cartography 0.114.0__py3-none-any.whl → 0.115.0__py3-none-any.whl

cartography/intel/aws/route53.py

@@ -24,6 +24,7 @@ DnsData = namedtuple(
     [
         "zones",
         "a_records",
+        "aaaa_records",
         "alias_records",
         "cname_records",
         "ns_records",
@@ -73,7 +74,7 @@ def get_zones(
 def transform_record_set(
     record_set: dict[str, Any], zone_id: str, name: str
 ) -> dict[str, Any] | None:
-    # process CNAME, ALIAS and A records
+    # process CNAME, ALIAS, A, and AAAA records
     if record_set["Type"] == "CNAME":
         if "AliasTarget" in record_set:
             # this is a weighted CNAME record
@@ -127,6 +128,31 @@ def transform_record_set(
                 "value": value,
                 "id": _create_dns_record_id(zone_id, name, "A"),
             }
+    elif record_set["Type"] == "AAAA":
+        if "AliasTarget" in record_set:
+            # AAAA alias records follow the same pattern as A aliases but map to IPv6 targets
+            value = record_set["AliasTarget"]["DNSName"]
+            if value.endswith("."):
+                value = value[:-1]
+            return {
+                "name": name,
+                "type": "ALIAS",
+                "zoneid": zone_id,
+                "value": value,
+                "id": _create_dns_record_id(zone_id, name, "ALIAS_AAAA"),
+            }
+        else:
+            ip_addresses = [record["Value"] for record in record_set["ResourceRecords"]]
+            value = ",".join(ip_addresses)
+
+            return {
+                "name": name,
+                "type": "AAAA",
+                "zoneid": zone_id,
+                "ip_addresses": ip_addresses,
+                "value": value,
+                "id": _create_dns_record_id(zone_id, name, "AAAA"),
+            }
     # This should never happen since we only call this for A and CNAME records,
     # but we'll log it and return None.
     logger.warning(f"Unsupported record type: {record_set['Type']}")
@@ -179,10 +205,11 @@ def transform_all_dns_data(
 ) -> DnsData:
     """
     Transform all DNS data into flat lists for loading.
-    Returns: (zones, a_records, alias_records, cname_records, ns_records)
+    Returns: (zones, a_records, aaaa_records, alias_records, cname_records, ns_records)
     """
     transformed_zones = []
     all_a_records = []
+    all_aaaa_records = []
     all_alias_records = []
     all_cname_records = []
     all_ns_records = []
@@ -196,7 +223,7 @@ def transform_all_dns_data(
         zone_name = parsed_zone["name"]
 
         for rs in zone_record_sets:
-            if rs["Type"] == "A" or rs["Type"] == "CNAME":
+            if rs["Type"] in {"A", "AAAA", "CNAME"}:
                 transformed_rs = transform_record_set(
                     rs,
                     zone_id,
@@ -209,6 +236,8 @@ def transform_all_dns_data(
                     all_a_records.append(transformed_rs)
                     # TODO consider creating IPs as a first-class node from here.
                     # Right now we just match on them from the A record.
+                elif transformed_rs["type"] == "AAAA":
+                    all_aaaa_records.append(transformed_rs)
                 elif transformed_rs["type"] == "ALIAS":
                     all_alias_records.append(transformed_rs)
                 elif transformed_rs["type"] == "CNAME":
@@ -232,6 +261,7 @@ def transform_all_dns_data(
     return DnsData(
         zones=transformed_zones,
         a_records=all_a_records,
+        aaaa_records=all_aaaa_records,
         alias_records=all_alias_records,
         cname_records=all_cname_records,
         ns_records=all_ns_records,
@@ -244,6 +274,7 @@ def _load_dns_details_flat(
     neo4j_session: neo4j.Session,
     zones: list[dict[str, Any]],
     a_records: list[dict[str, Any]],
+    aaaa_records: list[dict[str, Any]],
     alias_records: list[dict[str, Any]],
     cname_records: list[dict[str, Any]],
     ns_records: list[dict[str, Any]],
@@ -253,6 +284,7 @@ def _load_dns_details_flat(
 ) -> None:
     load_zones(neo4j_session, zones, current_aws_id, update_tag)
     load_a_records(neo4j_session, a_records, update_tag, current_aws_id)
+    load_aaaa_records(neo4j_session, aaaa_records, update_tag, current_aws_id)
     load_alias_records(neo4j_session, alias_records, update_tag, current_aws_id)
     load_cname_records(neo4j_session, cname_records, update_tag, current_aws_id)
     load_name_servers(neo4j_session, name_servers, update_tag, current_aws_id)
@@ -274,6 +306,7 @@ def load_dns_details(
         neo4j_session,
         transformed_data.zones,
         transformed_data.a_records,
+        transformed_data.aaaa_records,
         transformed_data.alias_records,
         transformed_data.cname_records,
         transformed_data.ns_records,
@@ -299,6 +332,22 @@ def load_a_records(
     )
 
