cartography 0.109.0rc1__tar.gz → 0.110.0rc1__tar.gz

{cartography-0.109.0rc1 → cartography-0.110.0rc1}/.github/workflows/ossf-scorecard.yml

@@ -57,6 +57,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@d6bbdef45e766d081b84a2def353b0055f728d3e # v3.29.3
+        uses: github/codeql-action/upload-sarif@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
         with:
           sarif_file: results.sarif

{cartography-0.109.0rc1 → cartography-0.110.0rc1}/.github/workflows/sphinx.yml

@@ -31,7 +31,7 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install uv
-        uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
+        uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"

{cartography-0.109.0rc1 → cartography-0.110.0rc1}/.github/workflows/test_suite.yml

@@ -40,7 +40,7 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install uv
-        uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
+        uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -72,7 +72,7 @@ jobs:
         with:
           python-version: "3.10"
       - name: Install uv
-        uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
+        uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"

{cartography-0.109.0rc1 → cartography-0.110.0rc1}/AGENTS.md

@@ -27,12 +27,13 @@ This guide teaches you how to write intel modules for Cartography using the mode
 4. @Data Model: Defining Nodes and Relationships
 5. @Advanced Node Schema Properties
 6. @One-to-Many Relationships
-7. @Configuration and Credentials
-8. @Error Handling
-9. @Testing Your Module
-10. @Common Patterns and Examples
-11. @Troubleshooting Guide
-12. @Quick Reference
+7. @MatchLinks: Connecting Existing Nodes
+8. @Configuration and Credentials
+9. @Error Handling
+10. @Testing Your Module
+11. @Common Patterns and Examples
+12. @Troubleshooting Guide
+13. @Quick Reference
 
 ## 🚀 Quick Start: Copy an Existing Module {#quick-start}
 
@@ -600,6 +601,177 @@ class MyNodeSchema(CartographyNodeSchema):
 
 If you need conditional behavior, handle it in your transform function by setting field values to `None` when relationships shouldn't be created, or by filtering your data before calling `load()`.
 
