link these entities, allowing for cross-platform security analysis.

Graph Structure:

• SnipeitTenant is the root resource.
• SnipeitTenant --RESOURCE--> SnipeitUser
• SnipeitTenant --RESOURCE--> SnipeitAsset
• SnipeitUser --HAS_CHECKED_OUT--> SnipeitAsset

Cartography can sync employee and organization data from Workday's HR system into Neo4j. This creates a graph representing organizational structures, reporting hierarchies, and job information.

Key features include:

• Employee data: Job information, location, and organizational structure.
• Manager hierarchies: Established via REPORTS_TO relationships.
• Organization nodes: Representing departments and teams.
• Human label integration: WorkdayHuman nodes use the Human label, allowing for identity correlation with other modules like Duo, Okta, and GitHub.