 
+@timeit
+def load_aaaa_records(
+    neo4j_session: neo4j.Session,
+    records: list[dict[str, Any]],
+    update_tag: int,
+    current_aws_id: str,
+) -> None:
+    load(
+        neo4j_session,
+        AWSDNSRecordSchema(),
+        records,
+        lastupdated=update_tag,
+        AWS_ID=current_aws_id,
+    )
+
+
 @timeit
 def load_alias_records(
     neo4j_session: neo4j.Session,
@@ -468,6 +517,7 @@ def sync(
         neo4j_session,
         transformed_data.zones,
         transformed_data.a_records,
+        transformed_data.aaaa_records,
         transformed_data.alias_records,
         transformed_data.cname_records,
         transformed_data.ns_records,

cartography/intel/aws/securityhub.py

@@ -6,6 +6,7 @@ import boto3
 import neo4j
 from dateutil import parser
 
+from cartography.client.core.tx import run_write_query
 from cartography.util import run_cleanup_job
 from cartography.util import timeit
 
@@ -50,7 +51,8 @@ def load_hub(
     ON CREATE SET r.firstseen = timestamp()
     SET r.lastupdated = $aws_update_tag
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_hub,
         Hub=data,
         AWS_ACCOUNT_ID=current_aws_account_id,

cartography/intel/azure/__init__.py

@@ -11,6 +11,7 @@ from . import app_service
 from . import compute
 from . import cosmosdb
 from . import functions
+from . import logic_apps
 from . import sql
 from . import storage
 from . import subscription
@@ -56,6 +57,13 @@ def _sync_one_subscription(
         update_tag,
         common_job_parameters,
     )
+    logic_apps.sync(
+        neo4j_session,
+        credentials,
+        subscription_id,
+        update_tag,
+        common_job_parameters,
+    )
     sql.sync(
         neo4j_session,
         credentials.credential,

cartography/intel/azure/logic_apps.py

@@ -0,0 +1,101 @@
+import logging
+from typing import Any
+
+import neo4j
+from azure.core.exceptions import ClientAuthenticationError
+from azure.core.exceptions import HttpResponseError
+from azure.mgmt.logic import LogicManagementClient
+
+from cartography.client.core.tx import load
+from cartography.graph.job import GraphJob
+from cartography.models.azure.logic_apps import AzureLogicAppSchema
+from cartography.util import timeit
+
+from .util.credentials import Credentials
+
+logger = logging.getLogger(__name__)
+
+
+@timeit
+def get_logic_apps(credentials: Credentials, subscription_id: str) -> list[dict]:
+    """
+    Get a list of Logic Apps from the given Azure subscription.
+    """
+    try:
+        client = LogicManagementClient(credentials.credential, subscription_id)
+        # NOTE: The resource for a Logic App is called a "Workflow" in the SDK.
+        return [w.as_dict() for w in client.workflows.list_by_subscription()]
+    except (ClientAuthenticationError, HttpResponseError) as e:
+        logger.warning(
+            f"Failed to get logic apps for subscription {subscription_id}: {str(e)}"
+        )
+        return []
+
+
+def transform_logic_apps(logic_apps_response: list[dict]) -> list[dict]:
+    """
+    Transform the raw API response to the dictionary structure that the model expects.
+    """
+    transformed_apps: list[dict[str, Any]] = []
+    for app in logic_apps_response:
+        transformed_app = {
+            "id": app.get("id"),
+            "name": app.get("name"),
+            "location": app.get("location"),
+            "state": app.get("properties", {}).get("state"),
+            "created_time": app.get("properties", {}).get("created_time"),
+            "changed_time": app.get("properties", {}).get("changed_time"),
+            "version": app.get("properties", {}).get("version"),
+            "access_endpoint": app.get("properties", {}).get("access_endpoint"),
+        }
+        transformed_apps.append(transformed_app)
+    return transformed_apps
+
+
+@timeit
+def load_logic_apps(
+    neo4j_session: neo4j.Session,
+    data: list[dict[str, Any]],
+    subscription_id: str,
+    update_tag: int,
+) -> None:
+    """
+    Load the transformed Azure Logic App data to Neo4j.
+    """
+    load(
+        neo4j_session,
+        AzureLogicAppSchema(),
+        data,
+        lastupdated=update_tag,
+        AZURE_SUBSCRIPTION_ID=subscription_id,
+    )
+
+
+@timeit
+def cleanup_logic_apps(
+    neo4j_session: neo4j.Session, common_job_parameters: dict
+) -> None:
+    """
+    Run the cleanup job for Azure Logic Apps.
+    """
+    GraphJob.from_node_schema(AzureLogicAppSchema(), common_job_parameters).run(
+        neo4j_session
+    )
+
+
+@timeit
+def sync(
+    neo4j_session: neo4j.Session,
+    credentials: Credentials,
+    subscription_id: str,
+    update_tag: int,
+    common_job_parameters: dict,
+) -> None:
+    """
+    The main sync function for Azure Logic Apps.
+    """
+    logger.info(f"Syncing Azure Logic Apps for subscription {subscription_id}.")
+    raw_apps = get_logic_apps(credentials, subscription_id)
+    transformed_apps = transform_logic_apps(raw_apps)
+    load_logic_apps(neo4j_session, transformed_apps, subscription_id, update_tag)
+    cleanup_logic_apps(neo4j_session, common_job_parameters)