+## 🔗 MatchLinks: Connecting Existing Nodes {#matchlinks}
+
+**⚠️ IMPORTANT: Use MatchLinks sparingly due to performance impact!**
+
+MatchLinks are a specialized tool for creating relationships between existing nodes in the graph. They should be used **only** in these two specific scenarios:
+
+### Scenario 1: Connecting Two Existing Node Types
+
+When you need to connect two different types of nodes that already exist in the graph, and the relationship data comes from a separate API call or data source.
+
+**Example**: AWS Identity Center role assignments connecting users to roles:
+
+```python
+# Data from a separate API call that maps users to roles
+role_assignments = [
+    {
+        "UserId": "user-123",
+        "RoleArn": "arn:aws:iam::123456789012:role/AdminRole",
+        "AccountId": "123456789012",
+    },
+    {
+        "UserId": "user-456",
+        "RoleArn": "arn:aws:iam::123456789012:role/ReadOnlyRole",
+        "AccountId": "123456789012",
+    }
+]
+
+# MatchLink schema to connect existing AWSSSOUser nodes to existing AWSRole nodes
+@dataclass(frozen=True)
+class RoleAssignmentAllowedByMatchLink(CartographyRelSchema):
+    target_node_label: str = "AWSRole"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher({
+        "arn": PropertyRef("RoleArn"),
+    })
+    source_node_label: str = "AWSSSOUser"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher({
+        "id": PropertyRef("UserId"),
+    })
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ALLOWED_BY"
+    properties: RoleAssignmentRelProperties = RoleAssignmentRelProperties()
+
+# Load the relationships
+load_matchlinks(
+    neo4j_session,
+    RoleAssignmentAllowedByMatchLink(),
+    role_assignments,
+    lastupdated=update_tag,
+    _sub_resource_label="AWSAccount",
+    _sub_resource_id=aws_account_id,
+)
+```
+
+### Scenario 2: Rich Relationship Properties
+
+When you need to store detailed metadata on relationships that doesn't make sense as separate nodes.
+
+**Example**: AWS Inspector findings connecting to packages with remediation details:
+
+```python
+# Data with rich relationship properties
+finding_to_package_data = [
+    {
+        "findingarn": "arn:aws:inspector2:us-east-1:123456789012:finding/abc123",
+        "packageid": "openssl|0:1.1.1k-1.el8.x86_64",
+        "filePath": "/usr/lib64/libssl.so.1.1",
+        "fixedInVersion": "0:1.1.1l-1.el8",
+        "remediation": "Update OpenSSL to version 1.1.1l or later",
+    }
+]
+
+# MatchLink schema with rich properties
+@dataclass(frozen=True)
+class InspectorFindingToPackageMatchLink(CartographyRelSchema):
+    target_node_label: str = "AWSInspectorPackage"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher({
+        "id": PropertyRef("packageid"),
+    })
+    source_node_label: str = "AWSInspectorFinding"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher({
+        "id": PropertyRef("findingarn"),
+    })
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "HAS_VULNERABLE_PACKAGE"
+    properties: InspectorFindingToPackageRelProperties = InspectorFindingToPackageRelProperties()
+
+@dataclass(frozen=True)
+class InspectorFindingToPackageRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef("_sub_resource_label", set_in_kwargs=True)
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+
+    # Rich relationship properties
+    filepath: PropertyRef = PropertyRef("filePath")
+    fixedinversion: PropertyRef = PropertyRef("fixedInVersion")
+    remediation: PropertyRef = PropertyRef("remediation")
+```
+
+### ⚠️ Performance Impact
+
+MatchLinks have significant performance overhead because they require:
+
+1. **API Call A** → Write Node A to graph
+2. **API Call B** → Write Node B to graph
+3. **Read Node A** from graph
+4. **Read Node B** from graph
+5. **Write relationship** between A and B to graph
+
+**Prefer standard node schemas + relationship schemas** whenever possible:
+
+```python
+# ✅ DO: Use standard node schema with relationships
+@dataclass(frozen=True)
+class YourNodeSchema(CartographyNodeSchema):
+    label: str = "YourNode"
+    properties: YourNodeProperties = YourNodeProperties()
+    sub_resource_relationship: YourNodeToTenantRel = YourNodeToTenantRel()
+    other_relationships: OtherRelationships = OtherRelationships([
+        YourNodeToOtherNodeRel(),  # Standard relationship
+    ])
+
+# ❌ DON'T: Use MatchLinks unless absolutely necessary
+# Only use when you can't define the relationship in the node schema
+```
+
+### When NOT to Use MatchLinks
+
+**❌ Don't use MatchLinks for:**
+- Standard parent-child relationships (use `other_relationships` in node schema)
+- Simple one-to-many relationships (use `one_to_many=True` in standard relationships)
+- When you can define the relationship in the node schema
+- Performance-critical scenarios
+
+**✅ Use MatchLinks only for:**
+- Connecting two existing node types from separate data sources
+- Relationships with rich metadata that doesn't belong in nodes
+
+### Required MatchLink Properties
+
+All MatchLink relationship properties must include these mandatory fields:
+
+```python
+@dataclass(frozen=True)
+class YourMatchLinkRelProperties(CartographyRelProperties):
+    # Required for all MatchLinks
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef("_sub_resource_label", set_in_kwargs=True)
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+
+    # Your custom properties here
+    custom_property: PropertyRef = PropertyRef("custom_property")
+```
+
+### MatchLink Cleanup
+
+Always implement cleanup for MatchLinks:
+
+```python
+def cleanup(neo4j_session: neo4j.Session, common_job_parameters: dict[str, Any]) -> None:
+    # Standard node cleanup
+    GraphJob.from_node_schema(YourNodeSchema(), common_job_parameters).run(neo4j_session)
+
+    # MatchLink cleanup
+    GraphJob.from_matchlink(
+        YourMatchLinkSchema(),
+        "AWSAccount",  # _sub_resource_label
+        common_job_parameters["AWS_ID"],  # _sub_resource_id
+        common_job_parameters["UPDATE_TAG"],
+    ).run(neo4j_session)
+```
+
 ## ⚙️ Configuration and Credentials {#configuration}
 
