Update CHANGELOG for version 1.4.0 release date

fix(ci): use supported macOS runner for Apple Silicon releases (#40 )
Release/v1.4.0 (#39 )
2026-11-09 01:29:38 -10:00 · 2026-11-05 12:49:38 -08:00 · 2026-11-05 12:09:45 -08:00 · 2026-11-05 11:50:47 -08:00 · 2026-09-29 16:51:37 -05:00 · 2026-09-21 19:41:29 -05:00
460 changed files with 29907 additions and 10854 deletions
@@ -0,0 +1 @@
+* @BishopFox/bf-red-team
@@ -0,0 +1,153 @@
+---
+name: cirro-schema-docs
+description: Synchronize Cirro analysis documentation and mkdocs navigation with schema constants and graph config YAML files.
+---
+
+# Cirro Schema Docs Skill
+
+## Purpose
+
+Use this skill when Cirro graph config files or schema constants change and documentation must be updated to match.
+
+Primary sources of truth:
+- `src/graph/config/constants.yaml`
+- `src/graph/config/**/*.tera.yaml`
+
+Primary documentation targets:
+- `docs/analysis/**`
+- `zensical.toml` nav entries
+
+## When To Use
+
+Trigger examples:
+- sync cirro docs
+- update node and edge documentation
+- ensure docs match cirro config
+- add missing cirro documentation
+
+## Required Workflow
+
+1. Read constants.
+	- Parse `REL.*` and `LABELS.*` from `src/graph/config/constants.yaml`.
+
+2. Inventory existing docs.
+	- `docs/analysis/graph-nodes/*.md`
+	- `docs/analysis/arm-nodes/**/*.md`
+	- `docs/analysis/additional-nodes/*.md`
+	- `docs/analysis/tailscale-nodes/*.md`
+	- `docs/analysis/edges/*.md`
+	- `docs/analysis/post-processing/*.md`
+	- Also inspect the `nav:` section in `zensical.toml`.
+
+3. Scan config YAML.
+	- `src/graph/config/azure/arm/**/*.tera.yaml`
+	- `src/graph/config/azure/msgraph/*.tera.yaml`
+	- `src/graph/config/post_processing/*.tera.yaml`
+	- `src/graph/config/tailscale/**/*.tera.yaml`
+	- For each file, extract `name`, `label`, `properties`, and all relationship usage from `cypher`.
+
+4. Cross-reference and find gaps.
+	- Missing node docs from `LABELS.*`
+	- Missing edge docs from `REL.*` (convert `UPPER_SNAKE` to `lower-kebab`)
+	- Missing post-processing docs from files in `src/graph/config/post_processing/`
+	- Missing `zensical.toml` nav entries for all docs under `docs/analysis/`
+
+5. Create or update docs.
+	- Prefer minimal edits and keep style consistent with nearby files.
+	- Create missing directories before creating files.
+
+6. Update `zensical.toml` nav.
+	- Place docs in the correct analysis sections.
+	- Keep entries alphabetically sorted within each section.
+	- Preserve existing indentation and structure.
+
+7. Ask for confirmation on unused constants.
+	- If a `LABELS.*` or `REL.*` constant is not referenced by any `.tera.yaml`, ask whether to document it or treat it as deprecated.
+
+## Mapping Rules
+
+- ARM labels -> `docs/analysis/arm-nodes/<provider>/<node-name>.md`
+- Graph labels -> `docs/analysis/graph-nodes/graph-<name>.md`
+- Additional labels -> `docs/analysis/additional-nodes/<name>.md`
+- Tailscale labels -> `docs/analysis/tailscale-nodes/ts-<name>.md`
+- Edge docs -> `docs/analysis/edges/<rel-name>.md`
+- Post-processing docs -> `docs/analysis/post-processing/<step-name>.md`
+
+## Content Templates
+
+Use these as baseline structures.
+
+### Node Doc
+
+~~~markdown
+# NodeDisplayName
+
+Description of what the node represents.
+
+**Labels:** `:ArmResource:NodeLabel`
+
+**Properties:**
+- `id` - Resource ID (primary key)
+- `propertyName` - Description
+
+## Relationships
+
+### Outgoing
+- **NodeLabel** -> `REL_NAME` -> **TargetLabel** - Description
+
+## Examples
+
+```cypher
+MATCH (n:NodeLabel)
+RETURN n.name, n.property
+```
+~~~
+
+For Graph nodes, use `:GraphObject:NodeLabel` in `Labels`.
+
+### Edge Doc
+
+~~~markdown
+# REL_NAME
+
+Description of the relationship.
+
+## Usage
+- **SourceLabel** -> `REL_NAME` -> **TargetLabel** - Description
+
+## Properties
+No additional properties on the relationship.
+
+## Examples
+
+```cypher
+MATCH (a)-[r:REL_NAME]->(b)
+RETURN a.name, b.name
+```
+~~~
+
+### Post-Processing Doc
+
+~~~markdown
+# Step Display Name
+
+Description of what this post-processing step does.
+
+**Priority:** N
+
+## Details
+Explanation of the logic.
+
+## Cypher
+
+```cypher
+// Cleaned-up cypher from YAML
+```
+~~~
+
+## Guardrails
+
+- Treat YAML config and constants as source of truth.
+- Do not invent labels or relationships not present in source files.
+- Keep edits deterministic, concise, and sorted where applicable.
+- Preserve existing docs style and naming conventions.
@@ -1,41 +0,0 @@
-name: docs-deploy
-on:
-  push:
-    paths:
-      - "docs/**"
-      - "mkdocs.yml"
-      - ".github/workflows/docs-deploy.yml"
-    branches:
-      - main
-  pull_request:
-    paths:
-      - "docs/**"
-      - "mkdocs.yml"
-      - ".github/workflows/docs-deploy.yml"
-    branches:
-      - main
-    types: [closed]
-
-permissions:
-  contents: write
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Configure Git Credentials
-        run: |
-          git config user.name github-actions[bot]
-          git config user.email github-actions[bot]@users.noreply.github.com
-      - uses: actions/setup-python@v5
-        with:
-          python-version: 3.x
-      - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-      - uses: actions/cache@v4
-        with:
-          key: mkdocs-material-${{ env.cache_id }}
-          path: ~/.cache
-          restore-keys: |
-            mkdocs-material-
-      - run: pip install mkdocs-material
-      - run: mkdocs gh-deploy --force
@@ -0,0 +1,32 @@
+name: Documentation
+on:
+  push:
+    paths:
+      - "docs/**"
+      - "zensical.toml"
+      - ".github/workflows/docs.yml"
+    branches:
+      - main
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/configure-pages@v6
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: 3.x
+      - run: pip install zensical
+      - run: zensical build --clean
+      - uses: actions/upload-pages-artifact@v5
+        with:
+          path: site
+      - uses: actions/deploy-pages@v5
+        id: deployment
@@ -1,7 +1,6 @@
-# This file was autogenerated by dist: https://github.com/astral-sh/cargo-dist
+# This file was autogenerated by dist: https://axodotdev.github.io/cargo-dist
 #
 # Copyright 2022-2024, axodotdev
-# Copyright 2025 Astral Software Inc.
 # SPDX-License-Identifier: MIT or Apache-2.0
 #
 # CI that:
@@ -57,7 +56,7 @@ jobs:
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          submodules: recursive
@@ -65,9 +64,9 @@ jobs:
        # we specify bash to get pipefail; it guards against the `curl` command
        # failing. otherwise `sh` won't catch that `curl` returned non-0
        shell: bash
-        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/cargo-dist/releases/download/v0.28.6/cargo-dist-installer.sh | sh"
+        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.2/cargo-dist-installer.sh | sh"
      - name: Cache dist
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@v4
        with:
          name: cargo-dist-cache
          path: ~/.cargo/bin/dist
@@ -83,7 +82,7 @@ jobs:
          cat plan-dist-manifest.json
          echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
      - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@v4
        with:
          name: artifacts-plan-dist-manifest
          path: plan-dist-manifest.json
@@ -117,7 +116,7 @@ jobs:
      - name: enable windows longpaths
        run: |
          git config --global core.longpaths true
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          submodules: recursive
@@ -132,7 +131,7 @@ jobs:
        run: ${{ matrix.install_dist.run }}
      # Get the dist-manifest
      - name: Fetch local artifacts
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
+        uses: actions/download-artifact@v4
        with:
          pattern: artifacts-*
          path: target/distrib/
@@ -159,7 +158,7 @@ jobs:

