cartography 0.104.0rc2__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/rules/data/rules/mfa_missing.py

@@ -0,0 +1,46 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# Facts
+_missing_mfa_cloudflare = Fact(
+    id="missing-mfa-cloudflare",
+    name="Cloudflare members with disabled MFA",
+    description="Finds Cloudflare member accounts that have Multi-Factor Authentication disabled.",
+    module=Module.CLOUDFLARE,
+    cypher_query="""
+    MATCH (m:CloudflareMember)
+    WHERE m.two_factor_authentication_enabled = false
+    RETURN m.id AS id, m.email AS email, m.firstname AS firstname, m.lastname AS lastname, m.status AS status
+    """,
+    cypher_visual_query="""
+    MATCH (m:CloudflareMember)
+    WHERE m.two_factor_authentication_enabled = false
+    RETURN m
+    """,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class MFARuleOutput(Finding):
+    email: str | None = None
+    id: str | None = None
+    firstname: str | None = None
+    lastname: str | None = None
+
+
+missing_mfa_rule = Rule(
+    id="mfa-missing",
+    name="User accounts missing MFA",
+    description="Detects user accounts that do not have Multi-Factor Authentication enabled.",
+    output_model=MFARuleOutput,
+    tags=("identity",),
+    facts=(
+        # TODO: _missing_mfa_slack,
+        _missing_mfa_cloudflare,
+    ),
+    version="0.1.0",
+)

cartography/rules/data/rules/object_storage_public.py

@@ -0,0 +1,100 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS Facts
+_aws_s3_public = Fact(
+    id="aws_s3_public",
+    name="Internet-Accessible S3 Storage Attack Surface",
+    description=("AWS S3 buckets accessible from the internet"),
+    cypher_query="""
+    MATCH (b:S3Bucket)
+    WHERE b.anonymous_access = true
+    OR (b.anonymous_actions IS NOT NULL AND size(b.anonymous_actions) > 0)
+    OR EXISTS {
+        MATCH (b)-[:POLICY_STATEMENT]->(stmt:S3PolicyStatement)
+        WHERE stmt.effect = 'Allow'
+        AND (stmt.principal = '*' OR stmt.principal CONTAINS 'AllUsers')
+    }
+    RETURN
+        b.id as id,
+        b.name AS name,
+        b.region AS region,
+        b.anonymous_access AS public_access,
+        b.anonymous_actions AS public_actions
+    """,
+    cypher_visual_query="""
+    MATCH (b:S3Bucket)
+    WHERE b.anonymous_access = true
+    OR (b.anonymous_actions IS NOT NULL AND size(b.anonymous_actions) > 0)
+    OR EXISTS {
+        MATCH (b)-[:POLICY_STATEMENT]->(stmt:S3PolicyStatement)
+        WHERE stmt.effect = 'Allow'
+        AND (stmt.principal = '*' OR stmt.principal CONTAINS 'AllUsers')
+    }
+    WITH b
+    OPTIONAL MATCH p=(b)-[:POLICY_STATEMENT]->(:S3PolicyStatement)
+    RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+# Azure Facts
+_azure_storage_public_blob_access = Fact(
+    id="azure_storage_public_blob_access",
+    name="Azure Storage Accounts with Public Blob Containers",
+    description=(
+        "Azure Storage Accounts that have blob containers with public access. "
+        "If a storage blob container has public_access set to 'Container' or 'Blob', "
+        "it means that the container is publicly accessible."
+    ),
+    cypher_query="""
+    MATCH (sa:AzureStorageAccount)-[:USES]->(bs:AzureStorageBlobService)-[:CONTAINS]->(bc:AzureStorageBlobContainer)
+    WHERE bc.publicaccess IN ['Container', 'Blob']
+    RETURN
+        sa.id AS account_id,
+        sa.name AS account,
+        sa.resourcegroup AS resource_group,
+        sa.location AS region,
+        bc.id as id,
+        bc.name AS name,
+        bc.publicaccess AS public_access_element,
+        bc.publicaccess IN ['Container', 'Blob'] AS public_access
+    """,
+    cypher_visual_query="""
+    MATCH p=(sa:AzureStorageAccount)-[:USES]->(bs:AzureStorageBlobService)-[:CONTAINS]->(bc:AzureStorageBlobContainer)
+    WHERE bc.publicaccess IN ['Container', 'Blob']
+    RETURN *
+    """,
+    module=Module.AZURE,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class ObjectStoragePublic(Finding):
+    name: str | None = None
+    id: str | None = None
+    account: str | None = None
+    account_id: str | None = None
+    region: str | None = None
+    public_access: bool | None = None
+
+
+object_storage_public = Rule(
+    id="object_storage_public",
+    name="Public Object Storage Attack Surface",
+    description=(
+        "Publicly accessible object storage services such as AWS S3 buckets and Azure Storage Blob Containers"
+    ),
+    output_model=ObjectStoragePublic,
+    facts=(
+        _aws_s3_public,
+        _azure_storage_public_blob_access,
+    ),
+    tags=("infrastructure", "attack_surface"),
+    version="0.1.0",
+)

