update dist config

update dist 0.30.2
bump v0.3.5
2026-11-09 01:29:38 -10:00 · 2025-12-09 11:50:48 -06:00 · 2025-12-09 11:43:17 -06:00 · 2025-12-09 11:20:58 -06:00 · 2025-12-09 11:16:02 -06:00 · 2025-11-10 16:29:03 -06:00
459 changed files with 12086 additions and 29844 deletions
@@ -1 +0,0 @@
-* @BishopFox/bf-red-team
@@ -1,153 +0,0 @@
---
-name: cirro-schema-docs
-description: Synchronize Cirro analysis documentation and mkdocs navigation with schema constants and graph config YAML files.
---
-
-# Cirro Schema Docs Skill
-
-## Purpose
-
-Use this skill when Cirro graph config files or schema constants change and documentation must be updated to match.
-
-Primary sources of truth:
- `src/graph/config/constants.yaml`
- `src/graph/config/**/*.tera.yaml`
-
-Primary documentation targets:
- `docs/analysis/**`
- `zensical.toml` nav entries
-
-## When To Use
-
-Trigger examples:
- sync cirro docs
- update node and edge documentation
- ensure docs match cirro config
- add missing cirro documentation
-
-## Required Workflow
-
-1. Read constants.
-	- Parse `REL.*` and `LABELS.*` from `src/graph/config/constants.yaml`.
-
-2. Inventory existing docs.
-	- `docs/analysis/graph-nodes/*.md`
-	- `docs/analysis/arm-nodes/**/*.md`
-	- `docs/analysis/additional-nodes/*.md`
-	- `docs/analysis/tailscale-nodes/*.md`
-	- `docs/analysis/edges/*.md`
-	- `docs/analysis/post-processing/*.md`
-	- Also inspect the `nav:` section in `zensical.toml`.
-
-3. Scan config YAML.
-	- `src/graph/config/azure/arm/**/*.tera.yaml`
-	- `src/graph/config/azure/msgraph/*.tera.yaml`
-	- `src/graph/config/post_processing/*.tera.yaml`
-	- `src/graph/config/tailscale/**/*.tera.yaml`
-	- For each file, extract `name`, `label`, `properties`, and all relationship usage from `cypher`.
-
-4. Cross-reference and find gaps.
-	- Missing node docs from `LABELS.*`
-	- Missing edge docs from `REL.*` (convert `UPPER_SNAKE` to `lower-kebab`)
-	- Missing post-processing docs from files in `src/graph/config/post_processing/`
-	- Missing `zensical.toml` nav entries for all docs under `docs/analysis/`
-
-5. Create or update docs.
-	- Prefer minimal edits and keep style consistent with nearby files.
-	- Create missing directories before creating files.
-
-6. Update `zensical.toml` nav.
-	- Place docs in the correct analysis sections.
-	- Keep entries alphabetically sorted within each section.
-	- Preserve existing indentation and structure.
-
-7. Ask for confirmation on unused constants.
-	- If a `LABELS.*` or `REL.*` constant is not referenced by any `.tera.yaml`, ask whether to document it or treat it as deprecated.
-
-## Mapping Rules
-
- ARM labels -> `docs/analysis/arm-nodes/<provider>/<node-name>.md`
- Graph labels -> `docs/analysis/graph-nodes/graph-<name>.md`
- Additional labels -> `docs/analysis/additional-nodes/<name>.md`
- Tailscale labels -> `docs/analysis/tailscale-nodes/ts-<name>.md`
- Edge docs -> `docs/analysis/edges/<rel-name>.md`
- Post-processing docs -> `docs/analysis/post-processing/<step-name>.md`
-
-## Content Templates
-
-Use these as baseline structures.
-
-### Node Doc
-
-~~~markdown
-# NodeDisplayName
-
-Description of what the node represents.
-
-**Labels:** `:ArmResource:NodeLabel`
-
-**Properties:**
- `id` - Resource ID (primary key)
- `propertyName` - Description
-
-## Relationships
-
-### Outgoing
- **NodeLabel** -> `REL_NAME` -> **TargetLabel** - Description
-
-## Examples
-
-```cypher
-MATCH (n:NodeLabel)
-RETURN n.name, n.property
-```
-~~~
-
-For Graph nodes, use `:GraphObject:NodeLabel` in `Labels`.
-
-### Edge Doc
-
-~~~markdown
-# REL_NAME
-
-Description of the relationship.
-
-## Usage
- **SourceLabel** -> `REL_NAME` -> **TargetLabel** - Description
-
-## Properties
-No additional properties on the relationship.
-
-## Examples
-
-```cypher
-MATCH (a)-[r:REL_NAME]->(b)
-RETURN a.name, b.name
-```
-~~~
-
-### Post-Processing Doc
-
-~~~markdown
-# Step Display Name
-
-Description of what this post-processing step does.
-
-**Priority:** N
-
-## Details
-Explanation of the logic.
-
-## Cypher
-
-```cypher
-// Cleaned-up cypher from YAML
-```
-~~~
-
-## Guardrails
-
- Treat YAML config and constants as source of truth.
- Do not invent labels or relationships not present in source files.
- Keep edits deterministic, concise, and sorted where applicable.
- Preserve existing docs style and naming conventions.
@@ -0,0 +1,41 @@
+name: docs-deploy
+on:
+  push:
+    paths:
+      - "docs/**"
+      - "mkdocs.yml"
+      - ".github/workflows/docs-deploy.yml"
+    branches:
+      - main
+  pull_request:
+    paths:
+      - "docs/**"
+      - "mkdocs.yml"
+      - ".github/workflows/docs-deploy.yml"
+    branches:
+      - main
+    types: [closed]
+
+permissions:
+  contents: write
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Configure Git Credentials
+        run: |
+          git config user.name github-actions[bot]
+          git config user.email github-actions[bot]@users.noreply.github.com
+      - uses: actions/setup-python@v5
+        with:
+          python-version: 3.x
+      - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
+      - uses: actions/cache@v4
+        with:
+          key: mkdocs-material-${{ env.cache_id }}
+          path: ~/.cache
+          restore-keys: |
+            mkdocs-material-
+      - run: pip install mkdocs-material
+      - run: mkdocs gh-deploy --force
@@ -1,32 +0,0 @@
-name: Documentation
-on:
-  push:
-    paths:
-      - "docs/**"
-      - "zensical.toml"
-      - ".github/workflows/docs.yml"
-    branches:
-      - main
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-jobs:
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/configure-pages@v6
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
-        with:
-          python-version: 3.x
-      - run: pip install zensical
-      - run: zensical build --clean
-      - uses: actions/upload-pages-artifact@v5
-        with:
-          path: site
-      - uses: actions/deploy-pages@v5
-        id: deployment
@@ -9,7 +9,7 @@ target/

 # Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
 # More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
-# Cargo.lock
+Cargo.lock

 # These are backup files generated by rustfmt
 **/*.rs.bk
@@ -46,11 +46,9 @@ rust-project.json
 *.db
 *.db-wal
 *.db-shm
-cirro_*.json
-*_export

 *.bin
 neo4j/
 site/
 *.csv
-demo/
+enrich_config.json
@@ -2,7 +2,7 @@
  "yaml.schemas": {
    "https://squidfunk.github.io/mkdocs-material/schema.json": "mkdocs.yml"
  },
-  "yaml.customTags": [
+  "yaml.customTags": [ 
    "!ENV scalar",
    "!ENV sequence",
    "!relative scalar",
@@ -12,7 +12,5 @@
    "tag:yaml.org,2002:python/object/apply:pymdownx.slugs.slugify mapping"
  ],
  "python-envs.defaultEnvManager": "ms-python.python:system",
-  "python-envs.pythonProjects": [],
-  "rust-analyzer.cargo.target": "x86_64-pc-windows-gnu",
-  "git.addAICoAuthor": "off"
+  "python-envs.pythonProjects": []
 }
@@ -1,93 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [1.4.0] - 2026-11-05
-
-### Added
-
- Restricted guest Microsoft Graph collection through service principal relationships with `--restricted-guest`.
- Custom application ID seeds with `--restricted-appids` and an optional Microsoft application catalog with `--restricted-guest-msapps`.
-
-## [1.3.0] - 2026-09-22
-
-### Added
-
- Add user manager and password change datetime by @daddycocoaman in [#36](https://github.com/bishopfox/cirro/pull/36)
- Add odata types and agent id relations by @daddycocoaman in [#35](https://github.com/bishopfox/cirro/pull/35)
-
-### Changed
-
- Process createdByAppId by @daddycocoaman in [#34](https://github.com/bishopfox/cirro/pull/34)
-
-### Fixed
-
- Use correct base64 decoding for tokens by @daddycocoaman in [#38](https://github.com/bishopfox/cirro/pull/38)
- Check site serverfarmid for null by @daddycocoaman in [#37](https://github.com/bishopfox/cirro/pull/37)
-
-## [1.2.1] - 2026-06-01
-
-### Fixed
-
- Fix merges in loadbalancer by @daddycocoaman in [#33](https://github.com/bishopfox/cirro/pull/33)
-
-## [1.2.0] - 2026-05-12
-
-### Added
-
- Add network LoadBalancer nodes and VirtualHub by @daddycocoaman in [#30](https://github.com/bishopfox/cirro/pull/30)
- Add subject for FIC collection by @daddycocoaman in [#28](https://github.com/bishopfox/cirro/pull/28)
- Add KustoCluster node by @daddycocoaman in [#25](https://github.com/bishopfox/cirro/pull/25)
- Add SyntexDocumentProcessor by @daddycocoaman in [#24](https://github.com/bishopfox/cirro/pull/24)
- Add azure stack nodes and edges by @daddycocoaman in [#23](https://github.com/bishopfox/cirro/pull/23)
- Add oracle autonomous db by @daddycocoaman in [#22](https://github.com/bishopfox/cirro/pull/22)
- Add multiple Hybrid nodes and parity with virtual machines by @daddycocoaman in [#21](https://github.com/bishopfox/cirro/pull/21)
- Add ManagedHSM by @daddycocoaman in [#15](https://github.com/bishopfox/cirro/pull/15)
- Add AnalysisServiceServer and AnalysisServiceFirewallRule by @daddycocoaman in [#14](https://github.com/bishopfox/cirro/pull/14)
- Add composite index and constraints syntax by @daddycocoaman in [#13](https://github.com/bishopfox/cirro/pull/13)
- Add GithubNetworkSettings by @daddycocoaman in [#12](https://github.com/bishopfox/cirro/pull/12)
- Add dry run switch for ingest by @daddycocoaman in [#11](https://github.com/bishopfox/cirro/pull/11)
- Add argument validation to applicable arguments by @daddycocoaman in [#10](https://github.com/bishopfox/cirro/pull/10)
-
-### Changed
-
- Update docs by @daddycocoaman in [#31](https://github.com/bishopfox/cirro/pull/31)
- Update cypher to Cypher 25 syntax by @daddycocoaman in [#27](https://github.com/bishopfox/cirro/pull/27)
- Update netapp nodes by @daddycocoaman in [#26](https://github.com/bishopfox/cirro/pull/26)
- Update docs skill for zensical by @daddycocoaman in [#20](https://github.com/bishopfox/cirro/pull/20)
- Migrate docs to zensical by @daddycocoaman in [#19](https://github.com/bishopfox/cirro/pull/19)
- Turn off git AI CoAuthor setting by @daddycocoaman in [#16](https://github.com/bishopfox/cirro/pull/16)
- Update restore point changes by @daddycocoaman in [#9](https://github.com/bishopfox/cirro/pull/9)
- Improve restorepointcollections by @daddycocoaman in [#8](https://github.com/bishopfox/cirro/pull/8)
-
-### Fixed
-
- Re-add WITH before CALLs in Cypher  and minor bugs by @daddycocoaman in [#29](https://github.com/bishopfox/cirro/pull/29)
- Change generic resource MI checks to CONTAINS by @daddycocoaman in [#17](https://github.com/bishopfox/cirro/pull/17)
-
-## [1.1.0] - 2026-04-13
-
-### Added
-
- Add NetworkWatcher, KeyVaultCertificate, KeyVaultCertificateValue by @daddycocoaman in [#3](https://github.com/BishopFox/cirro/pull/3)
- Add CODEOWNERS for bf-red-team (CLD-10728) by @grobbinsBF
-
-### Changed
-
- Bump version to 1.1.0
- Sync docs with schemas by @daddycocoaman
-
-### New Contributors
-* @grobbinsBF made their first contribution in [#2](https://github.com/BishopFox/cirro/pull/2)
-
-## [1.0.0] - 2026-03-31
-
-### Initial Release
-* Initial release by @daddycocoaman
-
-[1.1.0]: https://github.com/BishopFox/cirro/compare/v1.0.0...v1.1.0
-
-<!-- generated by git-cliff -->
@@ -1,42 +1,14 @@
-[package]
+[workspace]
+members = ["src/cirro", "src/cirro-graph"]
+resolver = "3"
+
+[workspace.package]
 edition = "2024"
-name = "cirro"
 repository = "https://github.com/bishopfox/cirro"
-version = "1.4.0"
+version = "0.3.5"

-[features]
-azure = ["collector"]
-collector = [
-    "dep:async-trait",
-    "dep:base64",
-    "dep:chrono",
-    "dep:dashmap",
-    "dep:futures",
-    "dep:jsonwebtoken",
-    "dep:once_cell",
-    "dep:pem",
-    "dep:regex",
-    "dep:reqwest",
-    "dep:rsa",
-    "dep:sha1",
-    "dep:which",
-]
-default = ["azure", "tailscale", "graph"]
-graph = [
-    "dep:neo4rs",
-    "dep:rayon",
-    "dep:rust-embed",
-    "dep:serde_yaml",
-    "dep:strum",
-    "dep:strum_macros",
-    "dep:tera",
-    "dep:url",
-]
-tailscale = ["collector"]
-
-[dependencies]
-# Common dependencies (shared between collection and graph)
-clap = { version = "4.5.54", features = ["cargo", "derive"] }
+[workspace.dependencies]
+clap = { version = "4.5.41", features = ["cargo", "derive"] }
 colored = "3.0.0"
 fern = { version = "0.7.1", features = ["chrono"] }
 log = "0.4.27"
@@ -47,46 +19,17 @@ thiserror = "2.0.16"
 tokio = { version = "1.46.1", features = ["full"] }
 uuid = { version = "1.17.0", features = ["v4"] }

-# Collection-specific dependencies (from cirro, optional)
-async-trait = { version = "0.1.78", optional = true }
-base64 = { version = "0.22.1", optional = true }
-chrono = { version = "0.4.41", optional = true }
-dashmap = { version = "5.5.3", optional = true }
-futures = { version = "0.3.31", optional = true }
-jsonwebtoken = { version = "10.3.0", features = [
-    "use_pem",
-    "aws_lc_rs",
-], optional = true }
-once_cell = { version = "1.19.0", optional = true }
-pem = { version = "3.0.5", optional = true }
-regex = { version = "1.12.3", optional = true }
-reqwest = { version = "0.13.2", features = [
-    "json",
-    "query",
-    "form",
-    "gzip",
-    "brotli",
-], optional = true }
-rsa = { version = "0.9.8", features = ["sha1", "sha2"], optional = true }
-sha1 = { version = "0.10.6", optional = true }
-which = { version = "8.0.0", optional = true }
-
-# Graph-specific dependencies (from cirro-graph, optional)
-neo4rs = { version = "0.8.0", features = ["json"], optional = true }
-rayon = { version = "1.10", optional = true }
-rust-embed = { version = "8.11.0", features = ["compression"], optional = true }
-serde_yaml = { version = "0.9.34", optional = true }
-strum = { version = "0.27.1", optional = true }
-strum_macros = { version = "0.27.1", optional = true }
-tera = { version = "1.20.1", optional = true }
-url = { version = "2.5.7", optional = true }
-
 [profile.dev]
 debug = "line-tables-only"
-opt-level = 0
+
+[profile.dev.package."*"]
+debug = false
+
+[profile.debugging]
+debug = true
+inherits = "dev"

 [profile.release]
-codegen-units = 1
 lto = "thin"
 opt-level = "s"
 panic = 'abort'
@@ -94,5 +37,12 @@ strip = true