 ### Adding CLI Arguments
@@ -657,30 +829,95 @@ def start_your_service_ingestion(neo4j_session: neo4j.Session, config: Config) -
 
 ## 🚨 Error Handling {#error-handling}
 
-Follow these principles for robust error handling:
+### Core Principles
 
-### DO: Catch Specific Exceptions
-```python
-import requests
+**Fail Loudly and Early**: Cartography follows the principle of failing loudly and as early as possible. This ensures sync jobs don't continue with partial or incorrect data, which is critical because Cartography has cleanup jobs that delete nodes and relationships it believes are stale. If we don't fail early, we may delete data that we shouldn't have.
+
+**Never Bury Exceptions**: We should never preemptively catch base exceptions unless we know specifically how to handle them. This helps with traceability and debugging.
 
+### GET Functions: Keep It Simple
 
+All `get_*` functions should be "dumb" - just fetch data and let exceptions propagate naturally:
+
+```python
+@timeit
 def get_users(api_key: str) -> dict[str, Any]:
-    try:
-        response = requests.get(f"https://api.service.com/users", headers={"Authorization": f"Bearer {api_key}"})
-        response.raise_for_status()
-        return response.json()
-    except requests.exceptions.HTTPError as e:
-        if e.response.status_code == 401:
-            logger.error("Invalid API key")
-        elif e.response.status_code == 429:
-            logger.error("Rate limit exceeded")
-        raise
-    except requests.exceptions.RequestException as e:
-        logger.error(f"Network error: {e}")
-        raise
+    """
+    Fetch data from external API
+    Should be simple and let exceptions propagate naturally
+    """
+    response = requests.get(
+        "https://api.service.com/users",
+        headers={"Authorization": f"Bearer {api_key}"},
+        timeout=(60, 60),
+    )
+    response.raise_for_status()  # Let HTTP errors propagate
+    return response.json()
 ```
 
-### DON'T: Catch Base Exception
+**Key Principles for `get()` Functions:**
+
+1. **No Preemptive Exception Handling**: Avoid adding try/except blocks in `get()` functions unless you know the specific ways the code can fail and how to handle them.
+   ```python
+   # ❌ DON'T: Preemptively add complex error handling in get()
+   def get_users(api_key: str) -> dict[str, Any]:
+       try:
+           response = requests.get(...)
+           response.raise_for_status()
+           return response.json()
+       except requests.exceptions.HTTPError as e:
+           if e.response.status_code == 401:
+               logger.error("Invalid API key")
+           elif e.response.status_code == 429:
+               logger.error("Rate limit exceeded")
+           raise
+       except requests.exceptions.RequestException as e:
+           logger.error(f"Network error: {e}")
+           raise
+
+   # ✅ DO: Code for the happy path. Keep it simple and let errors propagate.
+   def get_users(api_key: str) -> dict[str, Any]:
+       response = requests.get(...)
+       response.raise_for_status()
+       return response.json()
+   ```
+
+2. **Use Decorators for Common Patterns**: For AWS modules, use `@aws_handle_regions` to handle common AWS errors:
+   ```python
+   @timeit
+   @aws_handle_regions  # Handles region availability, throttling, etc.
+   def get_ec2_instances(boto3_session: boto3.session.Session, region: str) -> list[dict[str, Any]]:
+       client = boto3_session.client("ec2", region_name=region)
+       return client.describe_instances()["Reservations"]
+   ```
+
+3. **Fail Loudly**: If an error occurs, let it propagate up to the caller. This helps users identify and fix issues quickly:
+   ```python
+   # ❌ DON'T: Silently continue on error
+   def get_data() -> dict[str, Any]:
+       try:
+           return api.get_data()
+       except Exception:
+           return {}  # Silently continue with empty data
+
+   # ✅ DO: Let errors propagate
+   def get_data() -> dict[str, Any]:
+       return api.get_data()  # Let errors propagate to caller
+   ```
+
+4. **Timeout Configuration**: Set appropriate timeouts to avoid hanging:
+   ```python
+   # ✅ DO: Set timeouts
+   response = session.post(
+       "https://api.service.com/users",
+       json=payload,
+       timeout=(60, 60),  # (connect_timeout, read_timeout)
+   )
+   ```
+
+### Exception Handling Guidelines
+
+**DON'T: Catch Base Exception**
 ```python
 # ❌ Don't do this - makes debugging impossible
 try:
@@ -690,6 +927,32 @@ except Exception:
     pass  # Silently continue - BAD!
 ```
 
+**DON'T: Prematurely Optimize Error Handling**
+```python
+# ❌ Don't add complex error handling unless you know the specific failure modes
+def get_data() -> dict[str, Any]:
+    try:
+        # Complex error handling for unknown failure modes
+        response = api.get_data()
+        if response.status_code == 200:
+            return response.json()
+        elif response.status_code == 401:
+            # Handle auth error
+            pass
+        elif response.status_code == 429:
+            # Handle rate limiting
+            pass
+        # ... more unknown error cases
+    except Exception as e:
+        # Generic exception handling
+        logger.error(f"Unknown error: {e}")
+        raise
+```
+
+### Best-Effort Mode
+
+Some modules support best-effort mode via flags like `--aws-best-effort-mode` and `--entra-best-effort-mode`. These modes allow the user to override and continue running even if exceptions are encountered. This works well together with Cartography's main error handling principle: fail loudly and early, so you should not feel bad about not handling all possible exceptions.
+
 ### Required vs Optional Field Access
 
