lyft/cartography

Features

• Infrastructure Knowledge Graphs - Models complex relationships between cloud resources, identity providers, and security findings within a centralized graph database.
• Cross-Platform Links - Links identical assets across different platforms by matching shared attributes to maintain a unified entity view.
• Data Normalization - Maps fields from heterogeneous source data into a unified semantic model for consistent entity representation.
• Graph-Based Node Models - Stores infrastructure resources and their interdependencies as nodes and edges to enable complex relationship traversal and analysis.
• Security Analysis Queries - Identifies infrastructure risks and attack paths by executing graph traversal queries against the aggregated environment model.
• Semantic Normalization - Applies semantic labels and standardized properties to diverse resource types to enable consistent cross-platform queries.
• Infrastructure Dependency Visualizations - Visualizes complex relationships between cloud resources, network components, and data stores to understand environment dependencies and risks.
• Asset Inventory Aggregators - Consolidates hardware, software, and cloud resources into a unified asset ontology for visibility.
• Attack Path Analysis - Identifies risky infrastructure patterns and potential attack vectors using graph-based queries.
• Cloud Security Posture Management - Identifies attack paths and security misconfigurations by analyzing infrastructure relationships in a graph database.
• Identity and Access Management - Maps users, groups, and permissions across identity providers to analyze effective access and identify over-privileged accounts.
• Software Supply Chain Security - Traces container provenance and software dependencies from source repositories through CI/CD pipelines to production.
• Graph Pruning - Automatically removes stale nodes and relationships from the graph to ensure infrastructure data remains accurate.
• Internet Exposure Detection - Analyzes security group rules and load balancer schemes to flag assets reachable from the public internet.
• Infrastructure Mappers - Ingests cloud assets and relationships into a graph database to enable dependency analysis.
• Azure Data Factory Inventory - Models data factories, pipelines, datasets, and linked services to visualize data integration workflows.
• Data Catalogs - Indexes tables, instances, and clusters to map the data layer across cloud environments for centralized visibility.
• Pipeline Dependency Inventories - Ingests configuration and relationship data from data integration pipelines to analyze dependencies between data movement components.
• Entity Mapping - Provides mechanisms to restrict canonical entity creation to trusted modules, ensuring data consistency across the graph.
• Source Definitions - Restricts the creation of canonical user and device nodes to specific modules to ensure trusted data integrity.
• Synchronization Pruning - Maintains data accuracy by automatically removing nodes and relationships that were not updated during the latest synchronization cycle.
• Code Ownership Tools - Parses owner files to link repository paths to the users and teams responsible for them.
• Software Dependency Catalogs - Extracts manifests and lockfiles to identify and inventory software packages and versions across repositories.
• AWS Infrastructure Inventory - Transforms resource configurations and their relationships into a graph database to visualize dependencies across AWS environments.
• Azure Compute Inventory - Catalogs virtual machines, clusters, and serverless functions, including operational state and network exposure.
• Container Registry Inventory - Indexes container packages, images, tags, and layers from a registry to provide visibility into software supply chains.
• Infrastructure Inventory - Discovers and catalogs DigitalOcean cloud assets to populate a graph database for dependency analysis.
• AI Infrastructure Inventories - Ingests users, workspaces, and API keys to visualize relationships between AI infrastructure and organizational access points.
• Cloudflare - Ingests account roles and network records into a graph database to visualize the relationships between edge security assets and web infrastructure.
• Endpoint Fleet Inventories - Imports device objects and relationships to visualize managed endpoint fleets and security status.
• Endpoint Management Inventories - Ingests configuration and device data to visualize the security posture of managed endpoint infrastructure.
• Cloud Resource Inventory - Ingests Kubernetes cluster resources and their relationships into a graph database for infrastructure visualization.
• Compute Resource Inventory - Maps virtual machines, serverless functions, and clusters into a graph database to create a comprehensive view of distributed compute assets and dependencies.
• Infrastructure Security Audits - Executes pre-defined queries against graph-stored infrastructure data to identify potential attack surfaces, security gaps, and compliance violations.
• Infrastructure Topology Mapping - Visualizes virtual networks, subnets, and gateways to map traffic flow and infrastructure dependencies.
• Ingestion Filters - Limits the ingestion process to specific resource types to optimize synchronization performance and reduce data overhead.
• Access Pattern Analysis - Queries the relationships between users, groups, and applications to identify software access patterns.
• Authentication Flow Analysis - Models the sequence of authentication steps and execution requirements to visualize how users are authenticated.
• Compliance Security Audits - Evaluates the current environment against sets of predefined security rules to identify framework violations.
• Identity Correlation Tools - Links user accounts across multiple identity providers and platforms to create a unified view of identities.
• Identity Data Ingestion - Ingests identity and access management data to visualize relationships between users, devices, and security policies.
• Identity Provider Role Mapping - Infers effective user permissions by propagating group memberships and role assignments across a graph.
• Security Asset Inventories - Ingests security telemetry and asset data to visualize infrastructure relationships within a graph database.
• Security Finding Management - Aggregates vulnerabilities and security issues from multiple scanners into a unified graph to identify risks.
• Security Monitoring - Aggregates vulnerability and threat detection data from cloud-native security services into a searchable graph for risk assessment.
• Container Image Vulnerability Scanners - Parses security scan reports from container images to identify vulnerable base images and associated risks.
• Custom Security Rule Definitions - Defines new security checks by writing queries to gather evidence and specifying a data model for findings.
• Ontologies - Maps heterogeneous resource types from multiple providers into a standardized set of semantic labels and properties.
• External API Ingestion Pipelines - Uses independent, pluggable modules to fetch data from diverse APIs and transform them into a unified graph structure.
• AWS Security - Graph-based visualization of AWS infrastructure assets.
• Identity and Access Management - Maps dependencies and relationships between services and cloud resources.
• Security Assessment Tools - Consolidates infrastructure assets into a graph-based view.

Star-Verlauf