 # The profile that 'dist' will build with
 [profile.dist]
+codegen-units = 1
+debug = false
+incremental = false
 inherits = "release"
-lto = "thin"
+lto = "fat"
+opt-level = 3
+overflow-checks = false
+panic = "abort"
+strip = true
@@ -1,595 +1,202 @@
-GNU General Public License
-==========================
-
-_Version 3, 29 June 2007_  
-_Copyright © 2007 Free Software Foundation, Inc. &lt;<http://fsf.org/>&gt;_
-
-Everyone is permitted to copy and distribute verbatim copies of this license
-document, but changing it is not allowed.
-
-## Preamble
-
-The GNU General Public License is a free, copyleft license for software and other
-kinds of works.
-
-The licenses for most software and other practical works are designed to take away
-your freedom to share and change the works. By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change all versions of a
-program--to make sure it remains free software for all its users. We, the Free
-Software Foundation, use the GNU General Public License for most of our software; it
-applies also to any other work released this way by its authors. You can apply it to
-your programs, too.
-
-When we speak of free software, we are referring to freedom, not price. Our General
-Public Licenses are designed to make sure that you have the freedom to distribute
-copies of free software (and charge for them if you wish), that you receive source
-code or can get it if you want it, that you can change the software or use pieces of
-it in new free programs, and that you know you can do these things.
-
-To protect your rights, we need to prevent others from denying you these rights or
-asking you to surrender the rights. Therefore, you have certain responsibilities if
-you distribute copies of the software, or if you modify it: responsibilities to
-respect the freedom of others.
-
-For example, if you distribute copies of such a program, whether gratis or for a fee,
-you must pass on to the recipients the same freedoms that you received. You must make
-sure that they, too, receive or can get the source code. And you must show them these
-terms so they know their rights.
-
-Developers that use the GNU GPL protect your rights with two steps: **(1)** assert
-copyright on the software, and **(2)** offer you this License giving you legal permission
-to copy, distribute and/or modify it.
-
-For the developers' and authors' protection, the GPL clearly explains that there is
-no warranty for this free software. For both users' and authors' sake, the GPL
-requires that modified versions be marked as changed, so that their problems will not
-be attributed erroneously to authors of previous versions.
-
-Some devices are designed to deny users access to install or run modified versions of
-the software inside them, although the manufacturer can do so. This is fundamentally
-incompatible with the aim of protecting users' freedom to change the software. The
-systematic pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable. Therefore, we have designed
-this version of the GPL to prohibit the practice for those products. If such problems
-arise substantially in other domains, we stand ready to extend this provision to
-those domains in future versions of the GPL, as needed to protect the freedom of
-users.
-
-Finally, every program is threatened constantly by software patents. States should
-not allow patents to restrict development and use of software on general-purpose
-computers, but in those that do, we wish to avoid the special danger that patents
-applied to a free program could make it effectively proprietary. To prevent this, the
-GPL assures that patents cannot be used to render the program non-free.
-
-The precise terms and conditions for copying, distribution and modification follow.
-
-## TERMS AND CONDITIONS
-
-### 0. Definitions
-
-“This License” refers to version 3 of the GNU General Public License.
-
-“Copyright” also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-“The Program” refers to any copyrightable work licensed under this
-License. Each licensee is addressed as “you”. “Licensees” and
-“recipients” may be individuals or organizations.
-
-To “modify” a work means to copy from or adapt all or part of the work in
-a fashion requiring copyright permission, other than the making of an exact copy. The
-resulting work is called a “modified version” of the earlier work or a
-work “based on” the earlier work.
-
-A “covered work” means either the unmodified Program or a work based on
-the Program.
-
-To “propagate” a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for infringement under
-applicable copyright law, except executing it on a computer or modifying a private
-copy. Propagation includes copying, distribution (with or without modification),
-making available to the public, and in some countries other activities as well.
-
-To “convey” a work means any kind of propagation that enables other
-parties to make or receive copies. Mere interaction with a user through a computer
-network, with no transfer of a copy, is not conveying.
-
-An interactive user interface displays “Appropriate Legal Notices” to the
-extent that it includes a convenient and prominently visible feature that **(1)**
-displays an appropriate copyright notice, and **(2)** tells the user that there is no
-warranty for the work (except to the extent that warranties are provided), that
-licensees may convey the work under this License, and how to view a copy of this
-License. If the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-### 1. Source Code
-
-The “source code” for a work means the preferred form of the work for
-making modifications to it. “Object code” means any non-source form of a
-work.
-
-A “Standard Interface” means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of interfaces
-specified for a particular programming language, one that is widely used among
-developers working in that language.
-
-The “System Libraries” of an executable work include anything, other than
-the work as a whole, that **(a)** is included in the normal form of packaging a Major
-Component, but which is not part of that Major Component, and **(b)** serves only to
-enable use of the work with that Major Component, or to implement a Standard
-Interface for which an implementation is available to the public in source code form.
-A “Major Component”, in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system (if any) on which
-the executable work runs, or a compiler used to produce the work, or an object code
-interpreter used to run it.
-
-The “Corresponding Source” for a work in object code form means all the
-source code needed to generate, install, and (for an executable work) run the object
-code and to modify the work, including scripts to control those activities. However,
-it does not include the work's System Libraries, or general-purpose tools or
-generally available free programs which are used unmodified in performing those
-activities but which are not part of the work. For example, Corresponding Source
-includes interface definition files associated with source files for the work, and
-the source code for shared libraries and dynamically linked subprograms that the work
-is specifically designed to require, such as by intimate data communication or
-control flow between those subprograms and other parts of the work.
-
-The Corresponding Source need not include anything that users can regenerate
-automatically from other parts of the Corresponding Source.
-
-The Corresponding Source for a work in source code form is that same work.
-
-### 2. Basic Permissions
-
-All rights granted under this License are granted for the term of copyright on the
-Program, and are irrevocable provided the stated conditions are met. This License
-explicitly affirms your unlimited permission to run the unmodified Program. The
-output from running a covered work is covered by this License only if the output,
-given its content, constitutes a covered work. This License acknowledges your rights
-of fair use or other equivalent, as provided by copyright law.
-
-You may make, run and propagate covered works that you do not convey, without
-conditions so long as your license otherwise remains in force. You may convey covered
-works to others for the sole purpose of having them make modifications exclusively
-for you, or provide you with facilities for running those works, provided that you
-comply with the terms of this License in conveying all material for which you do not
-control copyright. Those thus making or running the covered works for you must do so
-exclusively on your behalf, under your direction and control, on terms that prohibit
-them from making any copies of your copyrighted material outside their relationship
-with you.
-
-Conveying under any other circumstances is permitted solely under the conditions
-stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
-
-### 3. Protecting Users' Legal Rights From Anti-Circumvention Law
-
-No covered work shall be deemed part of an effective technological measure under any
-applicable law fulfilling obligations under article 11 of the WIPO copyright treaty
-adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention
-of such measures.
-
-When you convey a covered work, you waive any legal power to forbid circumvention of
-technological measures to the extent such circumvention is effected by exercising
-rights under this License with respect to the covered work, and you disclaim any
-intention to limit operation or modification of the work as a means of enforcing,
-against the work's users, your or third parties' legal rights to forbid circumvention
-of technological measures.
-
-### 4. Conveying Verbatim Copies
-
-You may convey verbatim copies of the Program's source code as you receive it, in any
-medium, provided that you conspicuously and appropriately publish on each copy an
-appropriate copyright notice; keep intact all notices stating that this License and
-any non-permissive terms added in accord with section 7 apply to the code; keep
-intact all notices of the absence of any warranty; and give all recipients a copy of
-this License along with the Program.
-
-You may charge any price or no price for each copy that you convey, and you may offer
-support or warranty protection for a fee.
-
-### 5. Conveying Modified Source Versions
-
-You may convey a work based on the Program, or the modifications to produce it from
-the Program, in the form of source code under the terms of section 4, provided that
-you also meet all of these conditions:
-
-* **a)** The work must carry prominent notices stating that you modified it, and giving a
-relevant date.
-* **b)** The work must carry prominent notices stating that it is released under this
-License and any conditions added under section 7. This requirement modifies the
-requirement in section 4 to “keep intact all notices”.
-* **c)** You must license the entire work, as a whole, under this License to anyone who
-comes into possession of a copy. This License will therefore apply, along with any
-applicable section 7 additional terms, to the whole of the work, and all its parts,
-regardless of how they are packaged. This License gives no permission to license the
-work in any other way, but it does not invalidate such permission if you have
-separately received it.
-* **d)** If the work has interactive user interfaces, each must display Appropriate Legal
-Notices; however, if the Program has interactive interfaces that do not display
-Appropriate Legal Notices, your work need not make them do so.
-
-A compilation of a covered work with other separate and independent works, which are
-not by their nature extensions of the covered work, and which are not combined with
-it such as to form a larger program, in or on a volume of a storage or distribution
-medium, is called an “aggregate” if the compilation and its resulting
-copyright are not used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit. Inclusion of a covered work in an aggregate
-does not cause this License to apply to the other parts of the aggregate.
-
-### 6. Conveying Non-Source Forms
-
-You may convey a covered work in object code form under the terms of sections 4 and
-5, provided that you also convey the machine-readable Corresponding Source under the
-terms of this License, in one of these ways:
-
-* **a)** Convey the object code in, or embodied in, a physical product (including a
-physical distribution medium), accompanied by the Corresponding Source fixed on a
-durable physical medium customarily used for software interchange.
-* **b)** Convey the object code in, or embodied in, a physical product (including a
-physical distribution medium), accompanied by a written offer, valid for at least
-three years and valid for as long as you offer spare parts or customer support for
-that product model, to give anyone who possesses the object code either **(1)** a copy of
-the Corresponding Source for all the software in the product that is covered by this
-License, on a durable physical medium customarily used for software interchange, for
-a price no more than your reasonable cost of physically performing this conveying of
-source, or **(2)** access to copy the Corresponding Source from a network server at no
-charge.
-* **c)** Convey individual copies of the object code with a copy of the written offer to
-provide the Corresponding Source. This alternative is allowed only occasionally and
-noncommercially, and only if you received the object code with such an offer, in
-accord with subsection 6b.
-* **d)** Convey the object code by offering access from a designated place (gratis or for
-a charge), and offer equivalent access to the Corresponding Source in the same way
-through the same place at no further charge. You need not require recipients to copy
-the Corresponding Source along with the object code. If the place to copy the object
-code is a network server, the Corresponding Source may be on a different server
-(operated by you or a third party) that supports equivalent copying facilities,
-provided you maintain clear directions next to the object code saying where to find
-the Corresponding Source. Regardless of what server hosts the Corresponding Source,
-you remain obligated to ensure that it is available for as long as needed to satisfy
-these requirements.
-* **e)** Convey the object code using peer-to-peer transmission, provided you inform
-other peers where the object code and Corresponding Source of the work are being
-offered to the general public at no charge under subsection 6d.
-
-A separable portion of the object code, whose source code is excluded from the
-Corresponding Source as a System Library, need not be included in conveying the
-object code work.
-
-A “User Product” is either **(1)** a “consumer product”, which
-means any tangible personal property which is normally used for personal, family, or
-household purposes, or **(2)** anything designed or sold for incorporation into a
-dwelling. In determining whether a product is a consumer product, doubtful cases
-shall be resolved in favor of coverage. For a particular product received by a
-particular user, “normally used” refers to a typical or common use of
-that class of product, regardless of the status of the particular user or of the way
-in which the particular user actually uses, or expects or is expected to use, the
-product. A product is a consumer product regardless of whether the product has
-substantial commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-“Installation Information” for a User Product means any methods,
-procedures, authorization keys, or other information required to install and execute
-modified versions of a covered work in that User Product from a modified version of
-its Corresponding Source. The information must suffice to ensure that the continued
-functioning of the modified object code is in no case prevented or interfered with
-solely because modification has been made.
-
-If you convey an object code work under this section in, or with, or specifically for
-use in, a User Product, and the conveying occurs as part of a transaction in which
-the right of possession and use of the User Product is transferred to the recipient
-in perpetuity or for a fixed term (regardless of how the transaction is
-characterized), the Corresponding Source conveyed under this section must be
-accompanied by the Installation Information. But this requirement does not apply if
-neither you nor any third party retains the ability to install modified object code
-on the User Product (for example, the work has been installed in ROM).
-
-The requirement to provide Installation Information does not include a requirement to
-continue to provide support service, warranty, or updates for a work that has been
-modified or installed by the recipient, or for the User Product in which it has been
-modified or installed. Access to a network may be denied when the modification itself
-materially and adversely affects the operation of the network or violates the rules
-and protocols for communication across the network.
-
-Corresponding Source conveyed, and Installation Information provided, in accord with
-this section must be in a format that is publicly documented (and with an
-implementation available to the public in source code form), and must require no
-special password or key for unpacking, reading or copying.
-
-### 7. Additional Terms
-
-“Additional permissions” are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions. Additional
-permissions that are applicable to the entire Program shall be treated as though they
-were included in this License, to the extent that they are valid under applicable
-law. If additional permissions apply only to part of the Program, that part may be
-used separately under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-When you convey a copy of a covered work, you may at your option remove any
-additional permissions from that copy, or from any part of it. (Additional
-permissions may be written to require their own removal in certain cases when you
-modify the work.) You may place additional permissions on material, added by you to a
-covered work, for which you have or can give appropriate copyright permission.
-
-Notwithstanding any other provision of this License, for material you add to a
-covered work, you may (if authorized by the copyright holders of that material)
-supplement the terms of this License with terms:
-
-* **a)** Disclaiming warranty or limiting liability differently from the terms of
-sections 15 and 16 of this License; or
-* **b)** Requiring preservation of specified reasonable legal notices or author
-attributions in that material or in the Appropriate Legal Notices displayed by works
-containing it; or
-* **c)** Prohibiting misrepresentation of the origin of that material, or requiring that
-modified versions of such material be marked in reasonable ways as different from the
-original version; or
-* **d)** Limiting the use for publicity purposes of names of licensors or authors of the
-material; or
-* **e)** Declining to grant rights under trademark law for use of some trade names,
-trademarks, or service marks; or
-* **f)** Requiring indemnification of licensors and authors of that material by anyone
-who conveys the material (or modified versions of it) with contractual assumptions of
-liability to the recipient, for any liability that these contractual assumptions
-directly impose on those licensors and authors.
-
-All other non-permissive additional terms are considered “further
-restrictions” within the meaning of section 10. If the Program as you received
-it, or any part of it, contains a notice stating that it is governed by this License
-along with a term that is a further restriction, you may remove that term. If a
-license document contains a further restriction but permits relicensing or conveying
-under this License, you may add to a covered work material governed by the terms of
-that license document, provided that the further restriction does not survive such
-relicensing or conveying.
-
-If you add terms to a covered work in accord with this section, you must place, in
-the relevant source files, a statement of the additional terms that apply to those
-files, or a notice indicating where to find the applicable terms.
-
-Additional terms, permissive or non-permissive, may be stated in the form of a
-separately written license, or stated as exceptions; the above requirements apply
-either way.
-
-### 8. Termination
-
-You may not propagate or modify a covered work except as expressly provided under
-this License. Any attempt otherwise to propagate or modify it is void, and will
-automatically terminate your rights under this License (including any patent licenses
-granted under the third paragraph of section 11).
-
-However, if you cease all violation of this License, then your license from a
-particular copyright holder is reinstated **(a)** provisionally, unless and until the
-copyright holder explicitly and finally terminates your license, and **(b)** permanently,
-if the copyright holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-Moreover, your license from a particular copyright holder is reinstated permanently
-if the copyright holder notifies you of the violation by some reasonable means, this
-is the first time you have received notice of violation of this License (for any
-work) from that copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-Termination of your rights under this section does not terminate the licenses of
-parties who have received copies or rights from you under this License. If your
-rights have been terminated and not permanently reinstated, you do not qualify to
-receive new licenses for the same material under section 10.
-
-### 9. Acceptance Not Required for Having Copies
-
-You are not required to accept this License in order to receive or run a copy of the
-Program. Ancillary propagation of a covered work occurring solely as a consequence of
-using peer-to-peer transmission to receive a copy likewise does not require
-acceptance. However, nothing other than this License grants you permission to
-propagate or modify any covered work. These actions infringe copyright if you do not
-accept this License. Therefore, by modifying or propagating a covered work, you
-indicate your acceptance of this License to do so.
-
-### 10. Automatic Licensing of Downstream Recipients
-
-Each time you convey a covered work, the recipient automatically receives a license
-from the original licensors, to run, modify and propagate that work, subject to this
-License. You are not responsible for enforcing compliance by third parties with this
-License.
-
-An “entity transaction” is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an organization, or
-merging organizations. If propagation of a covered work results from an entity
-transaction, each party to that transaction who receives a copy of the work also
-receives whatever licenses to the work the party's predecessor in interest had or
-could give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if the predecessor
-has it or can get it with reasonable efforts.
-
-You may not impose any further restrictions on the exercise of the rights granted or
-affirmed under this License. For example, you may not impose a license fee, royalty,
-or other charge for exercise of rights granted under this License, and you may not
-initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging
-that any patent claim is infringed by making, using, selling, offering for sale, or
-importing the Program or any portion of it.
-
-### 11. Patents
-
-A “contributor” is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based. The work thus
-licensed is called the contributor's “contributor version”.
-
-A contributor's “essential patent claims” are all patent claims owned or
-controlled by the contributor, whether already acquired or hereafter acquired, that
-would be infringed by some manner, permitted by this License, of making, using, or
-selling its contributor version, but do not include claims that would be infringed
-only as a consequence of further modification of the contributor version. For
-purposes of this definition, “control” includes the right to grant patent
-sublicenses in a manner consistent with the requirements of this License.
-
-Each contributor grants you a non-exclusive, worldwide, royalty-free patent license
-under the contributor's essential patent claims, to make, use, sell, offer for sale,
-import and otherwise run, modify and propagate the contents of its contributor
-version.
-
-In the following three paragraphs, a “patent license” is any express
-agreement or commitment, however denominated, not to enforce a patent (such as an
-express permission to practice a patent or covenant not to sue for patent
-infringement). To “grant” such a patent license to a party means to make
-such an agreement or commitment not to enforce a patent against the party.
-
-If you convey a covered work, knowingly relying on a patent license, and the
-Corresponding Source of the work is not available for anyone to copy, free of charge
-and under the terms of this License, through a publicly available network server or
-other readily accessible means, then you must either **(1)** cause the Corresponding
-Source to be so available, or **(2)** arrange to deprive yourself of the benefit of the
-patent license for this particular work, or **(3)** arrange, in a manner consistent with
-the requirements of this License, to extend the patent license to downstream
-recipients. “Knowingly relying” means you have actual knowledge that, but
-for the patent license, your conveying the covered work in a country, or your
-recipient's use of the covered work in a country, would infringe one or more
-identifiable patents in that country that you have reason to believe are valid.
-
-If, pursuant to or in connection with a single transaction or arrangement, you
-convey, or propagate by procuring conveyance of, a covered work, and grant a patent
-license to some of the parties receiving the covered work authorizing them to use,
-propagate, modify or convey a specific copy of the covered work, then the patent
-license you grant is automatically extended to all recipients of the covered work and
-works based on it.
-
-A patent license is “discriminatory” if it does not include within the
-scope of its coverage, prohibits the exercise of, or is conditioned on the
-non-exercise of one or more of the rights that are specifically granted under this
-License. You may not convey a covered work if you are a party to an arrangement with
-a third party that is in the business of distributing software, under which you make
-payment to the third party based on the extent of your activity of conveying the
-work, and under which the third party grants, to any of the parties who would receive
-the covered work from you, a discriminatory patent license **(a)** in connection with
-copies of the covered work conveyed by you (or copies made from those copies), or **(b)**
-primarily for and in connection with specific products or compilations that contain
-the covered work, unless you entered into that arrangement, or that patent license
-was granted, prior to 28 March 2007.
-
-Nothing in this License shall be construed as excluding or limiting any implied
-license or other defenses to infringement that may otherwise be available to you
-under applicable patent law.
-
-### 12. No Surrender of Others' Freedom
-
-If conditions are imposed on you (whether by court order, agreement or otherwise)
-that contradict the conditions of this License, they do not excuse you from the
-conditions of this License. If you cannot convey a covered work so as to satisfy
-simultaneously your obligations under this License and any other pertinent
-obligations, then as a consequence you may not convey it at all. For example, if you
-agree to terms that obligate you to collect a royalty for further conveying from
-those to whom you convey the Program, the only way you could satisfy both those terms
-and this License would be to refrain entirely from conveying the Program.
-
-### 13. Use with the GNU Affero General Public License
-
-Notwithstanding any other provision of this License, you have permission to link or
-combine any covered work with a work licensed under version 3 of the GNU Affero
-General Public License into a single combined work, and to convey the resulting work.
-The terms of this License will continue to apply to the part which is the covered
-work, but the special requirements of the GNU Affero General Public License, section
-13, concerning interaction through a network will apply to the combination as such.
-
-### 14. Revised Versions of this License
-
-The Free Software Foundation may publish revised and/or new versions of the GNU
-General Public License from time to time. Such new versions will be similar in spirit
-to the present version, but may differ in detail to address new problems or concerns.
-
-Each version is given a distinguishing version number. If the Program specifies that
-a certain numbered version of the GNU General Public License “or any later
-version” applies to it, you have the option of following the terms and
-conditions either of that numbered version or of any later version published by the
-Free Software Foundation. If the Program does not specify a version number of the GNU
-General Public License, you may choose any version ever published by the Free
-Software Foundation.
-
-If the Program specifies that a proxy can decide which future versions of the GNU
-General Public License can be used, that proxy's public statement of acceptance of a
-version permanently authorizes you to choose that version for the Program.
-
-Later license versions may give you additional or different permissions. However, no
-additional obligations are imposed on any author or copyright holder as a result of
-your choosing to follow a later version.
-
-### 15. Disclaimer of Warranty
-
-THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
-EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER
-EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE
-QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE
-DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-### 16. Limitation of Liability
-
-IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY
-COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS
-PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL,
-INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
-PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE
-OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE
-WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-### 17. Interpretation of Sections 15 and 16
-
-If the disclaimer of warranty and limitation of liability provided above cannot be
-given local legal effect according to their terms, reviewing courts shall apply local
-law that most closely approximates an absolute waiver of all civil liability in
-connection with the Program, unless a warranty or assumption of liability accompanies
-a copy of the Program in return for a fee.
-
-_END OF TERMS AND CONDITIONS_
-
-## How to Apply These Terms to Your New Programs
-
-If you develop a new program, and you want it to be of the greatest possible use to
-the public, the best way to achieve this is to make it free software which everyone
-can redistribute and change under these terms.
-
-To do so, attach the following notices to the program. It is safest to attach them
-to the start of each source file to most effectively state the exclusion of warranty;
-and each file should have at least the “copyright” line and a pointer to
-where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program does terminal interaction, make it output a short notice like this
-when it starts in an interactive mode:
-
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type 'show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type 'show c' for details.
-
-The hypothetical commands `show w` and `show c` should show the appropriate parts of
-the General Public License. Of course, your program's commands might be different;
-for a GUI interface, you would use an “about box”.
-
-You should also get your employer (if you work as a programmer) or school, if any, to
-sign a “copyright disclaimer” for the program, if necessary. For more
-information on this, and how to apply and follow the GNU GPL, see
-&lt;<http://www.gnu.org/licenses/>&gt;.
-
-The GNU General Public License does not permit incorporating your program into
-proprietary programs. If your program is a subroutine library, you may consider it
-more useful to permit linking proprietary applications with the library. If this is
-what you want to do, use the GNU Lesser General Public License instead of this
-License. But first, please read
-&lt;<http://www.gnu.org/philosophy/why-not-lgpl.html>&gt;.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
@@ -1,161 +1,165 @@
 <p align='center'><img src='docs/logo.png' alt='logo' height="400"/><br>
 </p>