 ```python
@@ -1176,11 +1439,12 @@ from cartography.models.core.common import PropertyRef
 from cartography.models.core.nodes import CartographyNodeProperties, CartographyNodeSchema
 from cartography.models.core.relationships import (
     CartographyRelProperties, CartographyRelSchema, LinkDirection,
-    make_target_node_matcher, TargetNodeMatcher, OtherRelationships
+    make_target_node_matcher, TargetNodeMatcher, OtherRelationships,
+    make_source_node_matcher, SourceNodeMatcher  # For MatchLinks
 )
 
 # Loading and cleanup
-from cartography.client.core.tx import load
+from cartography.client.core.tx import load, load_matchlinks  # load_matchlinks for MatchLinks
 from cartography.graph.job import GraphJob
 
 # Utilities
@@ -1243,6 +1507,50 @@ target_node_matcher: TargetNodeMatcher = make_target_node_matcher({
 })
 ```
 
+### MatchLink Pattern (Use Sparingly!)
+```python
+# Only use for connecting existing nodes or rich relationship properties
+@dataclass(frozen=True)
+class YourMatchLinkSchema(CartographyRelSchema):
+    target_node_label: str = "TargetNode"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher({
+        "id": PropertyRef("target_id"),
+    })
+    source_node_label: str = "SourceNode"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher({
+        "id": PropertyRef("source_id"),
+    })
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "CONNECTS_TO"
+    properties: YourMatchLinkRelProperties = YourMatchLinkRelProperties()
+
+# Required properties for MatchLinks
+@dataclass(frozen=True)
+class YourMatchLinkRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+    _sub_resource_label: PropertyRef = PropertyRef("_sub_resource_label", set_in_kwargs=True)
+    _sub_resource_id: PropertyRef = PropertyRef("_sub_resource_id", set_in_kwargs=True)
+    # Your custom properties here
+
+# Load MatchLinks
+load_matchlinks(
+    neo4j_session,
+    YourMatchLinkSchema(),
+    mapping_data,
+    lastupdated=update_tag,
+    _sub_resource_label="AWSAccount",
+    _sub_resource_id=account_id,
+)
+
+# Cleanup MatchLinks
+GraphJob.from_matchlink(
+    YourMatchLinkSchema(),
+    "AWSAccount",
+    account_id,
+    update_tag,
+).run(neo4j_session)
+```
+
 ### Configuration Validation Template
 ```python
 def start_ingestion(neo4j_session: neo4j.Session, config: Config) -> None:

{cartography-0.109.0rc1 → cartography-0.110.0rc1}/Dockerfile

@@ -1,5 +1,5 @@
 # Base image
-FROM python:3.10-slim@sha256:9dd6774a1276178f94b0cc1fb1f0edd980825d0ea7634847af9940b1b6273c13 AS base
+FROM python:3.10-slim@sha256:81f1cdb3770d54ecfdbddcc52c2125fce674c14a1d976dfd8f65dc0734f9c3c5 AS base
 # Default to ''. Overridden with a specific version specifier e.g. '==0.98.0' by build args or from GitHub actions.
 ARG VERSION_SPECIFIER
 # the UID and GID to run cartography as

{cartography-0.109.0rc1 → cartography-0.110.0rc1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cartography
-Version: 0.109.0rc1
+Version: 0.110.0rc1
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2
@@ -82,7 +82,7 @@ You can learn more about the story behind Cartography in our [presentation at BS
 
 ## Supported platforms
 - [Airbyte](https://cartography-cncf.github.io/cartography/modules/airbyte/index.html) - Organization, Workspace, User, Source, Destination, Connection, Tag, Stream
-- [Amazon Web Services](https://cartography-cncf.github.io/cartography/modules/aws/index.html) - ACM, API Gateway, CloudWatch, CodeBuild, Config, EC2, ECS, ECR, Elasticsearch, Elastic Kubernetes Service (EKS), DynamoDB, GuardDuty, IAM, Inspector, KMS, Lambda, RDS, Redshift, Route53, S3, Secrets Manager(Secret Versions), Security Hub, SQS, SSM, STS, Tags
+- [Amazon Web Services](https://cartography-cncf.github.io/cartography/modules/aws/index.html) - ACM, API Gateway, CloudWatch, CodeBuild, Config, EC2, ECS, ECR, EFS, Elasticsearch, Elastic Kubernetes Service (EKS), DynamoDB, Glue, GuardDuty, IAM, Inspector, KMS, Lambda, RDS, Redshift, Route53, S3, Secrets Manager(Secret Versions), Security Hub, SNS, SQS, SSM, STS, Tags
 - [Anthropic](https://cartography-cncf.github.io/cartography/modules/anthropic/index.html) - Organization, ApiKey, User, Workspace
 - [BigFix](https://cartography-cncf.github.io/cartography/modules/bigfix/index.html) - Computers
 - [Cloudflare](https://cartography-cncf.github.io/cartography/modules/cloudflare/index.html) - Account, Role, Member, Zone, DNSRecord

{cartography-0.109.0rc1 → cartography-0.110.0rc1}/README.md

@@ -22,7 +22,7 @@ You can learn more about the story behind Cartography in our [presentation at BS
 