cartography/rules/data/rules/policy_administration_privileges.py

@@ -0,0 +1,104 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS
+_aws_policy_manipulation_capabilities = Fact(
+    id="aws_policy_manipulation_capabilities",
+    name="Principals with IAM Policy Creation and Modification Capabilities",
+    description=(
+        "AWS IAM principals that can create, modify, or attach IAM policies to other principals. "
+    ),
+    cypher_query="""
+        MATCH (a:AWSAccount)-[:RESOURCE]->(principal:AWSPrincipal)
+        MATCH (principal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(allow_stmt:AWSPolicyStatement {effect:"Allow"})
+        WHERE NOT principal.name STARTS WITH 'AWSServiceRole'
+        AND NOT principal.name CONTAINS 'QuickSetup'
+        AND principal.name <> 'OrganizationAccountAccessRole'
+        WITH a, principal, policy, allow_stmt,
+            [label IN labels(principal) WHERE label <> 'AWSPrincipal'][0] AS principal_type,
+            [
+            'iam:CreatePolicy','iam:CreatePolicyVersion',
+            'iam:AttachUserPolicy','iam:AttachRolePolicy','iam:AttachGroupPolicy',
+            'iam:DetachUserPolicy','iam:DetachRolePolicy','iam:DetachGroupPolicy',
+            'iam:PutUserPolicy','iam:PutRolePolicy','iam:PutGroupPolicy'
+            ] AS patterns
+        // Step 1 - Collect (action, resource) pairs for allowed statements
+        UNWIND allow_stmt.action AS allow_action
+            WITH a, principal, principal_type, policy, allow_stmt, allow_action, patterns
+            WHERE ANY(p IN patterns WHERE allow_action = p)
+            OR allow_action = 'iam:*'
+            OR allow_action = '*'
+        WITH a, principal, principal_type, policy, allow_stmt, allow_action, allow_stmt.resource AS allow_resources
+        // Step 2 - Gather all Deny statements for the same principal
+        OPTIONAL MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(deny_stmt:AWSPolicyStatement {effect:"Deny"})
+        WITH a, principal, principal_type, policy, allow_action, allow_resources,
+            REDUCE(acc = [], ds IN collect(deny_stmt.action) | acc + ds) AS all_deny_actions
+        // Step 3 - Filter out denied actions (handles *, iam:*, exact, and prefix wildcards)
+        WHERE NOT (
+            '*' IN all_deny_actions OR
+            'iam:*' IN all_deny_actions OR
+            allow_action IN all_deny_actions OR
+            ANY(d IN all_deny_actions WHERE d ENDS WITH('*') AND allow_action STARTS WITH split(d,'*')[0])
+        )
+        // Step 4 - Preserve (action, resource) mapping
+        UNWIND allow_resources AS resource
+        RETURN DISTINCT
+            a.name AS account,
+            a.id   AS account_id,
+            principal.name AS principal_name,
+            principal.arn  AS principal_identifier,
+            principal_type,
+            policy.name    AS policy_name,
+            allow_action   AS action,
+            resource
+        ORDER BY account, principal_name, action, resource
+    """,
+    cypher_visual_query="""
+    MATCH p1=(a:AWSAccount)-[:RESOURCE]->(principal:AWSPrincipal)
+    MATCH p2=(principal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+    WHERE NOT principal.name STARTS WITH 'AWSServiceRole'
+    AND NOT principal.name CONTAINS 'QuickSetup'
+    AND principal.name <> 'OrganizationAccountAccessRole'
+    AND stmt.effect = 'Allow'
+    AND ANY(action IN stmt.action WHERE
+        action CONTAINS 'iam:CreatePolicy' OR action CONTAINS 'iam:CreatePolicyVersion'
+        OR action CONTAINS 'iam:AttachUserPolicy' OR action CONTAINS 'iam:AttachRolePolicy'
+        OR action CONTAINS 'iam:AttachGroupPolicy' OR action CONTAINS 'iam:DetachUserPolicy'
+        OR action CONTAINS 'iam:DetachRolePolicy' OR action CONTAINS 'iam:DetachGroupPolicy'
+        OR action CONTAINS 'iam:PutUserPolicy' OR action CONTAINS 'iam:PutRolePolicy'
+        OR action CONTAINS 'iam:PutGroupPolicy' OR action = 'iam:*' OR action = '*'
+    )
+    RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Findings
+class PolicyAdministrationPrivileges(Finding):
+    principal_name: str | None = None
+    principal_identifier: str | None = None
+    account: str | None = None
+    account_id: str | None = None
+    principal_type: str | None = None
+    policy_name: str | None = None
+    action: str | None = None
+    resource: str | None = None
+
+
+policy_administration_privileges = Rule(
+    id="policy_administration_privileges",
+    name="Policy Administration Privileges",
+    description=(
+        "Principals can create, attach/detach, or write IAM policies—often enabling "
+        "indirect privilege escalation."
+    ),
+    output_model=PolicyAdministrationPrivileges,
+    facts=(_aws_policy_manipulation_capabilities,),
+    tags=("iam", "privilege_escalation"),
+    version="0.1.0",
+)

