lyft/cartography
Cartography
Cartography is a graph-based infrastructure visualization and security analysis framework. It ingests data from diverse cloud, identity, and software-as-a-service providers to model complex relationships between resources, users, and security findings within a centralized graph database. By mapping these interdependencies, the platform enables organizations to gain visibility into their environment and identify potential security risks through graph traversal queries.
The platform distinguishes itself through its ontology-based normalization and cross-platform entity correlation, which map heterogeneous data from multiple sources into a unified, consistent model. It employs modular ingestion pipelines and schema-based filtering to maintain this graph, ensuring that infrastructure data remains accurate through automated state-based pruning of stale nodes. This approach allows for the discovery of complex attack paths and security misconfigurations that span across disparate cloud, device, and identity management systems.
Beyond core modeling, the system provides extensive capabilities for asset inventory, identity governance, and software supply chain analysis. It supports a wide range of integrations, including cloud-native compute and networking resources, endpoint management telemetry, and development lifecycle metadata. Users can extend the platform’s functionality by defining custom security rules, adding specialized data analysis jobs, or integrating new intelligence sources through its modular framework.
The project is implemented in Python and provides documentation for configuring ingestion modules and defining custom graph queries.
Features
- Infrastructure Knowledge Graphs - Models complex relationships between cloud resources, identity providers, and security findings within a centralized graph database.
- Cross-Platform Links - Links identical assets across different platforms by matching shared attributes to maintain a unified entity view.
- Data Normalization - Maps fields from heterogeneous source data into a unified semantic model for consistent entity representation.
- Graph-Based Node Models - Stores infrastructure resources and their interdependencies as nodes and edges to enable complex relationship traversal and analysis.
- Security Analysis Queries - Identifies infrastructure risks and attack paths by executing graph traversal queries against the aggregated environment model.
- Semantic Normalization - Applies semantic labels and standardized properties to diverse resource types to enable consistent cross-platform queries.
- Infrastructure Dependency Visualizations - Visualizes complex relationships between cloud resources, network components, and data stores to understand environment dependencies and risks.
- Asset Inventory Aggregators - Consolidates hardware, software, and cloud resources into a unified asset ontology for visibility.
- Attack Path Analysis - Identifies risky infrastructure patterns and potential attack vectors using graph-based queries.
- Cloud Security Posture Management - Identifies attack paths and security misconfigurations by analyzing infrastructure relationships in a graph database.
- Identity and Access Management - Maps users, groups, and permissions across identity providers to analyze effective access and identify over-privileged accounts.
- Software Supply Chain Security - Traces container provenance and software dependencies from source repositories through CI/CD pipelines to production.
- Graph Pruning - Automatically removes stale nodes and relationships from the graph to ensure infrastructure data remains accurate.
- Internet Exposure Detection - Analyzes security group rules and load balancer schemes to flag assets reachable from the public internet.
- Infrastructure Mappers - Ingests cloud assets and relationships into a graph database to enable dependency analysis.
- Azure Data Factory Inventory - Models data factories, pipelines, datasets, and linked services to visualize data integration workflows.
- Data Catalogs - Indexes tables, instances, and clusters to map the data layer across cloud environments for centralized visibility.
- Pipeline Dependency Inventories - Ingests configuration and relationship data from data integration pipelines to analyze dependencies between data movement components.
- Entity Mapping - Provides mechanisms to restrict canonical entity creation to trusted modules, ensuring data consistency across the graph.
- Source Definitions - Restricts the creation of canonical user and device nodes to specific modules to ensure trusted data integrity.
- Synchronization Pruning - Maintains data accuracy by automatically removing nodes and relationships that were not updated during the latest synchronization cycle.
- Code Ownership Tools - Parses owner files to link repository paths to the users and teams responsible for them.
- Software Dependency Catalogs - Extracts manifests and lockfiles to identify and inventory software packages and versions across repositories.
- AWS Infrastructure Inventory - Transforms resource configurations and their relationships into a graph database to visualize dependencies across AWS environments.
- Azure Compute Inventory - Catalogs virtual machines, clusters, and serverless functions, including operational state and network exposure.
- Container Registry Inventory - Indexes container packages, images, tags, and layers from a registry to provide visibility into software supply chains.
- Infrastructure Inventory - Discovers and catalogs DigitalOcean cloud assets to populate a graph database for dependency analysis.
- AI Infrastructure Inventories - Ingests users, workspaces, and API keys to visualize relationships between AI infrastructure and organizational access points.
- Cloudflare - Ingests account roles and network records into a graph database to visualize the relationships between edge security assets and web infrastructure.
- Endpoint Fleet Inventories - Imports device objects and relationships to visualize managed endpoint fleets and security status.
- Endpoint Management Inventories - Ingests configuration and device data to visualize the security posture of managed endpoint infrastructure.
- Cloud Resource Inventory - Ingests Kubernetes cluster resources and their relationships into a graph database for infrastructure visualization.
- Compute Resource Inventory - Maps virtual machines, serverless functions, and clusters into a graph database to create a comprehensive view of distributed compute assets and dependencies.
- Infrastructure Security Audits - Executes pre-defined queries against graph-stored infrastructure data to identify potential attack surfaces, security gaps, and compliance violations.
- Infrastructure Topology Mapping - Visualizes virtual networks, subnets, and gateways to map traffic flow and infrastructure dependencies.
- Ingestion Filters - Limits the ingestion process to specific resource types to optimize synchronization performance and reduce data overhead.
- Access Pattern Analysis - Queries the relationships between users, groups, and applications to identify software access patterns.
- Authentication Flow Analysis - Models the sequence of authentication steps and execution requirements to visualize how users are authenticated.
- Compliance Security Audits - Evaluates the current environment against sets of predefined security rules to identify framework violations.
- Identity Correlation Tools - Links user accounts across multiple identity providers and platforms to create a unified view of identities.
- Identity Data Ingestion - Ingests identity and access management data to visualize relationships between users, devices, and security policies.
- Identity Provider Role Mapping - Infers effective user permissions by propagating group memberships and role assignments across a graph.
- Security Asset Inventories - Ingests security telemetry and asset data to visualize infrastructure relationships within a graph database.
- Security Finding Management - Aggregates vulnerabilities and security issues from multiple scanners into a unified graph to identify risks.
- Security Monitoring - Aggregates vulnerability and threat detection data from cloud-native security services into a searchable graph for risk assessment.
- Container Image Vulnerability Scanners - Parses security scan reports from container images to identify vulnerable base images and associated risks.
- Custom Security Rule Definitions - Defines new security checks by writing queries to gather evidence and specifying a data model for findings.
- Ontologies - Maps heterogeneous resource types from multiple providers into a standardized set of semantic labels and properties.
- External API Ingestion Pipelines - Uses independent, pluggable modules to fetch data from diverse APIs and transform them into a unified graph structure.
- AWS Security - Graph-based visualization of AWS infrastructure assets.
- Identity and Access Management - Maps dependencies and relationships between services and cloud resources.
- Security Assessment Tools - Consolidates infrastructure assets into a graph-based view.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