          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
      - name: "Upload artifacts"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@v4
        with:
          name: artifacts-build-local-${{ join(matrix.targets, '_') }}
          path: |
@@ -176,19 +175,19 @@ jobs:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          submodules: recursive
      - name: Install cached dist
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
+        uses: actions/download-artifact@v4
        with:
          name: cargo-dist-cache
          path: ~/.cargo/bin/
      - run: chmod +x ~/.cargo/bin/dist
      # Get all the local artifacts for the global tasks to use (for e.g. checksums)
      - name: Fetch local artifacts
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
+        uses: actions/download-artifact@v4
        with:
          pattern: artifacts-*
          path: target/distrib/
@@ -206,7 +205,7 @@ jobs:

          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
      - name: "Upload artifacts"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@v4
        with:
          name: artifacts-build-global
          path: |
@@ -218,27 +217,27 @@ jobs:
      - plan
      - build-local-artifacts
      - build-global-artifacts
-    # Only run if we're "publishing", and only if local and global didn't fail (skipped is fine)
-    if: ${{ always() && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
+    # Only run if we're "publishing", and only if plan, local and global didn't fail (skipped is fine)
+    if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    runs-on: "ubuntu-22.04"
    outputs:
      val: ${{ steps.host.outputs.manifest }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          submodules: recursive
      - name: Install cached dist
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
+        uses: actions/download-artifact@v4
        with:
          name: cargo-dist-cache
          path: ~/.cargo/bin/
      - run: chmod +x ~/.cargo/bin/dist
      # Fetch artifacts from scratch-storage
      - name: Fetch artifacts
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
+        uses: actions/download-artifact@v4
        with:
          pattern: artifacts-*
          path: target/distrib/
@@ -251,14 +250,14 @@ jobs:
          cat dist-manifest.json
          echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
      - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@v4
        with:
          # Overwrite the previous copy
          name: artifacts-dist-manifest
          path: dist-manifest.json
      # Create a GitHub Release while uploading all files to it
      - name: "Download GitHub Artifacts"
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
+        uses: actions/download-artifact@v4
        with:
          pattern: artifacts-*
          path: artifacts
@@ -291,7 +290,7 @@ jobs:
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@v4
        with:
          persist-credentials: false
          submodules: recursive
@@ -9,7 +9,7 @@ target/

 # Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
 # More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
-Cargo.lock
+# Cargo.lock

 # These are backup files generated by rustfmt
 **/*.rs.bk
@@ -46,7 +46,11 @@ rust-project.json
 *.db
 *.db-wal
 *.db-shm
+cirro_*.json
+*_export