cartography/rules/data/rules/unmanaged_accounts.py

@@ -0,0 +1,43 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# Facts
+_unmanaged_accounts_ontology = Fact(
+    id="unmanaged-accounts-ontology",
+    name="User accounts not linked to a user identity",
+    description="Finds user accounts that are not linked to an ontology user node.",
+    cypher_query="""
+    MATCH (a:UserAccount)
+    WHERE NOT (a)<-[:HAS_ACCOUNT]-(:User)
+    AND (a.active = true OR a.active IS NULL)
+    return a.id as id, a._ont_email AS email, a._ont_source AS source
+    """,
+    cypher_visual_query="""
+    MATCH (a:UserAccount)
+    WHERE NOT (a)<-[:HAS_ACCOUNT]-(:User)
+    AND (a.active = true OR a.active IS NULL)
+    return a
+    """,
+    module=Module.CROSS_CLOUD,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class UnmanagedAccountRuleOutput(Finding):
+    id: str | None = None
+    email: str | None = None
+
+
+unmanaged_accounts = Rule(
+    id="unmanaged-account",
+    name="User accounts not linked to a user identity",
+    description="Detects accounts that are not linked to a known user identity (inactive accounts are excluded).",
+    output_model=UnmanagedAccountRuleOutput,
+    tags=("identity", "iam", "compliance"),
+    facts=(_unmanaged_accounts_ontology,),
+    version="0.1.1",
+)