cartography/intel/create_indexes.py

@@ -3,6 +3,7 @@ from typing import List
 
 import neo4j
 
+from cartography.client.core.tx import run_write_query
 from cartography.config import Config
 from cartography.util import load_resource_binary
 
@@ -23,4 +24,4 @@ def run(neo4j_session: neo4j.Session, config: Config) -> None:
     logger.info("Creating indexes for cartography node types.")
     for statement in get_index_statements():
         logger.debug("Executing statement: %s", statement)
-        neo4j_session.run(statement)
+        run_write_query(neo4j_session, statement)

cartography/intel/dns.py

@@ -8,6 +8,7 @@ import dns.rdatatype
 import dns.resolver
 import neo4j
 
+from cartography.client.core.tx import run_write_query
 from cartography.util import timeit
 
 logger = logging.getLogger(__name__)
@@ -104,7 +105,8 @@ def _link_ip_to_A_record(
     SET r.lastupdated = $update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest,
         ParentId=parent_record,
         IP_LIST=ip_list,
@@ -151,7 +153,8 @@ def ingest_dns_record(
 
     record_id = f"{name}+{type}"
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         template.safe_substitute(
             record_label=record_label,
             dns_node_additional_label=dns_node_additional_label,

cartography/intel/gcp/dns.py

@@ -116,7 +116,8 @@ def transform_dns_rrs(dns_rrs: List[Dict]) -> List[Dict]:
     for r in dns_rrs:
         records.append(
             {
-                "id": r["name"],
+                # Compose a unique ID to avoid collisions across types and zones
+                "id": f"{r['name']}|{r.get('type')}|{r.get('zone')}",
                 "name": r["name"],
                 "type": r.get("type"),
                 "ttl": r.get("ttl"),

cartography/intel/github/repos.py

@@ -159,8 +159,6 @@ def _get_repo_collaborators_inner_func(
     token: str,
     repo_raw_data: list[dict[str, Any]],
     affiliation: str,
-    collab_users: list[dict[str, Any]],
-    collab_permission: list[str],
 ) -> dict[str, list[UserAffiliationAndRepoPermission]]:
     result: dict[str, list[UserAffiliationAndRepoPermission]] = {}
 
@@ -194,6 +192,9 @@ def _get_repo_collaborators_inner_func(
             affiliation,
         )
 
+        collab_users: List[dict[str, Any]] = []
+        collab_permission: List[str] = []
+
         # nodes and edges are expected to always be present given that we only call for them if totalCount is > 0
         # however sometimes GitHub returns None, as in issue 1334 and 1404.
         for collab in collaborators.nodes or []:
@@ -230,8 +231,6 @@ def _get_repo_collaborators_for_multiple_repos(
     logger.info(
         f'Retrieving repo collaborators for affiliation "{affiliation}" on org "{org}".',
     )
-    collab_users: List[dict[str, Any]] = []
-    collab_permission: List[str] = []
 
     result: dict[str, list[UserAffiliationAndRepoPermission]] = retries_with_backoff(
         _get_repo_collaborators_inner_func,
@@ -244,8 +243,6 @@ def _get_repo_collaborators_for_multiple_repos(
         token=token,
         repo_raw_data=repo_raw_data,
         affiliation=affiliation,
-        collab_users=collab_users,
-        collab_permission=collab_permission,
     )
     return result
 

cartography/intel/gsuite/api.py

@@ -6,6 +6,7 @@ import neo4j
 from googleapiclient.discovery import Resource
 from googleapiclient.errors import HttpError
 