 ## Supported platforms
 - [Airbyte](https://cartography-cncf.github.io/cartography/modules/airbyte/index.html) - Organization, Workspace, User, Source, Destination, Connection, Tag, Stream
-- [Amazon Web Services](https://cartography-cncf.github.io/cartography/modules/aws/index.html) - ACM, API Gateway, CloudWatch, CodeBuild, Config, EC2, ECS, ECR, Elasticsearch, Elastic Kubernetes Service (EKS), DynamoDB, GuardDuty, IAM, Inspector, KMS, Lambda, RDS, Redshift, Route53, S3, Secrets Manager(Secret Versions), Security Hub, SQS, SSM, STS, Tags
+- [Amazon Web Services](https://cartography-cncf.github.io/cartography/modules/aws/index.html) - ACM, API Gateway, CloudWatch, CodeBuild, Config, EC2, ECS, ECR, EFS, Elasticsearch, Elastic Kubernetes Service (EKS), DynamoDB, Glue, GuardDuty, IAM, Inspector, KMS, Lambda, RDS, Redshift, Route53, S3, Secrets Manager(Secret Versions), Security Hub, SNS, SQS, SSM, STS, Tags
 - [Anthropic](https://cartography-cncf.github.io/cartography/modules/anthropic/index.html) - Organization, ApiKey, User, Workspace
 - [BigFix](https://cartography-cncf.github.io/cartography/modules/bigfix/index.html) - Computers
 - [Cloudflare](https://cartography-cncf.github.io/cartography/modules/cloudflare/index.html) - Account, Role, Member, Zone, DNSRecord

{cartography-0.109.0rc1 → cartography-0.110.0rc1}/cartography/_version.py

@@ -17,5 +17,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '0.109.0rc1'
-__version_tuple__ = version_tuple = (0, 109, 0, 'rc1')
+__version__ = version = '0.110.0rc1'
+__version_tuple__ = version_tuple = (0, 110, 0, 'rc1')

{cartography-0.109.0rc1 → cartography-0.110.0rc1}/cartography/cli.py

@@ -254,6 +254,14 @@ class CLI:
                 "The name of environment variable containing Entra Client Secret for Service Principal Authentication."
             ),
         )
+        parser.add_argument(
+            "--entra-best-effort-mode",
+            action="store_true",
+            help=(
+                "Enable Entra ID sync best effort mode. This will allow cartography to continue "
+                "syncing other Entra ID entities and delay raising an exception until the end of the sync."
+            ),
+        )
         parser.add_argument(
             "--aws-requested-syncs",
             type=str,
@@ -700,6 +708,15 @@ class CLI:
                 "Required if you are using the Trivy module. Ignored otherwise."
             ),
         )
+        parser.add_argument(
+            "--trivy-results-dir",
+            type=str,
+            default=None,
+            help=(
+                "Path to a directory containing Trivy JSON results on disk. "
+                "Required if you are using the Trivy module with local results."
+            ),
+        )
         parser.add_argument(
             "--scaleway-org",
             type=str,
@@ -1089,6 +1106,9 @@ class CLI:
         if config.trivy_s3_prefix:
             logger.debug(f"Trivy S3 prefix: {config.trivy_s3_prefix}")
 
+        if config.trivy_results_dir:
+            logger.debug(f"Trivy results dir: {config.trivy_results_dir}")
+
         # Scaleway config
         if config.scaleway_secret_key_env_var:
             logger.debug(
@@ -1118,6 +1138,8 @@ class CLI:
             config.sentinelone_api_token = os.environ.get(
                 config.sentinelone_api_token_env_var
             )
+        else:
+            config.sentinelone_api_token = None
 