cartography/rules/data/rules/workload_identity_admin_capabilities.py

@@ -0,0 +1,193 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS
+_aws_service_account_manipulation_via_ec2 = Fact(
+    id="aws_service_account_manipulation_via_ec2",
+    name="Service Resources with Account Manipulation Through Instance Profiles",
+    description=(
+        "AWS EC2 instances with attached IAM roles that can manipulate other AWS accounts. "
+        "Also indicates whether the instance is internet-exposed."
+    ),
+    cypher_query="""
+        MATCH (a:AWSAccount)-[:RESOURCE]->(ec2:EC2Instance)
+        MATCH (ec2)-[:INSTANCE_PROFILE]->(profile:AWSInstanceProfile)
+        MATCH (profile)-[:ASSOCIATED_WITH]->(role:AWSRole)
+        MATCH (role)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(allow_stmt:AWSPolicyStatement {effect:"Allow"})
+        WITH a, ec2, role, allow_stmt,
+            ['iam:Create','iam:Attach','iam:Put','iam:Update','iam:Add'] AS patterns
+        // Step 1: Collect allowed actions that match IAM modification patterns
+        WITH a, ec2, role, patterns,
+            [action IN allow_stmt.action
+                WHERE ANY(p IN patterns WHERE action STARTS WITH p)
+                OR action = 'iam:*'
+                OR action = '*'
+            ] AS matched_allow_actions
+        WHERE size(matched_allow_actions) > 0
+        // Step 2: Collect deny statements for the same role
+        OPTIONAL MATCH (role)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(deny_stmt:AWSPolicyStatement {effect:"Deny"})
+        WITH a, ec2, role, patterns, matched_allow_actions,
+            // Flatten the deny action lists manually
+            REDUCE(acc = [], ds IN collect(deny_stmt.action) | acc + ds) AS all_deny_actions
+        // Step 3: Compute effective = allows minus denies
+        WITH a, ec2, role, matched_allow_actions, all_deny_actions,
+            [action IN matched_allow_actions
+                WHERE NOT (
+                    // Full wildcard Deny *
+                    '*' IN all_deny_actions OR
+                    // IAM category wildcard Deny iam:*
+                    'iam:*' IN all_deny_actions OR
+                    // Exact match deny
+                    action IN all_deny_actions OR
+                    // Prefix wildcards like Deny iam:Update*
+                    ANY(d IN all_deny_actions WHERE d ENDS WITH('*') AND action STARTS WITH split(d,'*')[0])
+                )
+            ] AS effective_actions
+        WHERE size(effective_actions) > 0
+        // Step 4: Optional internet exposure context
+        OPTIONAL MATCH (ec2 {exposed_internet: True})
+            -[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)
+            <-[:MEMBER_OF_EC2_SECURITY_GROUP]-(ip:IpPermissionInbound)
+        UNWIND effective_actions AS action
+        WITH a, ec2, role, sg, ip, COLLECT(DISTINCT action) AS actions
+        RETURN DISTINCT
+            ec2.id AS workload_id,
+            a.name AS account,
+            a.id AS account_id,
+            role.name AS role_name,
+            actions,
+            ec2.exposed_internet AS internet_accessible,
+            ec2.publicipaddress AS public_ip_address,
+            ip.fromport AS from_port,
+            ip.toport AS to_port
+        ORDER BY account, workload_id, internet_accessible, from_port
+    """,
+    cypher_visual_query="""
+        MATCH p = (a:AWSAccount)-[:RESOURCE]->(ec2:EC2Instance)
+        MATCH p1 = (ec2)-[:INSTANCE_PROFILE]->(profile:AWSInstanceProfile)
+        MATCH p2 = (profile)-[:ASSOCIATED_WITH]->(role:AWSRole)
+        MATCH p3 = (role)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+        WHERE stmt.effect = 'Allow'
+        AND ANY(action IN stmt.action WHERE
+            action STARTS WITH 'iam:Create'
+            OR action STARTS WITH 'iam:Attach'
+            OR action STARTS WITH 'iam:Put'
+            OR action STARTS WITH 'iam:Update'
+            OR action STARTS WITH 'iam:Add'
+            OR action = 'iam:*'
+            OR action = '*'
+        )
+        WITH p, p1, p2, p3, ec2
+        // Include the SG and rules for the instances that are internet open
+        MATCH p4=(ec2{exposed_internet: true})-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)<-[:MEMBER_OF_EC2_SECURITY_GROUP]-(ip:IpPermissionInbound)
+        RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+_aws_service_account_manipulation_via_lambda = Fact(