 *.bin
 neo4j/
-site/
+site/
+*.csv
+demo/
@@ -2,7 +2,7 @@
  "yaml.schemas": {
    "https://squidfunk.github.io/mkdocs-material/schema.json": "mkdocs.yml"
  },
-  "yaml.customTags": [ 
+  "yaml.customTags": [
    "!ENV scalar",
    "!ENV sequence",
    "!relative scalar",
@@ -10,5 +10,9 @@
    "tag:yaml.org,2002:python/name:material.extensions.emoji.twemoji",
    "tag:yaml.org,2002:python/name:pymdownx.superfences.fence_code_format",
    "tag:yaml.org,2002:python/object/apply:pymdownx.slugs.slugify mapping"
-  ]
+  ],
+  "python-envs.defaultEnvManager": "ms-python.python:system",
+  "python-envs.pythonProjects": [],
+  "rust-analyzer.cargo.target": "x86_64-pc-windows-gnu",
+  "git.addAICoAuthor": "off"
 }
@@ -0,0 +1,93 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.4.0] - 2026-11-05
+
+### Added
+
+- Restricted guest Microsoft Graph collection through service principal relationships with `--restricted-guest`.
+- Custom application ID seeds with `--restricted-appids` and an optional Microsoft application catalog with `--restricted-guest-msapps`.
+
+## [1.3.0] - 2026-09-22
+
+### Added
+
+- Add user manager and password change datetime by @daddycocoaman in [#36](https://github.com/bishopfox/cirro/pull/36)
+- Add odata types and agent id relations by @daddycocoaman in [#35](https://github.com/bishopfox/cirro/pull/35)
+
+### Changed
+
+- Process createdByAppId by @daddycocoaman in [#34](https://github.com/bishopfox/cirro/pull/34)
+
+### Fixed
+
+- Use correct base64 decoding for tokens by @daddycocoaman in [#38](https://github.com/bishopfox/cirro/pull/38)
+- Check site serverfarmid for null by @daddycocoaman in [#37](https://github.com/bishopfox/cirro/pull/37)
+
+## [1.2.1] - 2026-06-01
+
+### Fixed
+
+- Fix merges in loadbalancer by @daddycocoaman in [#33](https://github.com/bishopfox/cirro/pull/33)
+
+## [1.2.0] - 2026-05-12
+
+### Added
+
+- Add network LoadBalancer nodes and VirtualHub by @daddycocoaman in [#30](https://github.com/bishopfox/cirro/pull/30)
+- Add subject for FIC collection by @daddycocoaman in [#28](https://github.com/bishopfox/cirro/pull/28)
+- Add KustoCluster node by @daddycocoaman in [#25](https://github.com/bishopfox/cirro/pull/25)
+- Add SyntexDocumentProcessor by @daddycocoaman in [#24](https://github.com/bishopfox/cirro/pull/24)
+- Add azure stack nodes and edges by @daddycocoaman in [#23](https://github.com/bishopfox/cirro/pull/23)
+- Add oracle autonomous db by @daddycocoaman in [#22](https://github.com/bishopfox/cirro/pull/22)
+- Add multiple Hybrid nodes and parity with virtual machines by @daddycocoaman in [#21](https://github.com/bishopfox/cirro/pull/21)
+- Add ManagedHSM by @daddycocoaman in [#15](https://github.com/bishopfox/cirro/pull/15)
+- Add AnalysisServiceServer and AnalysisServiceFirewallRule by @daddycocoaman in [#14](https://github.com/bishopfox/cirro/pull/14)
+- Add composite index and constraints syntax by @daddycocoaman in [#13](https://github.com/bishopfox/cirro/pull/13)
+- Add GithubNetworkSettings by @daddycocoaman in [#12](https://github.com/bishopfox/cirro/pull/12)
+- Add dry run switch for ingest by @daddycocoaman in [#11](https://github.com/bishopfox/cirro/pull/11)
+- Add argument validation to applicable arguments by @daddycocoaman in [#10](https://github.com/bishopfox/cirro/pull/10)
+
+### Changed
+
+- Update docs by @daddycocoaman in [#31](https://github.com/bishopfox/cirro/pull/31)
+- Update cypher to Cypher 25 syntax by @daddycocoaman in [#27](https://github.com/bishopfox/cirro/pull/27)
+- Update netapp nodes by @daddycocoaman in [#26](https://github.com/bishopfox/cirro/pull/26)
+- Update docs skill for zensical by @daddycocoaman in [#20](https://github.com/bishopfox/cirro/pull/20)
+- Migrate docs to zensical by @daddycocoaman in [#19](https://github.com/bishopfox/cirro/pull/19)
+- Turn off git AI CoAuthor setting by @daddycocoaman in [#16](https://github.com/bishopfox/cirro/pull/16)