         # Run cartography
         try:

{cartography-0.109.0rc1 → cartography-0.110.0rc1}/cartography/config.py

@@ -51,6 +51,9 @@ class Config:
     :param entra_client_id: Client Id for connecting in a Service Principal Authentication approach. Optional.
     :type entra_client_secret: str
     :param entra_client_secret: Client Secret for connecting in a Service Principal Authentication approach. Optional.
+    :type entra_best_effort_mode: bool
+    :param entra_best_effort_mode: If True, Entra ID sync will continue on errors and raise an aggregated
+        exception at the end of the sync. If False (default), exceptions will be raised immediately.
     :type aws_requested_syncs: str
     :param aws_requested_syncs: Comma-separated list of AWS resources to sync. Optional.
     :type aws_guardduty_severity_threshold: str
@@ -152,6 +155,8 @@ class Config:
     :param trivy_s3_bucket: The S3 bucket name containing Trivy scan results. Optional.
     :type trivy_s3_prefix: str
     :param trivy_s3_prefix: The S3 prefix path containing Trivy scan results. Optional.
+    :type trivy_results_dir: str
+    :param trivy_results_dir: Local directory containing Trivy scan results. Optional.
     :type scaleway_access_key: str
     :param scaleway_access_key: Scaleway access key. Optional.
     :type scaleway_secret_key: str
@@ -162,6 +167,8 @@ class Config:
     :param sentinelone_api_url: SentinelOne API URL. Optional.
     :type sentinelone_api_token: string
     :param sentinelone_api_token: SentinelOne API token for authentication. Optional.
+    :type sentinelone_api_token_env_var: string
+    :param sentinelone_api_token_env_var: The name of an environment variable containing the SentinelOne API token. Optional.
     :type sentinelone_account_ids: list[str]
     :param sentinelone_account_ids: List of SentinelOne account IDs to sync. Optional.
     """
@@ -187,6 +194,7 @@ class Config:
         entra_tenant_id=None,
         entra_client_id=None,
         entra_client_secret=None,
+        entra_best_effort_mode=False,
         aws_requested_syncs=None,
         aws_guardduty_severity_threshold=None,
         analysis_job_directory=None,
@@ -243,11 +251,13 @@ class Config:
         airbyte_api_url=None,
         trivy_s3_bucket=None,
         trivy_s3_prefix=None,
+        trivy_results_dir=None,
         scaleway_access_key=None,
         scaleway_secret_key=None,
         scaleway_org=None,
         sentinelone_api_url=None,
         sentinelone_api_token=None,
+        sentinelone_api_token_env_var=None,
         sentinelone_account_ids=None,
     ):
         self.neo4j_uri = neo4j_uri
@@ -271,6 +281,7 @@ class Config:
         self.entra_tenant_id = entra_tenant_id
         self.entra_client_id = entra_client_id
         self.entra_client_secret = entra_client_secret
+        self.entra_best_effort_mode = entra_best_effort_mode
         self.aws_requested_syncs = aws_requested_syncs
         self.aws_guardduty_severity_threshold = aws_guardduty_severity_threshold
         self.analysis_job_directory = analysis_job_directory
@@ -327,9 +338,11 @@ class Config:
         self.airbyte_api_url = airbyte_api_url
         self.trivy_s3_bucket = trivy_s3_bucket
         self.trivy_s3_prefix = trivy_s3_prefix
+        self.trivy_results_dir = trivy_results_dir
         self.scaleway_access_key = scaleway_access_key
         self.scaleway_secret_key = scaleway_secret_key
         self.scaleway_org = scaleway_org
         self.sentinelone_api_url = sentinelone_api_url
         self.sentinelone_api_token = sentinelone_api_token
+        self.sentinelone_api_token_env_var = sentinelone_api_token_env_var
         self.sentinelone_account_ids = sentinelone_account_ids

{cartography-0.109.0rc1 → cartography-0.110.0rc1}/cartography/data/indexes.cypher

@@ -29,14 +29,6 @@ CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv4CidrBlock) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv4CidrBlock) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv6CidrBlock) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv6CidrBlock) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambda) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambda) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaEventSourceMapping) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaEventSourceMapping) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaFunctionAlias) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaFunctionAlias) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaLayer) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSLambdaLayer) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSPeeringConnection) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSPeeringConnection) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicy) ON (n.id);
@@ -158,13 +150,6 @@ CREATE INDEX IF NOT EXISTS FOR (n:IpRange) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:IpRange) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:JamfComputerGroup) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:JamfComputerGroup) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSKey) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSKey) ON (n.arn);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSKey) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSAlias) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSAlias) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSGrant) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:KMSGrant) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:LaunchConfiguration) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:LaunchConfiguration) ON (n.name);
 CREATE INDEX IF NOT EXISTS FOR (n:LaunchConfiguration) ON (n.lastupdated);