+from cartography.client.core.tx import run_write_query
 from cartography.util import run_cleanup_job
 from cartography.util import timeit
 
@@ -171,7 +172,12 @@ def load_gsuite_groups(
         g.lastupdated = $UpdateTag
     """
     logger.info(f"Ingesting {len(groups)} gsuite groups")
-    neo4j_session.run(ingestion_qry, GroupData=groups, UpdateTag=gsuite_update_tag)
+    run_write_query(
+        neo4j_session,
+        ingestion_qry,
+        GroupData=groups,
+        UpdateTag=gsuite_update_tag,
+    )
 
 
 @timeit
@@ -215,7 +221,12 @@ def load_gsuite_users(
         u.lastupdated = $UpdateTag
     """
     logger.info(f"Ingesting {len(users)} gsuite users")
-    neo4j_session.run(ingestion_qry, UserData=users, UpdateTag=gsuite_update_tag)
+    run_write_query(
+        neo4j_session,
+        ingestion_qry,
+        UserData=users,
+        UpdateTag=gsuite_update_tag,
+    )
 
 
 @timeit
@@ -234,7 +245,8 @@ def load_gsuite_members(
         SET
         r.lastupdated = $UpdateTag
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingestion_qry,
         MemberData=members,
         GroupID=group.get("id"),
@@ -249,7 +261,8 @@ def load_gsuite_members(
         SET
         r.lastupdated = $UpdateTag
     """
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         membership_qry,
         MemberData=members,
         GroupID=group.get("id"),

cartography/intel/okta/applications.py

@@ -10,6 +10,7 @@ import neo4j
 from okta.framework.ApiClient import ApiClient
 from okta.framework.OktaError import OktaError
 
+from cartography.client.core.tx import run_write_query
 from cartography.intel.okta.utils import check_rate_limit
 from cartography.intel.okta.utils import create_api_client
 from cartography.intel.okta.utils import is_last_page
@@ -293,7 +294,8 @@ def _load_okta_applications(
     SET org_r.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_statement,
         ORG_ID=okta_org_id,
         APP_LIST=app_list,
@@ -327,7 +329,8 @@ def _load_application_user(
     SET r.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest,
         APP_ID=app_id,
         USER_LIST=user_list,
@@ -361,7 +364,8 @@ def _load_application_group(
     SET r.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest,
         APP_ID=app_id,
         GROUP_LIST=group_list,
@@ -400,7 +404,8 @@ def _load_application_reply_urls(
     SET r.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest,
         APP_ID=app_id,
         URL_LIST=reply_urls,

cartography/intel/okta/awssaml.py

@@ -10,6 +10,7 @@ import neo4j
 
 from cartography.client.core.tx import read_list_of_dicts_tx
 from cartography.client.core.tx import read_single_value_tx
+from cartography.client.core.tx import run_write_query
 from cartography.util import timeit
 
 AccountRole = namedtuple("AccountRole", ["account_id", "role_name"])
@@ -116,7 +117,8 @@ def _load_okta_group_to_aws_roles(
     SET r.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_statement,
         GROUP_TO_ROLE=group_to_role,
         okta_update_tag=okta_update_tag,
@@ -140,7 +142,8 @@ def _load_human_can_assume_role(
     SET r.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_statement,
         okta_update_tag=okta_update_tag,
     )

cartography/intel/okta/factors.py

@@ -8,6 +8,7 @@ from okta import FactorsClient
 from okta.framework.OktaError import OktaError
 from okta.models.factor.Factor import Factor
 
+from cartography.client.core.tx import run_write_query
 from cartography.intel.okta.sync_state import OktaSyncState
 from cartography.util import timeit
 
@@ -130,7 +131,8 @@ def _load_user_factors(
     SET r.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest,
         USER_ID=user_id,
         FACTOR_LIST=factors,

cartography/intel/okta/groups.py

@@ -11,6 +11,7 @@ from okta.framework.OktaError import OktaError
 from okta.framework.PagedResults import PagedResults
 from okta.models.usergroup import UserGroup
 