+- Update restore point changes by @daddycocoaman in [#9](https://github.com/bishopfox/cirro/pull/9)
+- Improve restorepointcollections by @daddycocoaman in [#8](https://github.com/bishopfox/cirro/pull/8)
+
+### Fixed
+
+- Re-add WITH before CALLs in Cypher  and minor bugs by @daddycocoaman in [#29](https://github.com/bishopfox/cirro/pull/29)
+- Change generic resource MI checks to CONTAINS by @daddycocoaman in [#17](https://github.com/bishopfox/cirro/pull/17)
+
+## [1.1.0] - 2026-04-13
+
+### Added
+
+- Add NetworkWatcher, KeyVaultCertificate, KeyVaultCertificateValue by @daddycocoaman in [#3](https://github.com/BishopFox/cirro/pull/3)
+- Add CODEOWNERS for bf-red-team (CLD-10728) by @grobbinsBF
+
+### Changed
+
+- Bump version to 1.1.0
+- Sync docs with schemas by @daddycocoaman
+
+### New Contributors
+* @grobbinsBF made their first contribution in [#2](https://github.com/BishopFox/cirro/pull/2)
+
+## [1.0.0] - 2026-03-31
+
+### Initial Release
+* Initial release by @daddycocoaman
+
+[1.1.0]: https://github.com/BishopFox/cirro/compare/v1.0.0...v1.1.0
+
+<!-- generated by git-cliff -->
@@ -1,8 +1,92 @@
-[workspace]
-members = ["src/cirro", "src/cirro-graph"]
-resolver = "3"
+[package]
+edition = "2024"
+name = "cirro"
+repository = "https://github.com/bishopfox/cirro"
+version = "1.4.0"
+
+[features]
+azure = ["collector"]
+collector = [
+    "dep:async-trait",
+    "dep:base64",
+    "dep:chrono",
+    "dep:dashmap",
+    "dep:futures",
+    "dep:jsonwebtoken",
+    "dep:once_cell",
+    "dep:pem",
+    "dep:regex",
+    "dep:reqwest",
+    "dep:rsa",
+    "dep:sha1",
+    "dep:which",
+]
+default = ["azure", "tailscale", "graph"]
+graph = [
+    "dep:neo4rs",
+    "dep:rayon",
+    "dep:rust-embed",
+    "dep:serde_yaml",
+    "dep:strum",
+    "dep:strum_macros",
+    "dep:tera",
+    "dep:url",
+]
+tailscale = ["collector"]
+
+[dependencies]
+# Common dependencies (shared between collection and graph)
+clap = { version = "4.5.54", features = ["cargo", "derive"] }
+colored = "3.0.0"
+fern = { version = "0.7.1", features = ["chrono"] }
+log = "0.4.27"
+rusqlite = { version = "0.37.0", features = ["bundled"] }
+serde = { version = "1.0.219", features = ["serde_derive"] }
+serde_json = "1.0.140"
+thiserror = "2.0.16"
+tokio = { version = "1.46.1", features = ["full"] }
+uuid = { version = "1.17.0", features = ["v4"] }
+
+# Collection-specific dependencies (from cirro, optional)
+async-trait = { version = "0.1.78", optional = true }
+base64 = { version = "0.22.1", optional = true }
+chrono = { version = "0.4.41", optional = true }
+dashmap = { version = "5.5.3", optional = true }
+futures = { version = "0.3.31", optional = true }
+jsonwebtoken = { version = "10.3.0", features = [
+    "use_pem",
+    "aws_lc_rs",
+], optional = true }
+once_cell = { version = "1.19.0", optional = true }
+pem = { version = "3.0.5", optional = true }
+regex = { version = "1.12.3", optional = true }
+reqwest = { version = "0.13.2", features = [
+    "json",
+    "query",
+    "form",
+    "gzip",
+    "brotli",
+], optional = true }
+rsa = { version = "0.9.8", features = ["sha1", "sha2"], optional = true }
+sha1 = { version = "0.10.6", optional = true }
+which = { version = "8.0.0", optional = true }
+
+# Graph-specific dependencies (from cirro-graph, optional)
+neo4rs = { version = "0.8.0", features = ["json"], optional = true }
+rayon = { version = "1.10", optional = true }
+rust-embed = { version = "8.11.0", features = ["compression"], optional = true }
+serde_yaml = { version = "0.9.34", optional = true }
+strum = { version = "0.27.1", optional = true }
+strum_macros = { version = "0.27.1", optional = true }
+tera = { version = "1.20.1", optional = true }
+url = { version = "2.5.7", optional = true }
+
+[profile.dev]
+debug = "line-tables-only"
+opt-level = 0