-Cirro is an extensible security research platform that enables researchers and penetration testers to collect, analyze, and visualize cloud environments and identity relationships through graph databases. Built with a modular architecture, Cirro can be extended to support multiple platforms and data sources.
+Cirro is a tool that enables security researchers and penetration testers to collect, analyze, and visualize Azure cloud environments and Entra ID relationships through graph databases.

-You can check out the [Documentation](https://bishopfox.github.io/cirro) for more info.
+You can check out the [Documentation](https://crispy-adventure-qre5p1k.pages.github.io/) for more info.

 ## Features

- **Multi-platform Data Collection**: Extensible architecture supporting multiple cloud platforms and identity providers
- **Flexible Authentication**: Support for various authentication methods depending on the target platform
+- **Multi-source Data Collection**: Gather data from both Azure Resource Manager (ARM) APIs and Microsoft Graph APIs
+- **Flexible Authentication**: Support for multiple authentication methods including Azure CLI, access tokens, client secrets, and client certificates
+- **Graph Database Support**: Compatible with both **Neo4j** and **Memgraph** graph databases
+- **Data Enrichment**: Additional data collection capabilities for storage accounts, containers, and blob analysis
+- **Multi-cloud Support**: Works with Azure Public, China, Germany, and US Government clouds
 - **Cross-platform**: Available for Windows, macOS, and Linux
- **Modular Design**: Optional platform functionality through feature flags and extensible plugin architecture
- **Network Topology Analysis**: Support for network infrastructure platforms like Tailscale
- **Entra ID Enrichment**: User managers and password-change timestamps, application creators, agent identity properties, and published permission scopes
- **Restricted Guest Collection**: Traverse accessible application relationships with built-in, custom, or Microsoft catalog seeds
-
-See the [collection guide](docs/usage/cirro.md) for usage examples and collection coverage.

 ## Architecture

-Cirro has two main functional areas:
+Cirro consists of two main components:

- **Collection (`cirro collect`)**: Gathers information from various platforms and APIs
- **Graph Operations (`cirro graph`)**: Manages graph database operations including data ingestion and export
-
-The modular architecture uses feature flags to enable platform-specific functionality, allowing users to build only the components they need.
-
-## CLI Structure
-
-Cirro uses a hierarchical command structure organized by function and platform:
-
-```
-cirro <function> <platform> <command> [options]
-```
-
-### Data Collection
-
-**Azure (collect az)**
-
-```bash
-# Available authentication methods:
-cirro collect az azcli           # Azure CLI authentication
-cirro collect az client-secret   # Client ID and secret
-cirro collect az client-cert     # Client certificate
-cirro collect az access-token    # Pre-obtained access token
-cirro collect az user-pass       # Username and password
-```
-
-**Tailscale (collect ts)**
-
-```bash
-# Tailscale data collection
-cirro collect ts <auth-method> [options]
-```
-
-### Graph Operations
-
-**Data Ingestion (graph ingest)**
-
-```bash
-# Ingest collected data into graph database
-cirro graph ingest --type <platform> --file <data-file> [database options]
-```
-
-**Data Export (graph export)**
-
-```bash
-# Export graph data to various formats
-cirro graph export --format <format> [options]
-```
+- **`cirro`**: The primary data collection tool that gathers information from Azure and Microsoft Graph APIs
+- **`cirro-graph`**: The ingestion tool that loads collected data into graph databases (Neo4j or Memgraph)

 ## Installation

 ### Pre-built Binaries

-Download the latest release for your platform from the [releases page](https://github.com/bishopfox/cirro/releases). The releases are built with all features enabled.
+Download the latest release for your platform from the [releases page](https://github.com/bishopfox/cirro/releases).

 ### Building from Source

+Requires Rust 1.70 or later:
+
 ```bash
 git clone https://github.com/bishopfox/cirro.git
 cd cirro
 cargo build --release
 ```

-**NOTE: BUILDING WITH --RELEASE IS IMPORTANT FOR GRAPH FUNCTIONALITY SINCE IT EMBEDS YAML CONFIGURATION FILES IN THE BINARY!**
+Binaries will be available in `target/release/`.

-The binary will be available at `target/release/cirro`.
+## Quick Start

-#### Build Options
+### 1. Data Collection

-By default, Cirro includes all available functionality. To build with specific features:
+Collect Azure and Entra ID data using one of the supported authentication methods:
+
+#### Azure CLI Authentication
+Uses existing Azure CLI authentication. Ensure you're logged in with `az login` before running.

 ```bash
-# Build with only collection features
-cargo build --release --no-default-features --features collector
-
-# Build with only graph features
-cargo build --release --no-default-features --features graph
-
-# Build with specific platform support
-cargo build --release --no-default-features --features "azure"
-cargo build --release --no-default-features --features "tailscale"
+# Collect from current Azure CLI context
+cirro collect azcli
 ```

-## Data Ingestion
+#### Client Secret Authentication
+Authenticate using an Azure AD application's client ID and secret.
+```bash
+cirro collect client-secret \
+  --client-id <CLIENT_ID> \
+  --client-secret <CLIENT_SECRET> \
+  --tenant-id <TENANT_ID>
+```

-Cirro uses Neo4j as the backend database. There are docker-compose files in the [tools](/tools/) directory to assist with containerized databases. 
+#### Client Certificate Authentication
+Authenticate using an Azure AD application's client ID and certificate (PEM format).
+```bash
+cirro collect client-cert \
+  --client-id <CLIENT_ID> \
+  --certificate <CERT_PATH> \
+  --tenant-id <TENANT_ID>
+```
+
+#### Access Token Authentication
+Use a pre-obtained access token.
+```bash
+cirro collect access-token --token <ACCESS_TOKEN>
+```
+
+### 2. Data Ingestion
+
+Both Neo4j and Memgraph are supported as graph database backends. Set up your preferred database before ingesting data. There are two docker-compose files in the [tools](/tools/) directory to assist with containerized databases. `cirro-graph` defaults to Neo4j configurations but you might consider using Memgraph for faster ingestion and performance.

 After collecting data, ingest it into your graph database:

+#### Neo4j
 ```bash
-# Ingest data for specific platforms
-cirro graph ingest --type az --file cirro_output.db         # Azure data
-cirro graph ingest --type ts --file cirro_ts_socket.json    # Tailscale data
-
-# Specify custom database connection
-cirro graph ingest --type az --file cirro_output.db \
-  --server bolt://localhost:7687 \
-  --user neo4j \
-  --password password
+cirro-graph --file cirro_output.db
 ```

-## Dry-Run Mode
-
-Preview what would be ingested and post-processed without writing any data to the graph database:
-
+#### Memgraph
 ```bash
-# Preview Azure ingestion and see which resource types have no implemented specs
-cirro graph ingest --type az --file cirro_output.db --dry-run
-
-# Preview Tailscale ingestion
-cirro graph ingest --type ts --file cirro_ts_socket.json --dry-run
+cirro-graph --file cirro_output.db \
+  --graph-type memgraph \
+  --user cirro \
+  --password cirro
 ```

-In dry-run mode, Cirro will:
+## Collection Modes

- Report each spec and its row count that **would** be processed
- Skip all Neo4j writes (no ingestion or post-processing queries execute)
- For Azure, list resource types in the input data that have no implemented spec
+- **`both`** (default): Collect from both ARM and Graph APIs
+- **`arm`**: Collect only from Azure Resource Manager APIs
+- **`graph`**: Collect only from Microsoft Graph APIs

-## Dashboard
+## Data Enrichment

-CirroDash can be located here: [https://github.com/bishopfox/cirrodash](https://github.com/bishopfox/cirrodash)
+Cirro supports additional data enrichment capabilities that will add additional nodes to the graph:

-## Debug Mode
+```bash
+# Collect storage account keys
+cirro enrich azcli --storage-keys
+```
+
+## Cloud Support
+
+Cirro supports multiple Azure cloud environments:
+
+- **`public`** (default): Azure Public Cloud
+- **`china`**: Azure China Cloud
+- **`germany`**: Azure Germany Cloud
+- **`usgov`**: Azure US Government Cloud
+
+```bash
+cirro collect azcli --cloud usgov
+```
+
+## Configuration Options
+
+### Global Options
+
+- `--output-path`: Specify the output SQLite database file (default: `cirro_output.db`)
+- `--debug`: Enable debug logging for troubleshooting
+- `--mode`: Set collection mode (`both`, `arm`, `graph`)
+- `--cloud`: Specify Azure cloud environment
+
+### Ingestion Options
+
+- `--file`: Path to the Cirro SQLite database
+- `--graph-type`: Database type (`neo4j` or `memgraph`)
+- `--server`: Database server URL (bolt://, neo4j://, etc.)
+- `--user`: Database username
+- `--password`: Database password
+- `--db-name`: Database name (optional, defaults based on graph type)
+
+
+## Troubleshooting
+
+### Common Issues
+
+1. **Authentication Failures**: Ensure your credentials have appropriate permissions
+2. **HTTP 429 Errors**: This can occur in large Azure environments. Retries are implemented in code but please report if you are still getting these errors.
+3. **Access Token Authentication**: Ensure your access token has the appropriate audience for Microsoft Graph or Azure Resource Manager.
+   
+### Debug Mode

 Enable debug logging for detailed information:

 ```bash
-# Collection debug mode
-cirro collect az azcli --debug
-
-# Ingestion debug mode
-cirro graph ingest --type az --file cirro_output.db --debug
+cirro collect azcli --debug
+cirro-graph --file cirro_output.db --debug
 ```

 ---

-**Note**: Cirro is designed for authorized security testing and research. Ensure you have proper permissions before running against any cloud or network environment.
+**Note**: Cirro is designed for authorized security testing and research. Ensure you have proper permissions before running against any Azure environment.
@@ -1,108 +0,0 @@
-# git-cliff ~ configuration file
-# https://git-cliff.org/docs/configuration
-
-[changelog]
-# A Tera template to be rendered as the changelog's header.
-# See https://keats.github.io/tera/docs/#introduction
-header = """
-# Changelog\n
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n
-"""
-# A Tera template to be rendered for each release in the changelog.
-# See https://keats.github.io/tera/docs/#introduction
-body = """
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-
-{% if version -%}
-    ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
-{% else -%}
-    ## [Unreleased]
-{% endif -%}
-
-{% for group, commits in commits | group_by(attribute="group") %}
-    ### {{ group | upper_first }}
-    {% for commit in commits | unique(attribute="message") %}
-        - {{ commit.message | split(pat="\n") | first | upper_first | trim }}\
-            {% if commit.remote.username %} by @{{ commit.remote.username }}{%- endif -%}
-            {% if commit.remote.pr_number %} in \
-            [#{{ commit.remote.pr_number }}]({{ self::remote_url() }}/pull/{{ commit.remote.pr_number }}) \
-            {%- endif -%}
-    {% endfor %}
-{% endfor %}
-
-{%- if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
-    ### New Contributors
-{%- endif -%}
-
-{% for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
-  * @{{ contributor.username }} made their first contribution
-    {%- if contributor.pr_number %} in \
-      [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
-    {%- endif %}
-{%- endfor %}\n
-
-{%- if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}{% raw %}\n{% endraw -%}{% endif %}
-
-"""
-# A Tera template to be rendered as the changelog's footer.
-# See https://keats.github.io/tera/docs/#introduction
-footer = """
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-
-{% for release in releases -%}
-    {% if release.version -%}
-        {% if release.previous.version -%}
-            [{{ release.version | trim_start_matches(pat="v") }}]: \
-                {{ self::remote_url() }}/compare/{{ release.previous.version }}...{{ release.version }}
-        {% endif -%}
-    {% else -%}
-        [unreleased]: {{ self::remote_url() }}/compare/{{ release.previous.version }}...HEAD
-    {% endif -%}
-{% endfor %}
-<!-- generated by git-cliff -->
-"""
-# Remove leading and trailing whitespaces from the changelog's body.
-trim = true
-
-[git]
-# Parse commits according to the conventional commits specification.
-# See https://www.conventionalcommits.org
-conventional_commits = true
-# Exclude commits that do not match the conventional commits specification.
-filter_unconventional = true
-# An array of regex based parsers to modify commit messages prior to further processing.
-commit_preprocessors = [
-    # Remove issue numbers.
-    { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "" },
-]
-# An array of regex based parsers for extracting data from the commit message.
-# Assigns commits to groups.
-# Optionally sets the commit's scope and can decide to exclude commits from further processing.
-commit_parsers = [
-    { message = "^[a|A]dd", group = "Added" },
-    { message = "^[s|S]upport", group = "Added" },
-    { message = "^[r|R]emove", group = "Removed" },
-    { message = "^.*: add", group = "Added" },
-    { message = "^.*: support", group = "Added" },
-    { message = "^.*: remove", group = "Removed" },
-    { message = "^.*: delete", group = "Removed" },
-    { message = "^test", group = "Fixed" },
-    { message = "^fix", group = "Fixed" },
-    { message = "^.*: fix", group = "Fixed" },
-    { message = "^.*", group = "Changed" },
-    { body = "$^", skip = true },
-]
-# Exclude commits that are not matched by any commit parser.
-filter_commits = false
-# Order releases topologically instead of chronologically.
-topo_order = false
-# Order of commits in each group/release within the changelog.
-# Allowed values: newest, oldest
-sort_commits = "newest"
@@ -10,20 +10,12 @@ ci = "github"
 # The installers to generate for each app
 installers = ["shell", "powershell"]
 # Target platforms to build apps for (Rust target-triple syntax)
-targets = [
-    "aarch64-apple-darwin",
-    "aarch64-unknown-linux-gnu",
-    "x86_64-apple-darwin",
-    "x86_64-unknown-linux-gnu",
-    "x86_64-unknown-linux-musl",
-    "x86_64-pc-windows-msvc",
-]
+targets = ["aarch64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-apple-darwin", "x86_64-unknown-linux-gnu", "x86_64-unknown-linux-musl", "x86_64-pc-windows-msvc"]
 # Path that installers should place binaries in
 install-path = "CARGO_HOME"
 # Whether to install an updater program
 install-updater = false