+    id="aws_service_account_manipulation",
+    name="Service Resources with Account Manipulation Through Lambda Roles",
+    description=(
+        "AWS Lambda functions with IAM roles that can manipulate other AWS accounts."
+    ),
+    cypher_query="""
+        // Find Lambda functions with IAM modification or account manipulation capabilities
+        MATCH (a:AWSAccount)-[:RESOURCE]->(lambda:AWSLambda)
+        MATCH (lambda)-[:STS_ASSUMEROLE_ALLOW]->(role:AWSRole)
+        MATCH (role)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(allow_stmt:AWSPolicyStatement {effect:"Allow"})
+        WITH a, lambda, role, allow_stmt,
+            ['iam:Create','iam:Attach','iam:Put','iam:Update','iam:Add'] AS patterns
+        // Step 1: Gather allowed actions that match IAM modification patterns
+        WITH a, lambda, role, patterns,
+            [action IN allow_stmt.action
+                WHERE ANY(p IN patterns WHERE action STARTS WITH p)
+                OR action = 'iam:*'
+                OR action = '*'
+            ] AS matched_allow_actions
+        WHERE size(matched_allow_actions) > 0
+        // Step 2: Gather all deny actions from the same role
+        OPTIONAL MATCH (role)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(deny_stmt:AWSPolicyStatement {effect:"Deny"})
+        WITH a, lambda, role, patterns, matched_allow_actions,
+            REDUCE(acc = [], ds IN collect(deny_stmt.action) | acc + ds) AS all_deny_actions
+        // Step 3: Subtract Deny actions from Allow actions
+        WITH a, lambda, role, matched_allow_actions, all_deny_actions,
+            [action IN matched_allow_actions
+                WHERE NOT (
+                    // Global wildcard deny
+                    '*' IN all_deny_actions OR
+                    // IAM wildcard deny
+                    'iam:*' IN all_deny_actions OR
+                    // Exact match deny
+                    action IN all_deny_actions OR
+                    // Prefix wildcards like Deny iam:Update*
+                    ANY(d IN all_deny_actions WHERE d ENDS WITH('*') AND action STARTS WITH split(d,'*')[0])
+                )
+            ] AS effective_actions
+        WHERE size(effective_actions) > 0
+        // Step 4: Return only Lambdas with effective IAM modification capabilities
+        UNWIND effective_actions AS action
+        WITH a, lambda, role, COLLECT(DISTINCT action) AS actions
+        RETURN DISTINCT
+            lambda.arn AS workload_id,
+            lambda.name AS workload_name,
+            a.name AS account,
+            a.id AS account_id,
+            role.name AS role_name,
+            actions,
+            lambda.anonymous_access AS internet_accessible,
+            lambda.description AS description
+        ORDER BY account, workload_id, internet_accessible
+    """,
+    cypher_visual_query="""
+        MATCH p = (a:AWSAccount)-[:RESOURCE]->(lambda:AWSLambda)
+        MATCH p1 = (lambda)-[:STS_ASSUMEROLE_ALLOW]->(role:AWSRole)
+        MATCH p2 = (role)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement)
+        WHERE stmt.effect = 'Allow'
+        AND ANY(action IN stmt.action WHERE
+            action STARTS WITH 'iam:Create'
+            OR action STARTS WITH 'iam:Attach'
+            OR action STARTS WITH 'iam:Put'
+            OR action STARTS WITH 'iam:Update'
+            OR action STARTS WITH 'iam:Add'
+            OR action = 'iam:*'
+            OR action = '*'
+        )
+        RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class WorkloadIdentityAdminCapabilities(Finding):
+    workload_name: str | None = None
+    workload_id: str | None = None
+    account: str | None = None
+    account_id: str | None = None
+    role_name: str | None = None
+    actions: list[str] | None = None
+    internet_accessible: bool | None = None
+    public_ip_address: str | None = None
+
+
+workload_identity_admin_capabilities = Rule(
+    id="workload_identity_admin_capabilities",
+    name="Workload Identity-Admin Capabilities",
+    description=(
+        "A compute workload (VM or function) holds permissions to administer identities/policies. "
+        "If internet-exposed, the blast radius is higher."
+    ),
+    output_model=WorkloadIdentityAdminCapabilities,
+    facts=(
+        _aws_service_account_manipulation_via_ec2,
+        _aws_service_account_manipulation_via_lambda,
+    ),
+    tags=("iam", "privilege_escalation"),
+    version="0.1.0",
+)