+from cartography.client.core.tx import run_write_query
 from cartography.intel.okta.sync_state import OktaSyncState
 from cartography.intel.okta.utils import check_rate_limit
 from cartography.intel.okta.utils import create_api_client
@@ -204,7 +205,8 @@ def _load_okta_groups(
     SET org_r.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_statement,
         ORG_ID=okta_org_id,
         GROUP_LIST=group_list,
@@ -251,7 +253,8 @@ def load_okta_group_members(
         SET r.lastupdated = $okta_update_tag
     """
     logging.info(f"Loading {len(member_list)} members of group {group_id}")
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest,
         GROUP_ID=group_id,
         MEMBER_LIST=member_list,

cartography/intel/okta/organization.py

@@ -3,6 +3,7 @@ import logging
 
 import neo4j
 
+from cartography.client.core.tx import run_write_query
 from cartography.util import timeit
 
 logger = logging.getLogger(__name__)
@@ -27,7 +28,8 @@ def create_okta_organization(
     SET org.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest,
         ORG_NAME=organization,
         okta_update_tag=okta_update_tag,

cartography/intel/okta/origins.py

@@ -7,6 +7,7 @@ from typing import List
 import neo4j
 from okta.framework.ApiClient import ApiClient
 
+from cartography.client.core.tx import run_write_query
 from cartography.intel.okta.utils import create_api_client
 from cartography.util import timeit
 
@@ -96,7 +97,8 @@ def _load_trusted_origins(
     SET r.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest,
         ORG_ID=okta_org_id,
         TRUSTED_LIST=trusted_list,

cartography/intel/okta/roles.py

@@ -7,6 +7,7 @@ from typing import List
 import neo4j
 from okta.framework.ApiClient import ApiClient
 
+from cartography.client.core.tx import run_write_query
 from cartography.intel.okta.sync_state import OktaSyncState
 from cartography.intel.okta.utils import check_rate_limit
 from cartography.intel.okta.utils import create_api_client
@@ -117,7 +118,8 @@ def _load_user_role(
     SET r2.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest,
         USER_ID=user_id,
         ROLES_DATA=roles_data,
@@ -149,7 +151,8 @@ def _load_group_role(
     SET r2.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest,
         GROUP_ID=group_id,
         ROLES_DATA=roles_data,

cartography/intel/okta/users.py

@@ -8,6 +8,7 @@ import neo4j
 from okta import UsersClient
 from okta.models.user import User
 
+from cartography.client.core.tx import run_write_query
 from cartography.intel.okta.sync_state import OktaSyncState
 from cartography.intel.okta.utils import check_rate_limit
 from cartography.util import timeit
@@ -174,7 +175,8 @@ def _load_okta_users(
     SET h.lastupdated = $okta_update_tag
     """
 
-    neo4j_session.run(
+    run_write_query(
+        neo4j_session,
         ingest_statement,
         ORG_ID=okta_org_id,
         USER_LIST=user_list,

cartography/models/aws/identitycenter/awspermissionset.py

@@ -82,7 +82,7 @@ class AWSPermissionSetToAWSAccountRel(CartographyRelSchema):
 @dataclass(frozen=True)
 class RoleAssignmentAllowedByRelProperties(CartographyRelProperties):
     """
-    Properties for the ALLOWED_BY relationship between AWSRole and AWSSSOUser.
+    Properties for the ALLOWED_BY relationship between AWSRole and AWSSSO principals.
     """
 
     # Mandatory fields for MatchLinks
@@ -121,6 +121,29 @@ class RoleAssignmentAllowedByMatchLink(CartographyRelSchema):
     )
 
 
+@dataclass(frozen=True)
+class RoleAssignmentAllowedByGroupMatchLink(CartographyRelSchema):
+    """
+    MatchLink schema for ALLOWED_BY relationships from group role assignments.
+    Creates relationships like: (AWSRole)-[:ALLOWED_BY]->(AWSSSOGroup)
+    """
+
+    source_node_label: str = "AWSRole"
+    source_node_matcher: SourceNodeMatcher = make_source_node_matcher(
+        {"arn": PropertyRef("RoleArn")},
+    )
+
+    target_node_label: str = "AWSSSOGroup"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("GroupId")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "ALLOWED_BY"
+    properties: RoleAssignmentAllowedByRelProperties = (
+        RoleAssignmentAllowedByRelProperties()
+    )
+
+
 @dataclass(frozen=True)
 class AWSPermissionSetSchema(CartographyNodeSchema):
     label: str = "AWSPermissionSet"