Represents properties on cartography nodes and relationships. PropertyRefs allow dynamically generated Neo4j ingestion queries to set values

Mapping between an ontology field and a module's node field. Attributes: ontology_field: The field name in the ontology. node_fie

Encapsulates a list of CartographyRelSchema objects for additional relationships. This dataclass is used to group multiple CartographyRelSch

Encapsulates a list of labels for the CartographyNodeSchema. This wrapper class is used to ensure dataclass immutability for the Cartography

Mapping for a node in the ontology. Attributes: node_label: The label of the ontology node. fields: A list of OntologyFieldMappin

Ontology mapping for a specific module. Attributes: module_name: The name of the module. nodes: A list of OntologyNodeMapping def

A Fact gathers information about the environment using a Cypher query.

A Rule represents a security issue or misconfiguration detected in the environment.

Callable that defers `from cartography.intel.X import func` until first invocation. Keeps `import cartography.sync` cheap: provider SDKs (boto3,

A conditional label that is applied to nodes only when specific field conditions are met. Conditional labels allow you to dynamically apply

A reference document for a Rule.

If a node carrying ontology label `src` has an outward edge toward a node carrying ontology label `dst`, that edge MUST be named `label`. The

One enumerated report. uri: human-readable provenance string (used in logs and errors). name: backend-specific key passed to read_bytes (S3 o

A common interface for cartography configuration. All fields defined on this class must be present on a configuration object. Fields documen

ACLParser is a class that parses Tailscale ACLs to extract data. It removes comments and trailing commas from the ACL string and converts it

Okta sync state. Object used to store sync data to allow each stages to share data. For example, saving user and group list returned by O

A reference to a compliance framework requirement/control mapping. A rule can map to many framework controls, and many rules can map to the

Rule that maps a Cloud Asset full resource name to a Cartography node. - ``service_prefix``: the full name must start with this (e.g.

Schema to serialize and deserialize DriftStates from JSON.

Sub-resource scoping metadata for load_matchlinks() source or target matches. This helper lets a MatchLink schema opt into matching an endpo

Command Line Interface for cartography using Typer. This class provides the main command line interface for cartography, handling argume

Schema to serialize and deserialize Shortcuts from JSON.

Raised on read or parse failures from a ReportReader. Covers both transport failures (S3/GCS/Azure exceptions, local OSError) and decode/pars

Properties for GCPLabel nodes. The id is computed as "{resource_id}:{key}:{value}" during ingestion.

(:GCPProject)-[:RESOURCE]->(:GCPLabel)

Represents a container image from the graph (ECR, GCR, GitLab, etc.).

Results for a single Fact execution. Contains the findings from executing a Fact's Cypher query along with optional compliance metrics w

Define a sub resource relationship (:InterestingAsset)<-[:RELATIONSHIP_LABEL]-(:SubResource)

Schema for container images with conditional labels based on image type. This mimics the ECR use case where different image types map to diff

Raised when a transient ECR/image-blob fetch failure should skip one image.

GitHub App credential with automatic token refresh. Generates a JWT from the app's private key, exchanges it for an installation access

Schema for GitLab Project nodes. Projects are repositories/codebases that belong to an organization. They may also have a RESOURCE relat

A single `include:` entry from the YAML.

Test relationship schema connecting principals to S3 buckets with permissions.

An S3 bucket+prefix. `prefix` never has a leading slash.

The default object which stores query information. :type name: String :param name: Name of the query. :type validation_query: String

Result of fetching the org's container packages list. ``cleanup_safe`` is False when the endpoint was unavailable (404 on older GHES, for ins

A statement that will run against the cartography graph. Statements can query or update the graph. This class encapsulates a Neo4j Cypher qu

A filesystem path to a single report or a directory of reports.

There is no sub-resource relationship here because a CIDR block can be associated with more than one account and it doesn't make sense to

Inline policies are defined on the given principal and are therefore scoped to that principal's account.

An Azure Blob Storage container+prefix. `prefix` never has a leading slash.

Define an additional relationship (:InterestingAsset)-[:ASSOCIATED_WITH]->(:HelloAsset)