-[dist.github-custom-runners]
-aarch64-apple-darwin = "macos-15"
-aarch64-unknown-linux-gnu.container = "ghcr.io/rust-cross/cargo-zigbuild"
-aarch64-unknown-linux-musl.container = "ghcr.io/rust-cross/cargo-zigbuild"
+[dist.github-custom-runners.aarch64-unknown-linux-gnu.container]
+host = "x86_64-unknown-linux-musl"
+image = "quay.io/pypa/manylinux_2_28_x86_64"
@@ -7,36 +7,15 @@ These nodes are not direct objects in Entra ID or Azure but are created as a res
 - **[BastionIPConfig](additional-nodes/bastion-ip-config.md)** - IP configurations for Bastion hosts
 - **[Certificate](additional-nodes/certificate.md)** - X.509 certificates used for authentication
 - **[ClientSecret](additional-nodes/client-secret.md)** - Client secrets used for application authentication
- **[Container](additional-nodes/container.md)** - Individual containers within container groups
 - **[CustomDnsConfig](additional-nodes/custom-dns-config.md)** - Custom DNS configurations for private endpoints
- **[ExpressRouteCircuitPeering](additional-nodes/expressroute-circuit-peering.md)** - ExpressRoute peering configurations attached to circuits
 - **[FederatedIdentityCredential](additional-nodes/federated-identity-credential.md)** - Federated identity credentials for applications
- **[GraphAppRole](additional-nodes/graph-app-role.md)** - Application roles within Entra ID applications
- **[HybridExtension](additional-nodes/hybrid-extension.md)** - Extensions attached to hybrid machines
- **[HybridIPAddress](additional-nodes/hybrid-ip-address.md)** - IP addresses discovered for hybrid machines
+- **[GraphAppRole](additional-nodes/graph-app-role.md)** - Application roles within Azure AD applications
 - **[IPConfig](additional-nodes/ip-config.md)** - IP configuration details for network interfaces
- **[KeyVaultCertificate](additional-nodes/key-vault-certificate.md)** - Key Vault certificate metadata
- **[KeyVaultCertificateValue](additional-nodes/key-vault-certificate-value.md)** - Versioned Key Vault certificate data and policy details
- **[KeyVaultSecret](additional-nodes/key-vault-secret.md)** - Key Vault secret metadata
- **[KeyVaultSecretValue](additional-nodes/key-vault-secret-value.md)** - Versioned Key Vault secret values
- **[LoadBalancerBackendAddressPool](additional-nodes/load-balancer-backend-address-pool.md)** - Backend address pools attached to load balancers
- **[LoadBalancerFrontendIPConfiguration](additional-nodes/load-balancer-frontend-ip-configuration.md)** - Frontend IP configurations for load balancers
- **[LoadBalancerRule](additional-nodes/load-balancer-rule.md)** - Rule definitions attached to load balancers
 - **[NetworkGateway](additional-nodes/network-gateway.md)** - Virtual network gateways
 - **[NetworkPeering](additional-nodes/network-peering.md)** - Virtual network peering connections
 - **[NetworkRoute](additional-nodes/network-route.md)** - Individual routes within route tables
- **[NetAppAccountADDomain](additional-nodes/netapp-account-ad-domain.md)** - Active Directory domain configurations for NetApp accounts
- **[NetAppVolumeMount](additional-nodes/netapp-volume-mount.md)** - Mount targets for NetApp volumes
 - **[NSGRule](additional-nodes/nsg-rule.md)** - Network security group rules
- **[PrivateEndpointConnection](additional-nodes/private-endpoint-connection.md)** - Embedded private endpoint connection objects on ARM resources
 - **[PrivateLinkServiceConnection](additional-nodes/private-link-service-connection.md)** - Private link service connections
- **[RegistryCredential](additional-nodes/registry-credential.md)** - Container registry credentials associated with container groups
- **[RunbookParameter](additional-nodes/runbook-parameter.md)** - Parameters defined for automation runbooks
- **[ServicePrincipalEndpoint](additional-nodes/service-principal-endpoint.md)** - Service principal endpoints and metadata
 - **[StorageAccountKey](additional-nodes/storage-account-key.md)** - Storage account access keys
- **[StorageAccountDFS](additional-nodes/storage-account-dfs.md)** - Data Lake Storage Gen2 filesystems
 - **[Subnet](additional-nodes/subnet.md)** - Virtual network subnets
- **[VerifiedDomain](additional-nodes/verified-domain.md)** - Verified domains for Entra ID organizations
- **[VMExtension](additional-nodes/vm-extension.md)** - Extensions attached to Azure virtual machines
- **[VMRunCommand](additional-nodes/vm-run-command.md)** - Run command resources for Azure virtual machines
- **[VMRunCommandParameter](additional-nodes/vm-run-command-parameter.md)** - Parameters for virtual machine run commands
+- **[VerifiedDomain](additional-nodes/verified-domain.md)** - Verified domains for Azure AD organizations
@@ -1,27 +0,0 @@
-# AnalysisServiceFirewallRule
-
-Represents firewall rule entries attached to an Analysis Services server.
-
-**Labels:** `:AnalysisServiceFirewallRule`
-
-**Properties:**
-
- `name` - Firewall rule name
- `serverId` - Parent Analysis Services server resource ID (used with `name` as a composite key)
- `rangeStart` - Start of allowed IPv4 range
- `rangeEnd` - End of allowed IPv4 range
-
-## Relationships
-
-### Incoming
-
- **AnalysisServiceServer** → `HAS_RULE` → **AnalysisServiceFirewallRule** - Server that owns the firewall rule
-
-## Examples
-
-```cypher
-// List firewall rules per Analysis Services server
-MATCH (s:AnalysisServiceServer)-[:HAS_RULE]->(r:AnalysisServiceFirewallRule)
-RETURN s.serverFullName, r.name, r.rangeStart, r.rangeEnd
-ORDER BY s.serverFullName, r.name
-```
@@ -1,29 +0,0 @@
-# AzureStackEdgeMachineNic
-
-Represents network interface cards attached to Azure Stack HCI edge machines (not an ARM resource itself).
-
-**Labels:** `:AzureStackEdgeMachineNic`
-
-**Properties:**
-
- `machineId` - Parent edge machine ID (composite key with `adapterName`)
- `adapterName` - Network adapter name (composite key with `machineId`)
- `dnsServers` - DNS server addresses
- `ip4Address` - IPv4 address
- `macAddress` - MAC address
- `rdmaCapability` - RDMA capability of the adapter
- `subnetMask` - Subnet mask
-
-## Relationships
-
-### Incoming
-
- **AzureStackEdgeMachine** → `HAS_NIC` → **AzureStackEdgeMachineNic** - Parent edge machine
-
-## Examples
-
-```cypher
-// Find edge machines and their NIC details
-MATCH (em:AzureStackEdgeMachine)-[:HAS_NIC]->(nic:AzureStackEdgeMachineNic)
-RETURN em.id, nic.adapterName, nic.ip4Address, nic.macAddress, nic.rdmaCapability
-```
@@ -1,25 +0,0 @@
-# ContainerImage
-
-Represents a container image reference used by Container Apps (including tag/digest in the name).
-
-**Labels:** `:ContainerImage`
-
-**Properties:**
-
- `name` - Full image name (including registry prefix and tag/digest)
-
-## Relationships
-
-### Incoming
- **ContainerRegistry** → `CONTAINS_IMAGE` → **ContainerImage** - Registry that hosts the image reference
-
-### Outgoing
- **ContainerImage** → `HAS_ENVVAR` → **EnvVar** - Environment variables defined for the image in a Container App template
-
-## Examples
-
-```cypher
-// List images and their registries
-MATCH (acr:ContainerRegistry)-[:CONTAINS_IMAGE]->(img:ContainerImage)
-RETURN acr.loginServer, img.name
-```
@@ -1,15 +0,0 @@
-# Container
-
-Represents an individual container within an Azure Container Instances container group.
-
-**Labels:** `:Container`
-
-**Properties:**
-
- `image` - Container image name (primary key)
- `name` - Container name
- `environmentVariables` - List of environment variables in "name:value" format
-
-## Relationships
-
- **ContainerGroup** → **HAS_CONTAINER** → **Container** - Container within container groups
@@ -1,25 +0,0 @@
-# EnvVar
-
-Represents an environment variable defined for a container in a Container App template.
-
-**Labels:** `:EnvVar`
-
-**Properties:**
-
- `name` - Variable name (primary key per image edge)
- `value` - Literal value (if provided)
- `secretRef` - Secret reference name (if value is sourced from a secret)
-
-## Relationships
-
-### Incoming
- **ContainerImage** → `HAS_ENVVAR` → **EnvVar** - Environment variable attached to an image definition
-
-## Examples
-
-```cypher
-// Find env vars that reference secrets
-MATCH (img:ContainerImage)-[:HAS_ENVVAR]->(e:EnvVar)
-WHERE e.secretRef IS NOT NULL
-RETURN img.name, e.name, e.secretRef
-```
@@ -1,33 +0,0 @@
-# ExpressRouteCircuitPeering
-
-Represents an ExpressRoute peering object attached to an ExpressRoute circuit.
-
-**Labels:** `:ExpressRouteCircuitPeering`
-
-**Properties:**
-
- `id` - Peering resource ID (primary key)
- `name` - Peering name
- `azureASN` - Azure ASN value
- `peerASN` - Customer/provider ASN value
- `primaryPeerAddressPrefix` - Primary peering CIDR
- `secondaryPeerAddressPrefix` - Secondary peering CIDR
- `primaryAzurePort` - Primary Azure port
- `secondaryAzurePort` - Secondary Azure port
- `vlanId` - VLAN ID used for peering
- `peeringType` - Peering type
- `state` - Peering state
-
-## Relationships
-
-### Incoming
-
- **ExpressRouteCircuit** → `HAS_PEERING` → **ExpressRouteCircuitPeering** - Circuit-to-peering linkage
-
-## Examples
-
-```cypher
-// List ExpressRoute circuits and their peerings
-MATCH (c:ExpressRouteCircuit)-[:HAS_PEERING]->(p:ExpressRouteCircuitPeering)
-RETURN c.name, p.name, p.peeringType, p.state
-```
@@ -14,4 +14,4 @@ Represents federated identity credentials for applications.
 - `description` - Credential description

 **Relationships:**
- `AUTHENTICATES` → GraphApplication
+- `FEDERATED_CREDENTIAL` ← GraphApplication
@@ -1,6 +1,6 @@
 # GraphAppRole

-Represents application roles within Entra ID applications.
+Represents application roles within Azure AD applications.

 **Labels:** `:GraphAppRole`

@@ -1,34 +0,0 @@
-# HybridIPAddress
-
-Represents IP addresses associated with hybrid machines (not an ARM resource itself).
-
-**Labels:** `:HybridIPAddress`
-
-**Properties:**
-
- `id` - IP address ID (primary key)
- `ipAddress` - The IP address value
- `type` - IP address type (e.g., private, public)
- `subnetId` - Associated subnet ID if applicable
- `isPrimary` - Whether this is the primary IP address
-
-## Relationships
-
-### Incoming
-
- **HybridMachine** → `HAS_IP` → HybridIPAddress - Parent hybrid machine
-
-## Examples
-
-```cypher
-// Find all hybrid machines and their IP addresses
-MATCH (hm:HybridMachine)-[:HAS_IP]->(ip:HybridIPAddress)
-RETURN hm.displayName, ip.ipAddress, ip.type, ip.isPrimary
-```
-
-```cypher
-// Find hybrid machines with private IP addresses
-MATCH (hm:HybridMachine)-[:HAS_IP]->(ip:HybridIPAddress)
-WHERE ip.type = "private"
-RETURN hm.displayName, ip.ipAddress
-```
@@ -1,17 +0,0 @@
-# HybridRunCommandParameter
-
-Represents a parameter for a hybrid machine run command.
-
-**Labels:** `:HybridRunCommandParameter`
-
-**Properties:**
-
- `name` - Parameter name (composite key with `commandId`)
- `commandId` - Parent run command ID (composite key)
- `value` - Parameter value
-
-## Relationships
-
-### Incoming
-
- **HybridRunCommand** → `HAS_PARAMETER` → **HybridRunCommandParameter** - Parent run command
@@ -1,34 +0,0 @@
-# HybridRunCommand
-
-Represents a run command resource associated with an Azure Arc-enabled hybrid machine.
-
-**Labels:** `:ArmResource:HybridRunCommand`
-
-**Properties:**
-
- `id` - Run command resource ID (primary key)
- `asyncExecution` - Whether execution is asynchronous
- `runAsUser` - User context used to run the command
- `timeoutInSeconds` - Command timeout in seconds
- `treatFailureAsDeploymentFailure` - Failure handling behavior
- `script` - Script body
- `output` - Command output from the last execution
-
-## Relationships
-
-### Incoming
-
- **HybridMachine** → `HAS_RUN_COMMAND` → **HybridRunCommand** - Parent hybrid machine
-
-### Outgoing
-
- **HybridRunCommand** → `HAS_PARAMETER` → **HybridRunCommandParameter** - Parameters bound to the run command
-
-## Examples
-
-```cypher
-// Find hybrid run commands and their parameters
-MATCH (hm:HybridMachine)-[:HAS_RUN_COMMAND]->(cmd:HybridRunCommand)
-OPTIONAL MATCH (cmd)-[:HAS_PARAMETER]->(p:HybridRunCommandParameter)
-RETURN hm.displayName, cmd.id, collect(p.name) AS parameterNames
-```
@@ -1,40 +1,13 @@
-# IPConfiguration
+# IPConfig

-Represents IP configurations for network interfaces (not an ARM resource itself).
+Represents IP configurations for network interfaces.

