cartography 0.113.0__py3-none-any.whl → 0.115.0__py3-none-any.whl

cartography/_version.py

@@ -28,7 +28,7 @@ version_tuple: VERSION_TUPLE
 commit_id: COMMIT_ID
 __commit_id__: COMMIT_ID
 
-__version__ = version = '0.113.0'
-__version_tuple__ = version_tuple = (0, 113, 0)
+__version__ = version = '0.115.0'
+__version_tuple__ = version_tuple = (0, 115, 0)
 
 __commit_id__ = commit_id = None

cartography/cli.py

@@ -328,6 +328,14 @@ class CLI:
                 "Required if you are using the GitHub intel module. Ignored otherwise."
             ),
         )
+        parser.add_argument(
+            "--github-commit-lookback-days",
+            type=int,
+            default=30,
+            help=(
+                "Number of days to look back for tracking GitHub users committing to repositories. Defaults to 30 days."
+            ),
+        )
         parser.add_argument(
             "--digitalocean-token-env-var",
             type=str,
@@ -959,8 +967,8 @@ class CLI:
                 logger.warning("A Kandji base URI was provided but a token was not.")
                 config.kandji_token = None
         else:
-            logger.warning("A Kandji base URI was not provided.")
             config.kandji_base_uri = None
+            config.kandji_token = None
 
         if config.statsd_enabled:
             logger.debug(
@@ -1088,8 +1096,8 @@ class CLI:
                 logger.warning("A SnipeIT base URI was provided but a token was not.")
                 config.snipeit_token = None
         else:
-            logger.warning("A SnipeIT base URI was not provided.")
             config.snipeit_base_uri = None
+            config.snipeit_token = None
 
         # Tailscale config
         if config.tailscale_token_env_var:

cartography/client/core/tx.py

@@ -19,6 +19,17 @@ from cartography.util import batch
 logger = logging.getLogger(__name__)
 
 
+def run_write_query(
+    neo4j_session: neo4j.Session, query: str, **parameters: Any
+) -> None:
+    """Execute a write query inside a managed transaction."""
+
+    def _run_query_tx(tx: neo4j.Transaction) -> None:
+        tx.run(query, **parameters).consume()
+
+    neo4j_session.execute_write(_run_query_tx)
+
+
 def read_list_of_values_tx(
     tx: neo4j.Transaction,
     query: str,

cartography/config.py

@@ -70,6 +70,8 @@ class Config:
     :param okta_saml_role_regex: The regex used to map okta groups to AWS roles. Optional.
     :type github_config: str
     :param github_config: Base64 encoded config object for GitHub ingestion. Optional.
+    :type github_commit_lookback_days: int
+    :param github_commit_lookback_days: Number of days to look back for GitHub commit tracking. Optional.
     :type digitalocean_token: str
     :param digitalocean_token: DigitalOcean access token. Optional.
     :type permission_relationships_file: str
@@ -210,6 +212,7 @@ class Config:
         okta_api_key=None,
         okta_saml_role_regex=None,
         github_config=None,
+        github_commit_lookback_days=30,
         digitalocean_token=None,
         permission_relationships_file=None,
         jamf_base_uri=None,
@@ -301,6 +304,7 @@ class Config:
         self.okta_api_key = okta_api_key
         self.okta_saml_role_regex = okta_saml_role_regex
         self.github_config = github_config
+        self.github_commit_lookback_days = github_commit_lookback_days
         self.digitalocean_token = digitalocean_token
         self.permission_relationships_file = permission_relationships_file
         self.jamf_base_uri = jamf_base_uri