 [profile.release]
+codegen-units = 1
 lto = "thin"
 opt-level = "s"
 panic = 'abort'
@@ -10,12 +94,5 @@ strip = true

 # The profile that 'dist' will build with
 [profile.dist]
-codegen-units = 1
-debug = false
-incremental = false
 inherits = "release"
-lto = "fat"
-opt-level = 3
-overflow-checks = false
-panic = "abort"
-strip = true
+lto = "thin"
@@ -1,202 +1,595 @@
+GNU General Public License
+==========================

-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+_Version 3, 29 June 2007_  
+_Copyright © 2007 Free Software Foundation, Inc. &lt;<http://fsf.org/>&gt;_

-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+Everyone is permitted to copy and distribute verbatim copies of this license
+document, but changing it is not allowed.

-   1. Definitions.
+## Preamble

-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
+The GNU General Public License is a free, copyleft license for software and other
+kinds of works.

-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
+The licenses for most software and other practical works are designed to take away
+your freedom to share and change the works. By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change all versions of a
+program--to make sure it remains free software for all its users. We, the Free
+Software Foundation, use the GNU General Public License for most of our software; it
+applies also to any other work released this way by its authors. You can apply it to
+your programs, too.

-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
+When we speak of free software, we are referring to freedom, not price. Our General
+Public Licenses are designed to make sure that you have the freedom to distribute
+copies of free software (and charge for them if you wish), that you receive source
+code or can get it if you want it, that you can change the software or use pieces of
+it in new free programs, and that you know you can do these things.