-**Labels:** `:IPConfiguration`
+**Labels:** `:IPConfig`

 **Properties:**

- `id` - IP configuration ID (primary key)
 - `name` - Configuration name
- `type` - Configuration type
+- `primary` - Whether this is the primary IP configuration
 - `privateIPAddress` - Private IP address
- `privateIPAddressVersion` - IP address version (IPv4/IPv6)
- `privateIPAllocationMethod` - Private IP allocation method (Static/Dynamic)
-
-## Relationships
-
-### Incoming
-
- **NetworkInterface** → `HAS_CONFIG` → **IPConfiguration** - Parent network interface
- **Subnet** → `CONTAINS` → **IPConfiguration** - Subnet containing this IP configuration
-
-### Outgoing
-
- **IPConfiguration** → `HAS_IP` → **PublicIPAddress** - Associated public IP address (if any)
-
-## Examples
-
-```cypher
-// Find all static IP configurations
-MATCH (ip:IPConfiguration)
-WHERE ip.privateIPAllocationMethod = "Static"
-RETURN ip.name, ip.privateIPAddress, ip.privateIPAddressVersion
-```
-
-```cypher
-// Find IP configurations with public IPs
-MATCH (ip:IPConfiguration)-[:HAS_IP]->(pub:PublicIPAddress)
-RETURN ip.privateIPAddress, pub.ipAddress
-```
+- `privateIPAllocationMethod` - Private IP allocation method
+- `publicIPAddress` - Associated public IP address
@@ -1,48 +0,0 @@
-# KeyVaultCertificateValue
-
-Represents versioned Azure Key Vault certificate value objects, including certificate material and issuance policy metadata.
-
-**Labels:** `:KeyVaultCertificateValue`
-
-**Properties:**
-
- `id` - Certificate value version ID (primary key)
- `name` - Certificate name
- `cer` - Encoded certificate content
- `contentType` - Certificate content type
- `kid` - Related Key Vault key ID
- `sid` - Related Key Vault secret ID
- `x509Thumbprint` - Thumbprint value
- `x509ThumbprintHex` - Hex-encoded thumbprint
- `enabled` - Whether the certificate value is enabled
- `notBefore` - Time before which the certificate value is invalid
- `expires` - Expiration time
- `created` - Creation time
- `updated` - Last update time
- `recoverableDays` - Number of recoverable days
- `recoveryLevel` - Recovery level
- `issuerTransparency` - Certificate transparency setting from the issuer policy
- `issuerType` - Issuer certificate type
- `issuerName` - Issuer name
- `exportable` - Whether the private key is exportable
- `keyType` - Key algorithm or key type
- `secretContentType` - Content type used for the backing secret
- `keyUsage` - X.509 key usage values
- `x509SubjectName` - X.509 subject name from the policy
- `x509DnsNames` - DNS subject alternative names
- `x509Emails` - Email subject alternative names
- `x509Upns` - UPN subject alternative names
- `tags` - Certificate tags as `key:value` strings
-
-**Relationships:**
-
- `HAS_VERSION` ← KeyVaultCertificate - Parent certificate metadata node
-
-## Example Queries
-
-Find versioned Key Vault certificate values and their issuance details:
-
-```cypher
-MATCH (c:KeyVaultCertificate)-[:HAS_VERSION]->(v:KeyVaultCertificateValue)
-RETURN c.name, v.x509SubjectName, v.secretContentType, v.expires
-```
@@ -1,38 +0,0 @@
-# KeyVaultCertificate
-
-Represents Azure Key Vault certificate metadata.
-
-**Labels:** `:KeyVaultCertificate`
-
-**Properties:**
-
- `id` - Certificate ID (primary key)
- `name` - Certificate name
- `subject` - Certificate subject
- `x509Thumbprint` - Thumbprint value
- `x509ThumbprintHex` - Hex-encoded thumbprint
- `enabled` - Whether the certificate is enabled
- `notBefore` - Time before which the certificate is invalid
- `expires` - Expiration time
- `created` - Creation time
- `updated` - Last update time
- `recoverableDays` - Number of recoverable days
- `recoveryLevel` - Recovery level
- `tags` - Certificate tags as `key:value` strings
-
-**Relationships:**
-
- `HAS_CERTIFICATE` ← KeyVault - Parent Key Vault
- `HAS_VERSION` → KeyVaultCertificateValue - Versioned certificate value objects
- `MATCHES_CERT` → Certificate - Matched application or service principal certificates by thumbprint
-
-## Example Queries
-
-Find Key Vault certificates, their versions, and any matched Entra certificates:
-
-```cypher
-MATCH (kv:KeyVault)-[:HAS_CERTIFICATE]->(c:KeyVaultCertificate)
-OPTIONAL MATCH (c)-[:HAS_VERSION]->(v:KeyVaultCertificateValue)
-OPTIONAL MATCH (c)-[:MATCHES_CERT]->(cert:Certificate)
-RETURN kv.name, c.name, collect(DISTINCT v.id) AS versions, collect(DISTINCT cert.thumbprint) AS matchedThumbprints
-```
@@ -1,37 +0,0 @@
-# KeyVaultSecretValue
-
-Represents versioned Azure Key Vault secret values.
-
-**Labels:** `:KeyVaultSecretValue`
-
-**Properties:**
-
- `id` - Secret value version ID (primary key)
- `name` - Secret name
- `value` - Secret value collected from Key Vault
- `managed` - Whether Azure manages the secret
- `contentType` - Secret content type
- `kid` - Related Key Vault key ID, when present
- `enabled` - Whether the secret value is enabled
- `notBefore` - Time before which the secret value is invalid
- `expires` - Expiration time
- `created` - Creation time
- `updated` - Last update time
- `recoverableDays` - Number of recoverable days
- `recoveryLevel` - Recovery level
- `tags` - Secret tags as `key:value` strings
-
-**Relationships:**
-
- `HAS_VERSION` ← KeyVaultSecret - Parent secret metadata node
- `MATCHES_SECRET` → ClientSecret - Matched client secrets discovered during post-processing
-
-## Example Queries
-
-Find versioned Key Vault secret values and any matched client secrets:
-
-```cypher
-MATCH (s:KeyVaultSecret)-[:HAS_VERSION]->(v:KeyVaultSecretValue)
-OPTIONAL MATCH (v)-[:MATCHES_SECRET]->(c:ClientSecret)
-RETURN s.name, v.id, c.hint
-```
@@ -1,38 +0,0 @@
-# KeyVaultSecret
-
-Represents Azure Key Vault secret metadata.
-
-**Labels:** `:KeyVaultSecret`
-
-**Properties:**
-
- `id` - Secret ID (primary key)
- `name` - Secret name
- `managed` - Whether Azure manages the secret
- `contentType` - Secret content type
- `kid` - Related Key Vault key ID, when present
- `enabled` - Whether the secret is enabled
- `notBefore` - Time before which the secret is invalid
- `expires` - Expiration time
- `created` - Creation time
- `updated` - Last update time
- `recoverableDays` - Number of recoverable days
- `recoveryLevel` - Recovery level
- `tags` - Secret tags as `key:value` strings
-
-**Relationships:**
-
- `HAS_SECRET` ← KeyVault - Parent Key Vault
- `HAS_VERSION` → KeyVaultSecretValue - Versioned secret values
- `USED_BY` → WebCertificate - Web certificates backed by this secret
-
-## Example Queries
-
-Find Key Vault secrets, their versions, and any web certificates that consume them:
-
-```cypher
-MATCH (kv:KeyVault)-[:HAS_SECRET]->(s:KeyVaultSecret)
-OPTIONAL MATCH (s)-[:HAS_VERSION]->(v:KeyVaultSecretValue)
-OPTIONAL MATCH (s)-[:USED_BY]->(wc:WebCertificate)
-RETURN kv.name, s.name, collect(DISTINCT v.id) AS versions, collect(DISTINCT wc.name) AS webCertificates
-```
@@ -1,22 +0,0 @@
-# LoadBalancerBackendAddressPool
-
-Represents backend address pool objects attached to a load balancer.
-
-**Labels:** `:LoadBalancerBackendAddressPool`
-
-**Properties:**
-
- `id` - Backend address pool resource ID (primary key)
- `name` - Backend pool name
- `provisioningState` - Current provisioning state
- `type` - Azure resource type value
-
-## Relationships
-
-### Incoming
-
- **LoadBalancer** -> `HAS_BACKEND_POOL` -> **LoadBalancerBackendAddressPool** - Parent load balancer
-
-### Outgoing
-
- **LoadBalancerBackendAddressPool** -> `ASSOCIATED_WITH` -> **NetworkInterface** - Backend NIC configuration reference
@@ -1,23 +0,0 @@
-# LoadBalancerFrontendIPConfiguration
-
-Represents frontend IP configuration objects for a load balancer.
-
-**Labels:** `:LoadBalancerFrontendIPConfiguration`
-
-**Properties:**
-
- `id` - Frontend configuration resource ID (primary key)
- `name` - Frontend configuration name
- `privateIPAllocationMethod` - Private IP allocation method
- `provisioningState` - Current provisioning state
- `type` - Azure resource type value
-
-## Relationships
-
-### Incoming
-
- **LoadBalancer** -> `HAS_LB_FRONTEND` -> **LoadBalancerFrontendIPConfiguration** - Parent load balancer
-
-### Outgoing
-
- **LoadBalancerFrontendIPConfiguration** -> `HAS_IP` -> **PublicIPAddress** - Associated public IP (if present)
@@ -1,29 +0,0 @@
-# LoadBalancerRule
-
-Represents load balancing rule definitions attached to a load balancer.
-
-**Labels:** `:LoadBalancerRule`
-
-**Properties:**
-
- `id` - Rule resource ID (primary key)
- `name` - Rule name
- `protocol` - Protocol used by the rule
- `frontendPort` - Frontend listening port
- `backendPort` - Backend target port
- `allowBackendPortConflict` - Whether backend port conflict is allowed
- `disableConnectionTracking` - Whether connection tracking is disabled
- `disableOutboundSnat` - Whether outbound SNAT is disabled
- `enableConnectionTracking` - Whether connection tracking is enabled
- `enableDestinationServiceEndpoint` - Whether destination service endpoint is enabled
- `enableFloatingIP` - Whether floating IP is enabled
- `enableTcpReset` - Whether TCP reset is enabled
- `idleTimeoutInMinutes` - Idle timeout value
- `provisioningState` - Current provisioning state
- `type` - Azure resource type value
-
-## Relationships
-
-### Incoming
-
- **LoadBalancer** -> `HAS_RULE` -> **LoadBalancerRule** - Load balancer that owns the rule
@@ -1,28 +0,0 @@
-# NetAppAccountADDomain
-
-Represents an Active Directory domain configuration for an Azure NetApp Files account.
-
-**Labels:** `:NetAppAccountADDomain`
-
-**Properties:**
-
- `activeDirectoryId` - Active Directory identifier (primary key)
- `administrators` - List of administrator accounts
- `aesEncryption` - Whether AES encryption is enabled
- `allowLocalNfsUsersWithLdap` - Whether local NFS users are allowed with LDAP
- `backupOperators` - Backup operator accounts for the AD domain
- `dns` - DNS server configuration
- `domain` - Active Directory domain name
- `encryptDCConnections` - Whether domain controller connections are encrypted
- `kdcIP` - Kerberos KDC IP address
- `ldapOverTLS` - Whether LDAP over TLS is enabled
- `ldapSigning` - LDAP signing configuration
- `organizationalUnit` - Organizational unit for computer accounts
- `site` - Active Directory site name
- `smbServerName` - SMB server name
- `status` - Current status of the AD configuration
- `username` - Username for domain authentication
-
-## Relationships
-
- **NetAppAccount** → **IS_DEPLOYED** → **NetAppAccountADDomain** - AD domain where NetApp is deployed
@@ -1,16 +0,0 @@
-# NetAppVolumeMount
-
-Represents a mount target for an Azure NetApp Files volume.
-
-**Labels:** `:NetAppVolumeMount`
-
-**Properties:**
-
- `mountTargetId` - Mount target identifier (primary key)
- `fileSystemId` - File system identifier
- `ipAddress` - IP address for mounting
- `smbServerFqdn` - SMB server fully qualified domain name
-
-## Relationships
-
- **NetAppVolume** → **MOUNTS** → **NetAppVolumeMount** - Mount targets for volumes
@@ -1,6 +1,6 @@
 # NetworkPeering

-Represents virtual network peering connections (not an ARM resource itself).
+Represents virtual network peering connections.

 **Labels:** `:NetworkPeering`

@@ -8,34 +8,18 @@ Represents virtual network peering connections (not an ARM resource itself).

 - `id` - Peering ID (primary key)
 - `name` - Peering name
- `allowVirtualNetworkAccess` - Whether virtual network access is allowed
+- `type` - Peering type
 - `allowForwardedTraffic` - Whether forwarded traffic is allowed
 - `allowGatewayTransit` - Whether gateway transit is allowed
+- `allowVirtualNetworkAccess` - Whether virtual network access is allowed
+- `doNotVerifyRemoteGateway` - Whether to skip remote gateway verification
+- `peerCompleteVnets` - Whether to peer complete VNets
+- `peeringState` - Peering state
+- `peeringSyncLevel` - Peering sync level
+- `remoteAddressPrefixes` - Remote address prefixes
 - `useRemoteGateways` - Whether to use remote gateways
- `peeringState` - Current state of the peering (Connected, Disconnected, etc.)

-## Relationships
-
-### Incoming
-
- **VirtualNetwork** → `HAS_PEERING` → **NetworkPeering** - Source virtual network
-
-### Outgoing
-
- **NetworkPeering** → `PEERS_WITH` → **ArmResource** - Target virtual network
-
-## Examples
-
-```cypher
-// Find all connected peering relationships
-MATCH (vnet:VirtualNetwork)-[:HAS_PEERING]->(peering:NetworkPeering)
-WHERE peering.peeringState = "Connected"
-RETURN vnet.name, peering.name, peering.allowForwardedTraffic
-```
-
-```cypher
-// Find bidirectional peering relationships
-MATCH (vnet1:VirtualNetwork)-[:HAS_PEERING]->(p1:NetworkPeering)-[:PEERS_WITH]->(vnet2:VirtualNetwork)
-MATCH (vnet2)-[:HAS_PEERING]->(p2:NetworkPeering)-[:PEERS_WITH]->(vnet1)
-RETURN vnet1.name, vnet2.name, p1.peeringState, p2.peeringState
-```
+**Relationships:**
+- `HAS_PEERING` ← VirtualNetwork
+- `HAS_GATEWAY` → NetworkGateway
+- `PEER_TO` → VirtualNetwork
@@ -1,26 +0,0 @@
-# PrivateEndpointConnection
-
-Represents an embedded private endpoint connection object found on ARM resources.
-
-**Labels:** `:PrivateEndpointConnection`
-
-**Properties:**
-
- `id` - Private endpoint connection ID (primary key)
- `name` - Connection name
- `type` - Resource type
- `groupIds` - Target group IDs used by the connection
-
-## Relationships
-
-### Incoming
-
- **ArmResource** → `HAS_PRIVATE_ENDPOINT` → **PrivateEndpointConnection** - Parent resource references this connection object
-
-## Examples
-
-```cypher
-// Find resources with private endpoint connections
-MATCH (r:ArmResource)-[:HAS_PRIVATE_ENDPOINT]->(p:PrivateEndpointConnection)
-RETURN r.name, r.type, p.name, p.groupIds
-```
@@ -1,25 +0,0 @@
-# RegistryCredential
-
-Represents container image registry credentials associated with container groups.
-
-**Labels:** `:RegistryCredential`
-
-**Properties:**
-
- `username` - Registry username (primary key component)
- `server` - Registry server name (primary key component)
- `isDelegatedIdentity` - Whether delegated identity is used
-
-## Relationships
-
-### Outgoing
-
- **RegistryCredential** → `AUTHENTICATES` → **ContainerGroup** - Credential used to authenticate pulls for a container group
-
-## Examples
-
-```cypher
-// Find registry credentials used by container groups
-MATCH (cred:RegistryCredential)-[:AUTHENTICATES]->(cg:ContainerGroup)
-RETURN cred.server, cred.username, cred.isDelegatedIdentity, cg.name
-```
@@ -1,36 +0,0 @@
-# RunbookParameter
-
-Represents parameters defined for automation runbooks (not an ARM resource itself).
-
-**Labels:** `:RunbookParameter`
-
-**Properties:**
-
- `id` - Parameter ID (primary key)
- `name` - Parameter name
- `defaultValue` - Default value for the parameter
- `isMandatory` - Whether the parameter is mandatory
- `position` - Parameter position
- `type` - Parameter type
-
-## Relationships
-
-### Incoming
-
- **AutomationRunbook** → `HAS_PARAMETER` → RunbookParameter - Parent runbook
-
-## Examples
-
-```cypher
-// Find all mandatory parameters
-MATCH (p:RunbookParameter)
-WHERE p.isMandatory = true
-RETURN p.name, p.type, p.defaultValue
-```
-
-```cypher
-// Find runbooks with the most parameters
-MATCH (rb:AutomationRunbook)-[:HAS_PARAMETER]->(p:RunbookParameter)
-RETURN rb.name, count(p) AS parameterCount
-ORDER BY parameterCount DESC
-```
@@ -1,35 +0,0 @@
-# ServicePrincipalEndpoint
-
-Represents service principal endpoints (not an ARM resource itself).
-
-**Labels:** `:ServicePrincipalEndpoint`
-
-**Properties:**
-
- `id` - Endpoint ID (primary key)
- `type` - Endpoint type
- `uri` - Endpoint URI
- `customKeyIdentifier` - Custom key identifier
- `displayName` - Endpoint display name
- `usage` - Endpoint usage description
-
-## Relationships
-
-### Incoming
-
- **ServicePrincipal** → `HAS_ENDPOINT` → ServicePrincipalEndpoint - Parent service principal
-
-## Examples
-
-```cypher
-// Find all service principal endpoints
-MATCH (sp:ServicePrincipal)-[:HAS_ENDPOINT]->(endpoint:ServicePrincipalEndpoint)
-RETURN sp.displayName, endpoint.type, endpoint.uri, endpoint.displayName
-```
-
-```cypher
-// Find service principals with specific endpoint types
-MATCH (sp:ServicePrincipal)-[:HAS_ENDPOINT]->(endpoint:ServicePrincipalEndpoint)
-WHERE endpoint.type = "oauth2"
-RETURN sp.displayName, endpoint.uri
-```
@@ -1,14 +0,0 @@
-# StorageAccountDFS
-
-Represents Data Lake Storage Gen2 filesystems within Azure Storage Accounts.
-
-**Labels:** `:StorageAccountDFS`
-
-**Properties:**
-
- `id` - DFS filesystem ID (primary key)  
- `name` - Filesystem name
-
-**Relationships:**
- Connected from Storage Account via `HAS_DFS_FILESYSTEM` relationship
- `USED_BY` → Various services that use DFS storage (e.g., Synapse Workspaces)
@@ -1,6 +1,6 @@
 # VerifiedDomain

-Represents verified domains associated with Entra ID organizations. These are domains that have been verified as belonging to the organization.
+Represents verified domains associated with Azure AD organizations. These are domains that have been verified as belonging to the organization.