cartography/data/indexes.cypher

@@ -21,23 +21,12 @@ CREATE INDEX IF NOT EXISTS FOR (n:AWSDNSRecord) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSDNSZone) ON (n.name);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSDNSZone) ON (n.zoneid);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSDNSZone) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSGroup) ON (n.arn);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSGroup) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSInternetGateway) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSInternetGateway) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv4CidrBlock) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv4CidrBlock) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv6CidrBlock) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSIpv6CidrBlock) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicy) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicy) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicy) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicyStatement) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPolicyStatement) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPrincipal) ON (n.arn);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSPrincipal) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSRole) ON (n.arn);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSRole) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTag) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTag) ON (n.key);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTag) ON (n.lastupdated);
@@ -46,11 +35,6 @@ CREATE INDEX IF NOT EXISTS FOR (n:AWSTransitGateway) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTransitGateway) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTransitGatewayAttachment) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:AWSTransitGatewayAttachment) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSUser) ON (n.arn);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSUser) ON (n.name);
-CREATE INDEX IF NOT EXISTS FOR (n:AWSUser) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:AccountAccessKey) ON (n.accesskeyid);
-CREATE INDEX IF NOT EXISTS FOR (n:AccountAccessKey) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:AutoScalingGroup) ON (n.arn);
 CREATE INDEX IF NOT EXISTS FOR (n:AutoScalingGroup) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:CVE) ON (n.id);
@@ -100,8 +84,6 @@ CREATE INDEX IF NOT EXISTS FOR (n:ESDomain) ON (n.arn);
 CREATE INDEX IF NOT EXISTS FOR (n:ESDomain) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:ESDomain) ON (n.name);
 CREATE INDEX IF NOT EXISTS FOR (n:ESDomain) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPFolder) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPFolder) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPForwardingRule) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPForwardingRule) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPInstance) ON (n.id);
@@ -112,23 +94,14 @@ CREATE INDEX IF NOT EXISTS FOR (n:GCPNetworkTag) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPNetworkTag) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPNicAccessConfig) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPNicAccessConfig) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPOrganization) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPOrganization) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPProject) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPProject) ON (n.projectnumber);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPProject) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPBucket) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPBucket) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPBucketLabel) ON (n.key);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPBucketLabel) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPSubnet) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GCPSubnet) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPVpc) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GCPVpc) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GitHubRepository) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GitHubRepository) ON (n.lastupdated);
-CREATE INDEX IF NOT EXISTS FOR (n:GKECluster) ON (n.id);
-CREATE INDEX IF NOT EXISTS FOR (n:GKECluster) ON (n.lastupdated);
 CREATE INDEX IF NOT EXISTS FOR (n:GSuiteGroup) ON (n.email);
 CREATE INDEX IF NOT EXISTS FOR (n:GSuiteGroup) ON (n.id);
 CREATE INDEX IF NOT EXISTS FOR (n:GSuiteGroup) ON (n.lastupdated);

cartography/intel/aws/config.py

@@ -5,6 +5,7 @@ from typing import List
 import boto3
 import neo4j
 
+from cartography.client.core.tx import run_write_query
 from cartography.util import aws_handle_regions
 from cartography.util import run_cleanup_job
 from cartography.util import timeit
@@ -80,7 +81,8 @@ def load_configuration_recorders(
     for recorder in data:
         recorder["_id"] = f'{recorder["name"]}:{current_aws_account_id}:{region}'
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_configuration_recorders,
         Recorders=data,
         Region=region,
@@ -120,7 +122,8 @@ def load_delivery_channels(
     for channel in data:
         channel["_id"] = f'{channel["name"]}:{current_aws_account_id}:{region}'
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_delivery_channels,
         Channels=data,
         Region=region,
@@ -167,7 +170,8 @@ def load_config_rules(
             for detail in rule["Source"]["SourceDetails"]:
                 details.append(f"{detail}")
         rule["_source_details"] = details
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_config_rules,
         Rules=data,
         Region=region,

cartography/intel/aws/ecr.py

@@ -57,15 +57,15 @@ def get_ecr_repository_images(
         )
         for response in describe_response:
             image_details = response["imageDetails"]
-            image_details = [
-                (
-                    {**detail, "imageTag": detail["imageTags"][0]}
-                    if detail.get("imageTags")
-                    else detail
-                )
-                for detail in image_details
-            ]
-            ecr_repository_images.extend(image_details)
+            for detail in image_details:
+                tags = detail.get("imageTags") or []
+                if tags:
+                    for tag in tags:
+                        image_detail = {**detail, "imageTag": tag}
+                        image_detail.pop("imageTags", None)
+                        ecr_repository_images.append(image_detail)
+                else:
+                    ecr_repository_images.append({**detail})
     return ecr_repository_images