cartography/rules/formatters.py

@@ -0,0 +1,108 @@
+"""
+Output formatting utilities for Cartography rules.
+"""
+
+import json
+import re
+from dataclasses import asdict
+from dataclasses import is_dataclass
+from urllib.parse import quote
+
+from pydantic import BaseModel
+
+from cartography.rules.data.rules import RULES
+from cartography.rules.spec.result import RuleResult
+
+
+def _generate_neo4j_browser_url(neo4j_uri: str, cypher_query: str) -> str:
+    """Generate a clickable Neo4j Browser URL with pre-populated query."""
+    # Handle different Neo4j URI protocols
+    if neo4j_uri.startswith("bolt://"):
+        browser_uri = neo4j_uri.replace("bolt://", "http://", 1)
+    elif neo4j_uri.startswith("bolt+s://"):
+        browser_uri = neo4j_uri.replace("bolt+s://", "https://", 1)
+    elif neo4j_uri.startswith("bolt+ssc://"):
+        browser_uri = neo4j_uri.replace("bolt+ssc://", "https://", 1)
+    elif neo4j_uri.startswith("neo4j://"):
+        browser_uri = neo4j_uri.replace("neo4j://", "http://", 1)
+    elif neo4j_uri.startswith("neo4j+s://"):
+        browser_uri = neo4j_uri.replace("neo4j+s://", "https://", 1)
+    elif neo4j_uri.startswith("neo4j+ssc://"):
+        browser_uri = neo4j_uri.replace("neo4j+ssc://", "https://", 1)
+    else:
+        browser_uri = neo4j_uri
+
+    # Handle port mapping for local instances
+    if ":7687" in browser_uri and (
+        "localhost" in browser_uri or "127.0.0.1" in browser_uri
+    ):
+        browser_uri = browser_uri.replace(":7687", ":7474")
+
+    # For Neo4j Aura (cloud), remove the port as it uses standard HTTPS port
+    if ".databases.neo4j.io" in browser_uri:
+        # Remove any port number for Aura URLs
+        browser_uri = re.sub(r":\d+", "", browser_uri)
+
+    # Ensure the URL ends properly
+    if not browser_uri.endswith("/"):
+        browser_uri += "/"
+
+    # URL encode the cypher query
+    encoded_query = quote(cypher_query.strip())
+
+    # Construct the Neo4j Browser URL with pre-populated query
+    return f"{browser_uri}browser/?cmd=edit&arg={encoded_query}"
+
+
+def to_serializable(obj):
+    # Pydantic model (v2)
+    if isinstance(obj, BaseModel):
+        return to_serializable(obj.model_dump())
+
+    # Dataclass
+    if is_dataclass(obj):
+        return to_serializable(asdict(obj))
+
+    # Dict
+    if isinstance(obj, dict):
+        return {k: to_serializable(v) for k, v in obj.items()}
+
+    # List / Tuple / Set
+    if isinstance(obj, (list, tuple, set)):
+        return [to_serializable(v) for v in obj]
+
+    # Primitive
+    return obj
+
+
+def _format_and_output_results(
+    all_results: list[RuleResult],
+    rule_names: list[str],
+    output_format: str,
+    total_facts: int,
+    total_findings: int,
+):
+    """Format and output the results of framework execution."""
+    if output_format == "json":
+        combined_output = [asdict(result) for result in all_results]
+        print(json.dumps(to_serializable(combined_output), indent=2))
+    else:
+        # Text summary
+        print("\n" + "=" * 60)
+        if len(rule_names) == 1:
+            print(f"EXECUTION SUMMARY - {RULES[rule_names[0]].name}")
+        else:
+            print("OVERALL SUMMARY")
+        print("=" * 60)
+
+        if len(rule_names) > 1:
+            print(f"Rules executed: {len(rule_names)}")
+        print(f"Total facts: {total_facts}")
+        print(f"Total findings: {total_findings}")
+
+        if total_findings > 0:
+            print(
+                f"\n\033[36mRule execution completed with {total_findings} total findings\033[0m"
+            )
+        else:
+            print("\n\033[90mRule execution completed with no findings\033[0m")