 **Labels:** `:VerifiedDomain`

@@ -1,33 +0,0 @@
-# VMExtension
-
-Represents an extension attached to an Azure virtual machine.
-
-**Labels:** `:ArmResource:VMExtension`
-
-**Properties:**
-
- `id` - Extension resource ID (primary key)
- `name` - Extension name
- `extType` - Extension type
- `location` - Resource location
- `provisioningState` - Provisioning state
- `publisher` - Extension publisher
- `autoUpgradeMinorVersion` - Auto-upgrade behavior
- `triggerForceUpgrade` - Force-upgrade trigger
- `vmType` - VM type metadata from extension settings
- `settings` - Serialized extension settings
-
-## Relationships
-
-### Incoming
-
- **VirtualMachine** → `HAS_EXTENSION` → **VMExtension** - Extension bound to a VM
- **HybridMachine** → `HAS_EXTENSION` → **VMExtension** - Extension attached to an Arc/hybrid machine
-
-## Examples
-
-```cypher
-// Find extensions by publisher across VMs
-MATCH (vm:VirtualMachine)-[:HAS_EXTENSION]->(ext:VMExtension)
-RETURN vm.name, ext.name, ext.publisher, ext.provisioningState
-```
@@ -1,15 +0,0 @@
-# VMRunCommandParameter
-
-Represents a parameter for a virtual machine run command.
-
-**Labels:** `:VMRunCommandParameter`
-
-**Properties:**
-
- `name` - Parameter name (composite key with `commandId`)
- `commandId` - Parent run command ID (composite key)
- `value` - Parameter value
-
-## Relationships
-
- **VMRunCommand** → **HAS_PARAMETER** → **VMRunCommandParameter** - Parameters for run commands
@@ -1,33 +0,0 @@
-# VMRunCommand
-
-Represents a run command resource associated with a virtual machine.
-
-**Labels:** `:VMRunCommand`
-
-**Properties:**
-
- `id` - Run command resource ID (primary key)
- `asyncExecution` - Whether execution is asynchronous
- `runAsUser` - User context used to run command
- `timeoutInSeconds` - Command timeout
- `treatFailureAsDeploymentFailure` - Failure handling behavior
- `script` - Script body
-
-## Relationships
-
-### Incoming
-
- **VirtualMachine** → `HAS_RUN_COMMAND` → **VMRunCommand** - VM run-command association
-
-### Outgoing
-
- **VMRunCommand** → `HAS_PARAMETER` → **VMRunCommandParameter** - Parameters bound to the run command
-
-## Examples
-
-```cypher
-// Find VM run commands and parameters
-MATCH (vm:VirtualMachine)-[:HAS_RUN_COMMAND]->(cmd:VMRunCommand)
-OPTIONAL MATCH (cmd)-[:HAS_PARAMETER]->(p:VMRunCommandParameter)
-RETURN vm.name, cmd.id, collect(p.name) AS parameterNames
-```
@@ -18,4 +18,4 @@ Base properties inherited by all Azure Resource Manager resources.
 - `tags` - Resource tags as key:value pairs

 **Relationships:**
- `HAS_IDENTITY` → GraphObject (for managed identities)
+- `HAS_IDENTITY` → GraphObject (for managed identities)
@@ -1,41 +0,0 @@
-# AnalysisServiceServer
-
-Represents Azure Analysis Services server resources.
-
-**Labels:** `:ArmResource:AnalysisServiceServer`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `managedMode` - Indicates whether the server is managed
- `serverFullName` - Full server name
- `serverMonitorMode` - Monitoring mode for the server
- `state` - Current state of the server
- `administrators` - Raw administrator member entries from the resource
- `enablePowerBIService` - Whether Power BI service access is enabled
-
-## Relationships
-
-### Incoming
-
- **GraphServicePrincipal** → `IS_ADMIN` → **AnalysisServiceServer** - Service principal listed as administrator
- **GraphObject** → `IS_ADMIN` → **AnalysisServiceServer** - Directory object listed as administrator
- **GraphUser** → `IS_ADMIN` → **AnalysisServiceServer** - User listed as administrator
-
-### Outgoing
-
- **AnalysisServiceServer** → `HAS_RULE` → **AnalysisServiceFirewallRule** - Firewall rules defined on the server
-
-## Examples
-
-```cypher
-// Find Analysis Services servers and administrator principals
-MATCH (admin)-[:IS_ADMIN]->(s:AnalysisServiceServer)
-RETURN s.serverFullName, labels(admin), admin
-```
-
-```cypher
-// Find Analysis Services servers and their firewall rules
-MATCH (s:AnalysisServiceServer)-[:HAS_RULE]->(r:AnalysisServiceFirewallRule)
-RETURN s.serverFullName, r.name, r.rangeStart, r.rangeEnd
-```
@@ -1,39 +0,0 @@
-# ApimService
-
-Represents Azure API Management Service instances.
-
-**Labels:** `:ArmResource:ApimService`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `createdAt` - Creation timestamp
- `developerPortalStatus` - Developer portal status
- `developerPortalUrl` - Developer portal URL
- `gatewayRegionalUrl` - Gateway regional URL
- `gatewayUrl` - Gateway URL
- `legacyPortalStatus` - Legacy portal status
- `managementApiUrl` - Management API URL
- `outboundPublicIpAddresses` - Outbound public IP addresses
- `portalUrl` - Portal URL
- `publicIpAddresses` - Public IP addresses
- `publicNetworkAccess` - Public network access setting
- `publisherEmail` - Publisher email
- `publisherName` - Publisher name
- `publisherChannel` - Publisher channel
- `scmUrl` - SCM URL
-
-## Relationships
-
-### Outgoing
-
- **Tenant** → `MANAGES` → **Tenant** - Managed by tenant relationship (from managed tenants)
-
-## Examples
-
-```cypher
-// Find APIM services with public access
-MATCH (a:ApimService)
-WHERE a.publicNetworkAccess = 'Enabled'
-RETURN a.name, a.gatewayUrl, a.publisherName
-```
@@ -1,17 +0,0 @@
-# AppBuilder
-
-Represents Azure App Builders resources.
-
-**Labels:** `:ArmResource:AppBuilder`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
-
-## Examples
-
-```cypher
-// List App Builders
-MATCH (b:AppBuilder)
-RETURN b.id
-```
@@ -1,29 +0,0 @@
-# AppManagedEnvironment
-
-Represents Azure Container App managed environments.
-
-**Labels:** `:ArmResource:AppManagedEnvironment`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `daprAIConnectionString` - Dapr Application Insights connection string
- `defaultDomain` - Default domain for the environment
- `eventStreamEndpoint` - Event stream endpoint
- `infrastructureResourceGroup` - Backing infrastructure resource group
- `mtls` - Mutual TLS enabled
- `encryption` - Peer traffic encryption enabled
- `staticIp` - Static IP assigned to the environment
-
-## Relationships
-
-### Outgoing
- **AppManagedEnvironment** → `DEPLOYS` → **ContainerApp** - Container Apps deployed into this environment
-
-## Examples
-
-```cypher
-// Find environments and their apps
-MATCH (env:AppManagedEnvironment)-[:DEPLOYS]->(app:ContainerApp)
-RETURN env.defaultDomain, collect(app.fqdn) AS apps
-```
@@ -1,41 +0,0 @@
-# ContainerApp
-
-Represents Azure Container Apps.
-
-**Labels:** `:ArmResource:ContainerApp`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `runningStatus` - Current running status
- `allowInsecure` - Allow insecure ingress
- `fqdn` - Fully qualified domain name
- `clientCertificateMode` - Client certificate mode for ingress
- `external` - External ingress enabled
- `exposedPort` - Exposed ingress port
- `targetPort` - Target application port
- `secretNames` - Secret names referenced by the app
-
-## Relationships
-
-### Incoming
- **AppManagedEnvironment** → `DEPLOYS` → **ContainerApp** - Deployment into a managed environment
-
-### Outgoing
- **ContainerApp** → `CAN_ACCESS_REGISTRY` → **ContainerRegistry** - Registry access for image pulls (with identity/secret details)
- **ContainerRegistry** → `CONTAINS_IMAGE` → **ContainerImage** - Images referenced by this app (by registry server and image string)
- **ContainerImage** → `HAS_ENVVAR` → **EnvVar** - Environment variables defined on containers
-
-## Examples
-
-```cypher
-// Container Apps and their registries
-MATCH (app:ContainerApp)-[r:CAN_ACCESS_REGISTRY]->(acr:ContainerRegistry)
-RETURN app.fqdn, acr.loginServer, r.identity, r.username, r.passwordSecretRef
-```
-
-```cypher
-// Container Apps with images and env vars
-MATCH (acr:ContainerRegistry)-[:CONTAINS_IMAGE]->(img:ContainerImage)-[:HAS_ENVVAR]->(e:EnvVar)
-RETURN acr.loginServer, img.name, collect({name: e.name, value: e.value, secretRef: e.secretRef}) AS env
-```
@@ -1,24 +0,0 @@
-# AppConfigurationStore
-
-Represents Azure App Configuration Stores.
-
-**Labels:** `:ArmResource:AppConfigurationStore`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `creationDate` - Creation date
- `endpoint` - Configuration store endpoint
- `disableLocalAuth` - Whether local authentication is disabled
- `enablePurgeProtection` - Whether purge protection is enabled
- `softDeleteRetentionInDays` - Soft delete retention period in days
- `defaultKeyValueRevisionRetentionPeriodInSeconds` - Default key-value revision retention period in seconds
-
-## Examples
-
-```cypher
-// Find App Configuration stores with local auth enabled
-MATCH (ac:AppConfigurationStore)
-WHERE ac.disableLocalAuth = false OR ac.disableLocalAuth IS NULL
-RETURN ac.name, ac.endpoint
-```
@@ -9,25 +9,3 @@ Represents Azure Automation accounts.
 - `id` - Automation account resource ID (primary key)
 - `creationTime` - Account creation timestamp
 - `lastModifiedTime` - Last modification timestamp
- `registrationUrl` - Registration URL for the automation account
- `automationHybridServiceUrl` - Automation hybrid service URL
-
-## Relationships
-
-### Outgoing
-
- **AutomationAccount** → `HAS_RUNBOOK` → **AutomationRunbook** - Runbooks in this automation account
-
-## Examples
-
-```cypher
-// Find all automation accounts
-MATCH (aa:AutomationAccount)
-RETURN aa.name, aa.creationTime, aa.registrationUrl
-```
-
-```cypher
-// Find automation accounts and their runbooks
-MATCH (aa:AutomationAccount)-[:HAS_RUNBOOK]->(rb:AutomationRunbook)
-RETURN aa.name, rb.name, rb.runbookType
-```
@@ -1,41 +0,0 @@
-# AutomationRunbook
-
-Represents Azure Automation runbooks.
-
-**Labels:** `:ArmResource:AutomationRunbook`
-
-**Properties:**
-
- `id` - Automation runbook resource ID (primary key)
- `creationTime` - Runbook creation timestamp
- `lastModifiedTime` - Last modification timestamp
- `description` - Runbook description
- `jobCount` - Number of jobs for this runbook
- `runbookType` - Type of runbook (e.g., PowerShell, Python)
- `state` - Current state of the runbook
- `runtimeEnvironment` - Runtime environment for the runbook
-
-## Relationships
-
-### Outgoing
-
- `HAS_PARAMETER` → **RunbookParameter** - Parameters defined for this runbook
-
-### Incoming
-
- **AutomationAccount** → `HAS_RUNBOOK` → AutomationRunbook - Parent automation account
-
-## Examples
-
-```cypher
-// Find all PowerShell runbooks
-MATCH (rb:AutomationRunbook)
-WHERE rb.runbookType = "PowerShell"
-RETURN rb.name, rb.description, rb.state
-```
-
-```cypher
-// Find runbooks with their parameters
-MATCH (rb:AutomationRunbook)-[:HAS_PARAMETER]->(p:RunbookParameter)
-RETURN rb.name, collect(p.name) AS parameters
-```
@@ -11,6 +11,6 @@ Azure Management Groups provide a way to efficiently manage access, policies, an

 ## Relationships

- `Tenant` → `CONTAINS` → `ManagementGroup` - Root management groups under tenants
- `ManagementGroup` → `CONTAINS` → `ManagementGroup` - Parent-child management group hierarchy
- `ManagementGroup` → `CONTAINS` → `Subscription` - Management groups containing subscriptions
+- `Tenant` → `HAS_ENTITY` → `ManagementGroup` - Root management groups under tenants
+- `ManagementGroup` → `HAS_ENTITY` → `ManagementGroup` - Parent-child management group hierarchy
+- `ManagementGroup` → `HAS_SUBSCRIPTION` → `Subscription` - Management groups containing subscriptions
@@ -13,4 +13,4 @@ Represents Azure resource groups - logical containers for Azure resources.
 - `subscriptionId` - Parent subscription ID

 **Relationships:**
- `CONTAINS` → Various ARM resources
+- `HAS_RESOURCE` → Various ARM resources
@@ -16,5 +16,5 @@ Represents Azure tenants - the top-level organizational units in Azure.
 - `tenantType` - Tenant type

 **Relationships:**
- `CONTAINS` → ManagementGroup
+- `CONTAINS` → Subscription
 - `ASSOCIATED_WITH` → GraphOrg (bidirectional)
@@ -1,13 +0,0 @@
-# B2CDirectory
-
-Represents Azure Active Directory B2C directories.
-
-**Labels:** `:ArmResource:B2CDirectory`
-
-**Properties:**
-
- `id` - B2C directory resource ID (primary key)
- `tenantId` - Associated tenant ID
-
-**Relationships:**
- `ASSOCIATED_WITH` → Tenant
@@ -1,39 +0,0 @@
-# AzureStackEdgeMachine
-
-Represents Azure Stack HCI edge machine resources.
-
-**Labels:** `:ArmResource:AzureStackEdgeMachine`
-
-**Properties:**
-
- `id` - Edge machine resource ID (primary key)
- `arcMachineResourceGroupId` - Resource group ID of the associated Arc machine
- `arcMachineResourceId` - Resource ID of the associated Arc machine
- `cloudId` - Cloud identifier this edge machine is registered with
- `connectivityStatus` - Connectivity status of the edge machine
- `devicePoolResourceId` - Device pool resource ID
- `edgeMachineKind` - Kind/type of edge machine
- `lastUpdated` - Last update timestamp
- `lastSyncTimestamp` - Last synchronization timestamp
- `machineState` - Current machine state
-
-## Relationships
-
-### Outgoing
-
- **AzureStackEdgeMachine** → `REGISTERED_BY` → **GraphObject** - Identity that registered this edge machine
- **AzureStackEdgeMachine** → `HAS_NIC` → **AzureStackEdgeMachineNic** - Network interfaces attached to this edge machine
-
-## Examples
-
-```cypher
-// Find all edge machines and their connectivity status
-MATCH (em:AzureStackEdgeMachine)
-RETURN em.id, em.edgeMachineKind, em.connectivityStatus, em.machineState
-```
-
-```cypher
-// Find edge machines and their network interfaces
-MATCH (em:AzureStackEdgeMachine)-[:HAS_NIC]->(nic:AzureStackEdgeMachineNic)
-RETURN em.id, nic.adapterName, nic.ip4Address, nic.macAddress
-```
@@ -1,30 +0,0 @@
-# AzureStackRegistration
-
-Represents Azure Stack registration resources, which link on-premises Azure Stack hardware to an Azure subscription.
-
-**Labels:** `:ArmResource:AzureStackRegistration`
-
-**Properties:**
-
- `id` - Registration resource ID (primary key)
- `cloudId` - Cloud identifier for the registered Azure Stack
-
-## Relationships
-
-### Outgoing
-
- **AzureStackRegistration** → `REGISTERED_BY` → **GraphObject** - Identity that registered this Azure Stack
-
-## Examples
-
-```cypher
-// Find all Azure Stack registrations
-MATCH (r:AzureStackRegistration)
-RETURN r.id, r.cloudId
-```
-
-```cypher
-// Find registrations and who registered them
-MATCH (r:AzureStackRegistration)-[:REGISTERED_BY]->(obj:GraphObject)
-RETURN r.id, r.cloudId, obj.id
-```
@@ -1,27 +0,0 @@
-# RedisCache
-
-Represents Azure Cache for Redis instances.
-
-**Labels:** `:ArmResource:RedisCache`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `hostname` - Host name
- `disableAccessKeyAuthentication` - Whether access key authentication is disabled
- `enableNonSslPort` - Whether non-SSL port is enabled
- `minimumTlsVersion` - Minimum TLS version
- `port` - Redis port
- `sslPort` - Redis SSL port
- `redisVersion` - Redis version
- `updateChannel` - Update channel
- `instancePorts` - List of SSL ports for instances
-
-## Examples
-
-```cypher
-// Find Redis caches with non-SSL port enabled
-MATCH (r:RedisCache)
-WHERE r.enableNonSslPort = true
-RETURN r.name, r.hostname, r.minimumTlsVersion
-```
@@ -1,16 +0,0 @@
-# AfdEndpoint
-
-Represents Azure Front Door (AFD) endpoints within CDN profiles.
-
-**Labels:** `:ArmResource:AfdEndpoint`
-
-**Properties:**
-
- `id` - AFD endpoint resource ID (primary key)
- `deploymentStatus` - Current deployment status of the endpoint
- `hostName` - Host name of the endpoint
- `enabledState` - Whether the endpoint is enabled or disabled
- `enforceMtls` - Whether mutual TLS is enforced
-
-**Relationships:**
- Connected to CDN Profile via `HAS_ENDPOINT` relationship (reverse direction)
@@ -1,15 +0,0 @@
-# CdnProfile
-
-Represents Azure Content Delivery Network (CDN) profiles.
-
-**Labels:** `:ArmResource:CdnProfile`
-
-**Properties:**
-
- `id` - CDN profile resource ID (primary key)
- `frontDoorId` - Front Door ID (if applicable)
- `resourceState` - Current state of the CDN profile
- `sku` - SKU/pricing tier of the CDN profile
-
-**Relationships:**
- `HAS_ENDPOINT` → AfdEndpoint (for Azure Front Door endpoints)
@@ -1,19 +0,0 @@
-# ComputeImage
-
-Represents a compute image resource that can be used to create virtual machines.
-
-**Labels:** `:ArmResource`, `:ComputeImage`
-
-**Properties:**
-
- `id` - Resource identifier (primary key)
- `hyperVGeneration` - Hyper-V generation of the image
- `provisioningState` - Current provisioning state
- `blobUri` - URI of the blob containing the image (when applicable)
- `osType` - Operating system type (Linux/Windows)
- `osState` - Operating system state (Generalized/Specialized)
- `diskSizeGB` - Size of the disk in gigabytes
-
-## Relationships
-
- **HAS_SOURCE** → **VirtualMachine** - Links to the source virtual machine if the image was created from a VM
@@ -1,26 +0,0 @@
-# DiskEncryptionSet
-
-Represents Azure Disk Encryption Sets (DES).
-
-**Labels:** `:ArmResource:DiskEncryptionSet`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `activeKey` - Active key URL
- `encryptionType` - Encryption type
- `lastKeyRotationTimestamp` - Last key rotation time
- `rotationToLatestKeyVersionEnabled` - Automatic rotation enabled
-
-## Relationships
-
-### Outgoing
- **DiskEncryptionSet** → `USES_KEY_VAULT` → **KeyVault** - Key Vault that holds the active key
-
-## Examples
-
-```cypher
-// DES with their Key Vaults
-MATCH (des:DiskEncryptionSet)-[:USES_KEY_VAULT]->(kv:KeyVault)
-RETURN des.id, kv.vaultUri, des.activeKey
-```
@@ -10,15 +10,8 @@ Represents Azure managed disks.
 - `diskSizeGB` - Disk size in GB
 - `diskState` - Current disk state
 - `osType` - OS type (if OS disk)
- `hyperVGeneration` - Hyper-V generation
 - `networkAccessPolicy` - Network access policy
 - `publicNetworkAccess` - Public network access setting
- `timeCreated` - Creation timestamp
- `uniqueId` - Unique identifier
- `fromImage` - Source image ID when created FromImage
- `sourceUri` - Source URI or resource when imported/copied

 **Relationships:**
 - `HAS_SNAPSHOT` ← Snapshot
- `HAS_SOURCE` ← StorageAccount - Source storage for Import/Copy operations
- `ENCRYPTED_BY` → DiskEncryptionSet - Encryption configuration
@@ -1,28 +0,0 @@
-# GalleryImageVersion
-
-Represents Azure Compute Gallery Image Versions.
-
-**Labels:** `:ArmResource:GalleryImageVersion`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `excludedFromLatest` - Whether excluded from latest
- `publishedDate` - Published date
- `replicaCount` - Replica count
- `storageAccountType` - Storage account type
-
-## Relationships
-
-### Outgoing
-
- **GalleryImageVersion** → `HAS_SOURCE` → **Disk** - Source OS disk image
- **GalleryImageVersion** → `HAS_SOURCE` → **ComputeImage** - Source compute image
-
-## Examples
-
-```cypher
-// Find gallery image versions and their sources
-MATCH (giv:GalleryImageVersion)-[:HAS_SOURCE]->(src)
-RETURN giv.name, giv.publishedDate, labels(src), src.id
-```
@@ -1,35 +0,0 @@
-# GalleryImage
-
-Represents Azure Compute Gallery Image definitions.
-
-**Labels:** `:ArmResource:GalleryImage`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `architecture` - CPU architecture (e.g. x64, Arm64)
- `osType` - OS type (Windows or Linux)
- `hyperVGeneration` - Hyper-V generation (V1 or V2)
- `offer` - Image offer identifier
- `publisher` - Image publisher
- `sku` - Image SKU
- `osState` - OS state (Generalized or Specialized)
- `provisioningState` - Provisioning state
-
-## Relationships
-
-### Incoming
-
- **Gallery** → `HAS_GALLERY_IMAGE` → **GalleryImage** - Parent gallery contains this image definition
-
-### Outgoing
-
- **GalleryImage** → `HAS_VERSION` → **GalleryImageVersion** - Versions of this image definition
-
-## Examples
-
-```cypher
-// Find gallery images and their parent galleries
-MATCH (g)-[:HAS_GALLERY_IMAGE]->(gi:GalleryImage)
-RETURN g.name, gi.name, gi.osType, gi.publisher, gi.offer, gi.sku
-```
@@ -7,8 +7,6 @@ Represents VM restore point collections.
 **Properties:**

 - `id` - Restore point collection resource ID (primary key)
- `restorePointCollectionId` - Collection identifier used for VM correlation

 **Relationships:**
- `HAS_RESTOREPOINTS` <- VirtualMachine (source VM)
- `HAS_INSTANCE` -> RestorePoint (instances in the collection)
+- `HAS_RESTOREPOINT` ← ArmResource (source VM)
@@ -1,14 +0,0 @@
-# RestorePoint
-
-Represents individual restore point instances inside a restore point collection.
-
-**Labels:** `:ArmResource:RestorePoint`
-
-**Properties:**
-
- `id` - Restore point ARM resource ID (primary key)
- `consistencyMode` - Snapshot consistency mode
- `timeCreated` - Time the restore point was created
-
-**Relationships:**
- `HAS_INSTANCE` <- RestorePointCollection (parent collection)
@@ -1,23 +0,0 @@
-# VMScaleSet
-
-Represents Azure Virtual Machine Scale Sets.
-
-**Labels:** `:ArmResource:VMScaleSet`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `constrainedMaximumCapacity` - Max capacity when constrained
- `orchestrationMode` - Orchestration mode (Flexible/Uniform)
- `uniqueId` - Unique identifier
- `timeCreated` - Creation timestamp
- `adminUsername` - Admin username on the VM profile
- `computerNamePrefix` - Computer name prefix for instances
-
-## Examples
-
-```cypher
-// List VMSS with orchestration mode
-MATCH (s:VMScaleSet)
-RETURN s.id, s.orchestrationMode, s.constrainedMaximumCapacity
-```
@@ -14,31 +14,4 @@ Represents Azure virtual machines.
 - `vmId` - Virtual machine ID
 - `os` - Operating system type
 - `image` - VM image offer
- `imageVersion` - VM image version
-
-## Relationships
-
-### Outgoing
-
- **VirtualMachine** → `HAS_NIC` → **NetworkInterface** - Network interfaces attached to the VM
- **VirtualMachine** → `HAS_EXTENSION` → **VMExtension** - Extensions installed on the VM
-
-## Examples
-
-```cypher
-// Find all VMs with their sizes
-MATCH (vm:VirtualMachine)
-RETURN vm.computerName, vm.vmSize, vm.os
-```
-
-```cypher
-// Find VMs and their network interfaces
-MATCH (vm:VirtualMachine)-[:HAS_NIC]->(nic:NetworkInterface)
-RETURN vm.computerName, collect(nic.name) AS networkInterfaces
-```
-
-```cypher
-// Find VMs with extensions
-MATCH (vm:VirtualMachine)-[:HAS_EXTENSION]->(ext:VMExtension)
-RETURN vm.computerName, ext.name, ext.type
-```
+- `imageVersion` - VM image version
@@ -11,7 +11,6 @@ Represents virtual machine extensions (not an ARM resource itself).
 - `type` - Extension type
 - `location` - Extension location
 - `provisioningState` - Provisioning state
- `settings` - Extension settings

 **Relationships:**
 - `HAS_EXTENSION` ← VirtualMachine
@@ -1,19 +0,0 @@
-# VMRunCommand
-
-Represents a run command associated with a virtual machine for executing scripts and commands.
-
-**Labels:** `:ArmResource`, `:VMRunCommand`
-
-**Properties:**
-
- `id` - Resource identifier (primary key)
- `asyncExecution` - Whether the command executes asynchronously
- `runAsUser` - User context for command execution
- `timeoutInSeconds` - Command execution timeout
- `treatFailureAsDeploymentFailure` - Whether command failure should be treated as deployment failure
- `script` - Script content to execute
-
-## Relationships
-
- **VirtualMachine** → **HAS_RUN_COMMAND** → **VMRunCommand** - Associated with virtual machines
- **HAS_PARAMETER** → **VMRunCommandParameter** - Contains command parameters
@@ -1,14 +0,0 @@
-# ContainerGroup
-
-Represents an Azure Container Instances container group that hosts one or more containers.
-
-**Labels:** `:ArmResource`, `:ContainerGroup`
-
-**Properties:**
-
- `id` - Resource identifier (primary key)
- `nameservers` - DNS nameservers configuration
-
-## Relationships
-
- **HAS_CONTAINER** → **Container** - Contains individual containers
@@ -17,4 +17,9 @@ Represents Azure Container Registry instances.
 - `metadataSearch` - Metadata search setting
 - `networkRuleBypassOptions` - Network rule bypass options
 - `publicNetworkAccess` - Public network access setting
- `roleAssignmentMode` - Role assignment mode
+- `createdAt` - System creation timestamp
+- `createdBy` - Created by user
+- `createdByType` - Created by type
+- `lastModifiedAt` - Last modification timestamp
+- `lastModifiedBy` - Last modified by user
+- `lastModifiedByType` - Last modified by type
@@ -1,17 +0,0 @@
-# GrafanaDashboard
-
-Represents Azure Managed Grafana instances.
-
-**Labels:** `:ArmResource:GrafanaDashboard`
-
-**Properties:**
-
- `id` - Grafana instance resource ID (primary key)
- `apiKey` - API key for the Grafana instance
- `creatorCanAdmin` - Whether the creator has admin privileges
- `deterministicOutboundIp` - Whether deterministic outbound IP is enabled
- `endpoint` - Grafana endpoint URL
- `smtpEnabled` - Whether SMTP is enabled
- `grafanaMajorVersion` - Major version of Grafana
- `grafanaVersion` - Full version of Grafana
- `publicNetworkAccess` - Public network access setting
@@ -1,28 +0,0 @@
-# DocumentDB
-
-Represents Azure Cosmos DB (DocumentDB) Database Accounts.
-
-**Labels:** `:ArmResource:DocumentDB`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `enabledApiTypes` - Enabled API types
- `documentEndpoint` - Document endpoint
- `instanceId` - Instance ID
- `networkAclBypass` - Network ACL bypass setting
- `publicNetworkAccess` - Public network access setting
- `sqlEndpoint` - SQL endpoint
- `readLocations` - List of read location endpoints
- `writeLocations` - List of write location endpoints
- `ipRules` - List of IP rules
- `isVirtualNetworkFilterEnabled` - Whether virtual network filter is enabled
-
-## Examples
-
-```cypher
-// Find Cosmos DB accounts with public access
-MATCH (db:DocumentDB)
-WHERE db.publicNetworkAccess = 'Enabled'
-RETURN db.name, db.enabledApiTypes, db.documentEndpoint
-```
@@ -1,33 +0,0 @@
-# EventGridSystemTopic
-
-Represents Azure Event Grid system topics.
-
-**Labels:** `:ArmResource:EventGridTopic`
-
-**Properties:**
-
- `id` - Event Grid system topic resource ID (primary key)
- `metricResourceId` - Metric resource identifier
- `source` - Source of the system topic
- `topicType` - Type of the system topic
-
-## Relationships
-
-### Outgoing
-
- **EventGridSystemTopic** → `HAS_SOURCE` → **ArmResource** - Source resource for the system topic
-
-## Examples
-
-```cypher
-// Find all Event Grid system topics
-MATCH (topic:EventGridTopic)
-WHERE topic.topicType IS NOT NULL
-RETURN topic.name, topic.source, topic.topicType
-```
-
-```cypher
-// Find system topics and their source resources
-MATCH (topic:EventGridTopic)-[:HAS_SOURCE]->(source:ArmResource)
-RETURN topic.name, topic.topicType, source.name
-```
@@ -1,17 +0,0 @@
-# EventHubNamespace
-
-Represents an Event Hub namespace resource for streaming and event ingestion.
-
-**Labels:** `:ArmResource`, `:EventHubNamespace`
-
-**Properties:**
-
- `id` - Resource identifier (primary key)
- `createdAt` - Timestamp when the namespace was created
- `disableLocalAuth` - Whether local authentication is disabled
- `isAutoInflateEnabled` - Whether auto-inflate is enabled for throughput units
- `kafkaEnabled` - Whether Kafka is enabled for the namespace
- `publicNetworkAccess` - Public network access configuration
- `serviceBusEndpoint` - Service Bus endpoint URL
- `status` - Current status of the namespace
- `updatedAt` - Timestamp when the namespace was last updated
@@ -1,17 +0,0 @@
-# FabricCapacity
-
-Represents Microsoft Fabric capacities.
-
-**Labels:** `:ArmResource:FabricCapacity`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `members` - Administration members list
-
-## Examples
-
-```cypher
-MATCH (c:FabricCapacity)
-RETURN c.id, c.members
-```
@@ -1,41 +1,20 @@
 # HybridExtension

-Represents extensions installed on Azure Arc-enabled hybrid machines.
+Represents extensions installed on hybrid machines (not an ARM resource itself).

-**Labels:** `:ArmResource:HybridExtension`
+**Labels:** `:HybridExtension`

 **Properties:**

- `id` - Extension resource ID (primary key)
+- `id` - Extension ID (primary key)
 - `name` - Extension name
- `type` - Resource type (`microsoft.hybridcompute/machines/extensions`)
- `location` - Resource location
- `extType` - Extension type (e.g. `CustomScriptExtension`)
+- `type` - Extension type
+- `location` - Extension location
 - `typeHandlerVersion` - Type handler version
 - `autoUpgradeMinorVersion` - Auto upgrade minor version
 - `enableAutomaticUpgrade` - Enable automatic upgrade
- `statusMessage` - Extension status message
+- `statusMessage` - Status message
 - `provisioningState` - Provisioning state
- `publisher` - Extension publisher
- `settings` - Serialized extension settings (JSON)

-## Relationships
-
-### Incoming
-
- **HybridMachine** → `HAS_EXTENSION` → **HybridExtension** - Parent hybrid machine
-
-## Examples
-
-```cypher
-// Find all hybrid machine extensions
-MATCH (hm:HybridMachine)-[:HAS_EXTENSION]->(ext:HybridExtension)
-RETURN hm.displayName, ext.name, ext.extType, ext.provisioningState
-```
-
-```cypher
-// Find extensions with auto upgrade enabled
-MATCH (ext:HybridExtension)
-WHERE ext.enableAutomaticUpgrade = true
-RETURN ext.name, ext.extType, ext.typeHandlerVersion
-```
+**Relationships:**
+- `HAS_EXTENSION` ← HybridMachine
@@ -1,23 +0,0 @@
-# HybridGateway
-
-Represents an Azure Arc gateway resource used to connect hybrid machines to Azure through a managed endpoint.
-
-**Labels:** `:ArmResource:HybridGateway`
-
-**Properties:**
-
- `id` - Gateway resource ID (primary key)
- `allowedFeatures` - Features allowed through the gateway
- `gatewayEndpoint` - Gateway endpoint URL
- `gatewayId` - Unique gateway identifier
- `gatewayType` - Type of gateway
- `lastUpdateTime` - Last update timestamp
- `provisioningState` - Provisioning state
-
-## Examples
-
-```cypher
-// Find all hybrid gateways
-MATCH (gw:HybridGateway)
-RETURN gw.id, gw.gatewayType, gw.gatewayEndpoint, gw.provisioningState
-```
@@ -1,21 +0,0 @@
-# HybridPrivateLinkScope
-
-Represents an Azure Arc private link scope resource used to connect hybrid machines over private endpoints.
-
-**Labels:** `:ArmResource:HybridPrivateLinkScope`
-
-**Properties:**
-
- `id` - Private link scope resource ID (primary key)
- `privateLinkScopeId` - Unique private link scope identifier
- `provisioningState` - Provisioning state
- `publicNetworkAccess` - Public network access setting
-
-## Examples
-
-```cypher
-// Find private link scopes with public access enabled
-MATCH (pls:HybridPrivateLinkScope)
-WHERE pls.publicNetworkAccess = "Enabled"
-RETURN pls.id, pls.privateLinkScopeId
-```
@@ -1,27 +0,0 @@
-# ActivityLogAlert
-
-Represents Azure Monitor Activity Log Alerts.
-
-**Labels:** `:ArmResource:ActivityLogAlert`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `description` - Alert description
- `enabled` - Whether the alert is enabled
- `condition` - Alert condition (JSON)
-
-## Relationships
-
-### Incoming
-
- **ArmResource** → `HAS_ALERT` → **ActivityLogAlert** - Any ARM resource in scope fires this alert
-
-## Examples
-
-```cypher
-// Find all enabled alerts and their scoped resources
-MATCH (r:ArmResource)-[:HAS_ALERT]->(a:ActivityLogAlert)
-WHERE a.enabled = true
-RETURN r.id, labels(r), a.id, a.description
-```
@@ -13,11 +13,6 @@ Represents Azure Key Vault instances.
 - `publicNetworkAccess` - Public network access setting
 - `softDeleteRetentionInDays` - Soft delete retention period
 - `vaultUri` - Key Vault URI
- `networkAclBypass` - Network ACL bypass setting
- `networkAclDefaultAction` - Network ACL default action
- `allowedIps` - Allowed IP rules

 **Relationships:**
 - `HAS_POLICY` → GraphObject (access policies for users/service principals)
- `HAS_SECRET` → KeyVaultSecret
- `HAS_CERTIFICATE` → KeyVaultCertificate
@@ -1,31 +0,0 @@
-# ManagedHSM
-
-Represents Azure Key Vault Managed HSM resources.
-
-**Labels:** `:ManagedHSM`
-
-**Properties:**
-
- `id` - Managed HSM resource ID (primary key)
- `enablePurgeProtection` - Whether purge protection is enabled
- `enableSoftDelete` - Whether soft delete is enabled
- `hsmUri` - Managed HSM URI
- `publicNetworkAccess` - Public network access setting
- `activationStatus` - Security domain activation status
- `activationStatusMessage` - Security domain activation status message
- `softDeleteRetentionInDays` - Soft delete retention period
- `statusMessage` - Service status message
-
-## Relationships
-
-### Incoming
-
- **GraphObject** → `IS_ADMIN` → **ManagedHSM** - Directory object configured as initial HSM administrator
-
-## Examples
-
-```cypher
-// Find Managed HSM resources and their administrators
-MATCH (go:GraphObject)-[:IS_ADMIN]->(hsm:ManagedHSM)
-RETURN hsm.id, hsm.hsmUri, go.id
-```
@@ -1,41 +0,0 @@
-# KustoCluster
-
-Represents Azure Data Explorer (Kusto) cluster resources.
-
-**Labels:** `:ArmResource:KustoCluster`
-
-**Properties:**
-
- `id` - Cluster resource ID (primary key)
- `acceptedAudiences` - Audiences accepted by the cluster
- `allowedFqdnList` - List of allowed fully qualified domain names
- `allowedIpRangeList` - List of allowed IP ranges
- `dataIngestionUri` - URI for data ingestion
- `enableAutoStop` - Whether auto-stop is enabled
- `enableDiskEncryption` - Whether disk encryption is enabled
- `enableDoubleEncryption` - Whether double encryption is enabled
- `enablePurge` - Whether purge is enabled
- `enableStreamingIngest` - Whether streaming ingestion is enabled
- `engineType` - Type of engine (e.g., V3)
- `publicIpType` - Type of public IP configuration
- `publicNetworkAccess` - Public network access setting
- `restrictOutboundNetworkAccess` - Whether outbound network access is restricted
- `state` - Cluster state (e.g., Running, Unavailable)
- `stateReason` - Reason for the cluster state
- `trustedExternalTenants` - List of trusted external tenant IDs
- `uri` - Cluster URI/endpoint
-
-## Examples
-
-```cypher
-// Find all Kusto clusters and their states
-MATCH (kc:KustoCluster)
-RETURN kc.id, kc.state, kc.uri, kc.enableAutoStop
-```
-
-```cypher
-// Find Kusto clusters with specific security settings
-MATCH (kc:KustoCluster)
-WHERE kc.enableDoubleEncryption = true AND kc.publicNetworkAccess = 'Disabled'
-RETURN kc.id, kc.uri
-```
@@ -1,29 +0,0 @@
-# MLWorkspace
-
-Represents Azure Machine Learning Workspaces.
-
-**Labels:** `:ArmResource:MLWorkspace`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `allowRoleAssignmentOnRG` - Allow role assignment on resource group
- `creationTime` - Creation time
- `discoveryUrl` - Discovery URL
- `friendlyName` - Friendly name
- `networkAclBypass` - Network ACL bypass setting
- `networkAclDefaultAction` - Network ACL default action
- `notebookInfoFqdn` - Notebook info FQDN
- `isPrivateLinkEnabled` - Whether private link is enabled
- `publicNetworkAccess` - Public network access setting
- `softDeleteEnabled` - Whether soft delete is enabled
- `tenantId` - Tenant ID
-
-## Examples
-
-```cypher
-// Find ML workspaces with public network access
-MATCH (ml:MLWorkspace)
-WHERE ml.publicNetworkAccess = 'Enabled'
-RETURN ml.name, ml.friendlyName
-```
@@ -1,19 +0,0 @@
-# NetAppAccount
-
-Represents an Azure NetApp Files account for managing file storage pools and volumes.
-
-**Labels:** `:ArmResource`, `:NetAppAccount`
-
-**Properties:**
-
- `id` - Resource identifier (primary key)
- `multiADStatus` - Status of multi-Active Directory configuration
- `provisioningState` - Current provisioning state
- `encryptionKeySource` - Source of encryption keys
-
-## Relationships
-
- **IS_DEPLOYED** → **NetAppAccountADDomain** - Links to Active Directory domain configurations
- **CONTAINS** → **NetAppCapacityPool** - Contains capacity pools
- **HAS_BACKUP_VAULT** → **NetAppBackupVault** - Associated backup vaults
- **HAS_POLICY** → **NetAppSnapshotPolicy** - Associated snapshot policies
@@ -1,14 +0,0 @@
-# NetAppBackupVault
-
-Represents a backup vault for Azure NetApp Files account backups.
-
-**Labels:** `:ArmResource`, `:NetAppBackupVault`
-
-**Properties:**
-
- `id` - Resource identifier (primary key)
- `provisioningState` - Current provisioning state
-
-## Relationships
-
- **NetAppAccount** → **HAS_BACKUP_VAULT** → **NetAppBackupVault** - Associated backup vault for the NetApp account
@@ -1,19 +0,0 @@
-# NetAppCapacityPool
-
-Represents a capacity pool within an Azure NetApp Files account for managing storage capacity and performance tiers.
-
-**Labels:** `:ArmResource`, `:NetAppCapacityPool`
-
-**Properties:**
-
- `id` - Resource identifier (primary key)
- `coolAccess` - Whether cool access tier is enabled
- `encryptionType` - Type of encryption applied
- `poolId` - Unique pool identifier
- `qosType` - Quality of Service type (Auto/Manual)
- `size` - Size of the capacity pool in bytes
-
-## Relationships
-
- **NetAppAccount** → **CONTAINS** → **NetAppCapacityPool** - Contained within NetApp accounts
- **CONTAINS** → **NetAppVolume** - Contains volumes
@@ -1,27 +0,0 @@
-# NetAppSnapshotPolicy
-
-Represents a snapshot policy for Azure NetApp Files volumes that defines automated backup schedules.
-
-**Labels:** `:ArmResource`, `:NetAppSnapshotPolicy`
-
-**Properties:**
-
- `id` - Resource identifier (primary key)
- `enabled` - Whether the policy is enabled
- `dailyScheduleHour` - Hour for daily snapshots
- `dailyScheduleMinute` - Minute for daily snapshots
- `dailyScheduleSnapshotsToKeep` - Number of daily snapshots to retain
- `hourlyScheduleMinute` - Minute for hourly snapshots
- `hourlyScheduleSnapshotsToKeep` - Number of hourly snapshots to retain
- `weeklyScheduleDay` - Day of week for weekly snapshots
- `weeklyScheduleHour` - Hour for weekly snapshots
- `weeklyScheduleMinute` - Minute for weekly snapshots
- `weeklyScheduleSnapshotsToKeep` - Number of weekly snapshots to retain
- `monthlyScheduleDaysOfMonth` - Days of month for monthly snapshots
- `monthlyScheduleHour` - Hour for monthly snapshots
- `monthlyScheduleMinute` - Minute for monthly snapshots
- `monthlyScheduleSnapshotsToKeep` - Number of monthly snapshots to retain
-
-## Relationships
-
- **NetAppAccount** → **HAS_POLICY** → **NetAppSnapshotPolicy** - Associated with NetApp accounts
@@ -1,34 +0,0 @@
-# NetAppVolume
-
-Represents a volume within an Azure NetApp Files capacity pool.
-
-**Labels:** `:ArmResource`, `:NetAppVolume`
-
-**Properties:**
-
- `id` - Resource identifier (primary key)
- `baremetalTenantId` - Bare metal tenant identifier
- `coolAccess` - Cool access configuration
- `creationToken` - Unique creation token for the volume
- `enableSubvolumes` - Whether subvolumes are enabled
- `encryptionKeySource` - Source of encryption keys
- `fileSystemId` - File system identifier
- `isDefaultQuotaEnabled` - Whether default quota is enabled
- `isLargeVolume` - Whether this is a large volume
- `kerberosEnabled` - Whether Kerberos authentication is enabled
- `ldapEnabled` - Whether LDAP is enabled
- `maximumNumberOfFiles` - Maximum number of files allowed
- `protocolTypes` - Supported protocol types (NFSv3, NFSv4.1, SMB, etc.)
- `securityStyle` - Security style (Unix/NTFS/Mixed)
- `smbAccessBasedEnumeration` - SMB access-based enumeration setting
- `smbContinuouslyAvailable` - SMB continuously available setting
- `smbEncryption` - SMB encryption setting
- `smbNonBrowsable` - SMB non-browsable setting
- `snapshotDirectoryVisible` - Whether snapshot directory is visible
- `usageThreshold` - Usage threshold in bytes
- `volumeType` - Type of volume
-
-## Relationships
-
- **NetAppCapacityPool** → **CONTAINS** → **NetAppVolume** - Contained within capacity pools
- **MOUNTS** → **NetAppVolumeMount** - Associated mount targets
@@ -1,31 +0,0 @@
-# ExpressRouteCircuit
-
-Represents Azure ExpressRoute Circuit resources.
-
-**Labels:** `:ArmResource:ExpressRouteCircuit`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `allowClassicOperations` - Whether classic operations are allowed
- `allowGlobalReach` - Whether Global Reach is allowed
- `authorizationKey` - Authorization key
- `circuitProvisioningState` - Circuit provisioning state
- `serviceProviderProvisioningState` - Service provider provisioning state
- `bandwidthInMbps` - Bandwidth in Mbps
- `peeringLocation` - Peering location
- `serviceProviderName` - Service provider name
-
-## Relationships
-
-### Outgoing
-
- **ExpressRouteCircuit** → `HAS_PEERING` → **ExpressRouteCircuitPeering** - Circuit peering configurations
-
-## Examples
-
-```cypher
-// Find ExpressRoute circuits and their peerings
-MATCH (erc:ExpressRouteCircuit)-[:HAS_PEERING]->(p:ExpressRouteCircuitPeering)
-RETURN erc.name, p.peeringType, p.state, erc.bandwidthInMbps
-```
@@ -1,24 +0,0 @@
-# GitHub Network Settings
-
-Represents Azure GitHub network settings resources used to associate GitHub connectivity settings with a subnet.
-
-**Labels:** `:ArmResource:GithubNetworkSettings`
-
-**Properties:**
-
- `id` - Resource ID (primary key)
- `businessId` - GitHub business identifier associated with the network setting
-
-## Relationships
-
-### Incoming
-
- **ArmResource** → `HAS_GITHUB_SETTING` → **GithubNetworkSettings** - Subnet resource associated with this GitHub network setting
-
-## Examples
-
-```cypher
-// Find GitHub network settings and their linked subnet resources
-MATCH (sub:ArmResource)-[:HAS_GITHUB_SETTING]->(setting:GithubNetworkSettings)
-RETURN sub.id, setting.businessId
-```
@@ -1,29 +0,0 @@
-# LoadBalancer
-
-Represents Azure Load Balancer resources.
-
-**Labels:** `:ArmResource:LoadBalancer`
-
-**Properties:**
-
- `id` - Load balancer resource ID (primary key)
- `resourceGuid` - Azure-generated unique resource GUID
- `provisioningState` - Current provisioning state
-
-## Relationships
-
-### Outgoing
-
- **LoadBalancer** -> `HAS_RULE` -> **LoadBalancerRule** - Load balancing rules attached to the load balancer
- **LoadBalancer** -> `HAS_LB_FRONTEND` -> **LoadBalancerFrontendIPConfiguration** - Frontend IP configurations
- **LoadBalancer** -> `HAS_BACKEND_POOL` -> **LoadBalancerBackendAddressPool** - Backend address pools
-
-## Examples
-
-```cypher
-// Find load balancers with frontend and backend topology
-MATCH (lb:LoadBalancer)
-OPTIONAL MATCH (lb)-[:HAS_LB_FRONTEND]->(fe:LoadBalancerFrontendIPConfiguration)
-OPTIONAL MATCH (lb)-[:HAS_BACKEND_POOL]->(be:LoadBalancerBackendAddressPool)
-RETURN lb.name, count(DISTINCT fe) AS frontendCount, count(DISTINCT be) AS backendPoolCount
-```
@@ -12,27 +12,7 @@ Represents network interfaces attached to VMs.
 - `appliedDnsServers` - Applied DNS servers
 - `dnsServers` - Configured DNS servers

-## Relationships
-
-### Incoming
-
- **VirtualMachine** → `HAS_NIC` → **NetworkInterface** - VM using this network interface
-
-### Outgoing
-
- **NetworkInterface** → `HAS_NSG` → **NetworkSecurityGroup** - Associated network security group
- **NetworkInterface** → `HAS_CONFIG` → **IPConfiguration** - IP configurations
-
-## Examples
-
-```cypher
-// Find network interfaces and their VMs
-MATCH (vm:VirtualMachine)-[:HAS_NIC]->(nic:NetworkInterface)
-RETURN vm.computerName, nic.macAddress, nic.allowPort25Out
-```
-
-```cypher
-// Find network interfaces with their IP configurations
-MATCH (nic:NetworkInterface)-[:HAS_CONFIG]->(ip:IPConfiguration)
-RETURN nic.name, ip.privateIPAddress, ip.privateIPAllocationMethod
-```
+**Relationships:**
+- `HAS_CONFIG` → IPConfig
+- `HAS_NSG` → NSG (Network Security Group)
+- `HAS_NIC` ← VirtualMachine
@@ -1,12 +0,0 @@
-# NetworkWatcher
-
-Represents Azure Network Watcher resources.
-
-**Labels:** `:ArmResource:NetworkWatcher`
-
-**Properties:**
-
- `id` - Network Watcher resource ID (primary key)
- `provisioningState` - Current provisioning state
-
-No additional relationships are created for NetworkWatcher nodes by the current ingestion config.
@@ -8,32 +8,11 @@ Represents subnets within virtual networks (not an ARM resource itself).

 - `id` - Subnet ID (primary key)
 - `name` - Subnet name
- `addressPrefix` - Address prefix for the subnet
- `privateEndpointNetworkPolicies` - Private endpoint network policies setting
- `privateLinkServiceNetworkPolicies` - Private link service network policies setting
+- `type` - Subnet type
+- `addressPrefix` - Address prefix
+- `privateEndpointNetworkPolicies` - Private endpoint network policies
+- `privateLinkServiceNetworkPolicies` - Private link service network policies

-## Relationships
-
-### Incoming
-
- **VirtualNetwork** → `CONTAINS` → **Subnet** - Parent virtual network
-
-### Outgoing
-
- **Subnet** → `CONTAINS` → **IPConfiguration** - IP configurations in this subnet
- **Subnet** → `HAS_CONFIG` → **RouteTable** - Associated route table
- **Subnet** → `HAS_NSG` → **NetworkSecurityGroup** - Associated network security group
-
-## Examples
-
-```cypher
-// Find subnets and their address prefixes
-MATCH (vnet:VirtualNetwork)-[:CONTAINS]->(subnet:Subnet)
-RETURN vnet.name, subnet.name, subnet.addressPrefix
-```
-
-```cypher
-// Find subnets with route tables
-MATCH (subnet:Subnet)-[:HAS_CONFIG]->(rt:RouteTable)
-RETURN subnet.name, rt.name
-```
+**Relationships:**
+- `HAS_SUBNET` ← VirtualNetwork
+- `CONTAINS` → IPConfig
Author	SHA1	Message	Date
Leron Gray	fbb5f4fa7d	update dist config	2025-12-09 11:50:48 -06:00
Leron Gray	002de154fd	update dist 0.30.2	2025-12-09 11:43:17 -06:00
Leron Gray	646f3049a7	bump v0.3.5	2025-12-09 11:20:58 -06:00
Leron Gray	4b64b8bb94	Access token audience fix (#24 ) * push v0.3.4 (#23) * add dns analysis (#21) * revise enrichment (#22) * fix return on storage key ingest * fix system managed identity null check * bump 0.3.4 * fix access token audience	2025-12-09 11:16:02 -06:00
Leron Gray	9c9b2297bb	bump 0.3.4	2025-11-10 16:29:03 -06:00
Leron Gray	fa7a743294	fix system managed identity null check	2025-11-10 16:27:56 -06:00
Leron Gray	4b51181ae9	fix return on storage key ingest	2025-09-29 11:37:19 -05:00
Leron Gray	8bfe537ed0	revise enrichment (#22 )	2025-09-19 12:18:30 -07:00
Leron Gray	e05a2692fc	add dns analysis (#21 )	2025-09-10 13:48:15 -07:00
Leron Gray	48a4257758	release v0.3.3	2025-09-08 15:58:37 -05:00
Leron Gray	8152c1a803	Add graph limiting (#20 ) * fix mg container, ua clientId check * add retry logic * reorder retry logic for arm and graph * add log limiting * Add graph timeout handling	2025-09-08 13:57:23 -07:00
Leron Gray	b5592e5551	release v0.3.2	2025-08-27 15:36:03 -07:00
Leron Gray	b8a4a15fd3	fix availability and UA labels (#19 )	2025-08-27 15:32:57 -07:00
Leron Gray	0218cb6c1a	bump v0.3.1	2025-08-18 16:31:24 -05:00
Leron Gray	64fe3edb45	fix userassigned MI parsing	2025-08-18 16:29:53 -05:00
Leron Gray	2b84dcb186	bump v0.3.0	2025-08-18 14:20:53 -05:00
Leron Gray	84e500a534	prep for v0.3.0 (#18 ) * Features/more nodes (#15) * way more nodes update * update docs * update more docs * add arc sql db * fix cypher syntaxes * add management groups (#16)	2025-08-18 12:19:05 -07:00
Leron Gray	646dddfc3c	Update neodash_config.json (#17 )	2025-08-18 12:12:05 -07:00
Leron Gray	bd9c8ab732	rename cirro-ingest to cirro-graph (#14 )	2025-08-11 18:33:50 -07:00
Leron Gray	2d58287efb	add spn endpoints and app fidc (#13 )	2025-08-05 00:37:15 -07:00
Leron Gray	5f0e9c8210	release: v0.2.0	2025-07-31 03:19:41 -05:00
Leron Gray	8c4ae18c7e	push V0.2.0 changes (#12 ) * add graphpolicy node type * add GraphAppRole node * refactor cypher queries with call	2025-07-31 01:16:52 -07:00
Leron Gray	e09a5fdbfd	add graph org node (#11 )	2025-07-30 15:53:12 -07:00
Leron Gray	f1f230d428	update cirro-roadrecon comparison	2025-07-29 12:16:44 -05:00
Leron Gray	b8328dbe78	Merge branch 'main' of https://github.com/BishopFox/cirro	2025-07-29 12:10:06 -05:00
Leron Gray	5d30683270	add FAQ to docs	2025-07-29 12:09:50 -05:00
Leron Gray	0aecfec3d2	Update neodash_config.json (#10 )	2025-07-28 10:19:44 -07:00
Leron Gray	061bbec076	release: v0.1.1	2025-07-28 12:03:05 -05:00
Leron Gray	250bbcf1a6	fix neo4j ingest bugs (#9 ) * fix neo4j ingest bugs and some labels * update docs	2025-07-28 09:52:10 -07:00
Leron Gray	ee1f295176	remove old doc files (#8 ) * first docs update * center logo * move projects into src * major docs push * add docs ci * update docs ci * remove unnecessary doc files	2025-07-25 09:46:40 -07:00
Leron Gray	2fc39451ff	update docs ci (#7 ) * first docs update * center logo * move projects into src * major docs push * add docs ci * update docs ci	2025-07-25 08:44:22 -07:00
Leron Gray	205739584c	Documentation (#6 ) * first docs update * center logo * move projects into src * major docs push * add docs ci	2025-07-25 08:38:09 -07:00
Leron Gray	fecf7ea536	Documentation (#5 ) * first docs update * center logo * move projects into src * major docs push	2025-07-24 15:52:20 -07:00
Leron Gray	24fe11b7c2	documentation changes (#4 ) * first docs update * center logo * move projects into src	2025-07-24 07:04:53 -07:00
Leron Gray	e6c0e29584	README cleanup	2025-07-23 17:37:42 -05:00
Leron Gray	043f24f9be	add dist build	2025-07-23 17:17:50 -05:00
Leron Gray	c1ec9c6f85	neodash and other updates	2025-07-23 15:48:02 -05:00
Leron Gray	80b0851906	fix network interface, subnet, etc	2025-07-18 00:22:39 -05:00
Leron Gray	c981011bae	update post process queries	2025-07-17 23:01:49 -05:00
Leron Gray	7705a7e9dc	lowercase id fields	2025-07-17 21:08:42 -05:00
Leron Gray	2feff0c07d	remove .vscode	2025-07-17 13:18:42 -05:00
Leron Gray	b5c7a5ca0f	init rust rewrite	2025-07-17 13:16:57 -05:00
Leron Gray	fca44dec8b	init rust rewrite	2025-07-17 13:15:37 -05:00