-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
+To protect your rights, we need to prevent others from denying you these rights or
+asking you to surrender the rights. Therefore, you have certain responsibilities if
+you distribute copies of the software, or if you modify it: responsibilities to
+respect the freedom of others.

-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
+For example, if you distribute copies of such a program, whether gratis or for a fee,
+you must pass on to the recipients the same freedoms that you received. You must make
+sure that they, too, receive or can get the source code. And you must show them these
+terms so they know their rights.

-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
+Developers that use the GNU GPL protect your rights with two steps: **(1)** assert
+copyright on the software, and **(2)** offer you this License giving you legal permission
+to copy, distribute and/or modify it.

-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
+For the developers' and authors' protection, the GPL clearly explains that there is
+no warranty for this free software. For both users' and authors' sake, the GPL
+requires that modified versions be marked as changed, so that their problems will not
+be attributed erroneously to authors of previous versions.

-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
+Some devices are designed to deny users access to install or run modified versions of
+the software inside them, although the manufacturer can do so. This is fundamentally
+incompatible with the aim of protecting users' freedom to change the software. The
+systematic pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable. Therefore, we have designed
+this version of the GPL to prohibit the practice for those products. If such problems
+arise substantially in other domains, we stand ready to extend this provision to
+those domains in future versions of the GPL, as needed to protect the freedom of
+users.

-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
+Finally, every program is threatened constantly by software patents. States should
+not allow patents to restrict development and use of software on general-purpose
+computers, but in those that do, we wish to avoid the special danger that patents
+applied to a free program could make it effectively proprietary. To prevent this, the
+GPL assures that patents cannot be used to render the program non-free.

-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
+The precise terms and conditions for copying, distribution and modification follow.

-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
+## TERMS AND CONDITIONS

-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
+### 0. Definitions

-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
+“This License” refers to version 3 of the GNU General Public License.

-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
+“Copyright” also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.

-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
+“The Program” refers to any copyrightable work licensed under this
+License. Each licensee is addressed as “you”. “Licensees” and
+“recipients” may be individuals or organizations.

-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
+To “modify” a work means to copy from or adapt all or part of the work in
+a fashion requiring copyright permission, other than the making of an exact copy. The
+resulting work is called a “modified version” of the earlier work or a
+work “based on” the earlier work.

-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
+A “covered work” means either the unmodified Program or a work based on
+the Program.

-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
+To “propagate” a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for infringement under
+applicable copyright law, except executing it on a computer or modifying a private
+copy. Propagation includes copying, distribution (with or without modification),
+making available to the public, and in some countries other activities as well.

-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
+To “convey” a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user through a computer
+network, with no transfer of a copy, is not conveying.

-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
+An interactive user interface displays “Appropriate Legal Notices” to the
+extent that it includes a convenient and prominently visible feature that **(1)**
+displays an appropriate copyright notice, and **(2)** tells the user that there is no
+warranty for the work (except to the extent that warranties are provided), that
+licensees may convey the work under this License, and how to view a copy of this
+License. If the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.

-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
+### 1. Source Code

-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
+The “source code” for a work means the preferred form of the work for
+making modifications to it. “Object code” means any non-source form of a
+work.

-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
+A “Standard Interface” means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of interfaces
+specified for a particular programming language, one that is widely used among
+developers working in that language.

-   END OF TERMS AND CONDITIONS
+The “System Libraries” of an executable work include anything, other than
+the work as a whole, that **(a)** is included in the normal form of packaging a Major
+Component, but which is not part of that Major Component, and **(b)** serves only to
+enable use of the work with that Major Component, or to implement a Standard
+Interface for which an implementation is available to the public in source code form.
+A “Major Component”, in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system (if any) on which
+the executable work runs, or a compiler used to produce the work, or an object code
+interpreter used to run it.

-   APPENDIX: How to apply the Apache License to your work.
+The “Corresponding Source” for a work in object code form means all the
+source code needed to generate, install, and (for an executable work) run the object
+code and to modify the work, including scripts to control those activities. However,
+it does not include the work's System Libraries, or general-purpose tools or
+generally available free programs which are used unmodified in performing those
+activities but which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for the work, and
+the source code for shared libraries and dynamically linked subprograms that the work
+is specifically designed to require, such as by intimate data communication or
+control flow between those subprograms and other parts of the work.

-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
+The Corresponding Source need not include anything that users can regenerate
+automatically from other parts of the Corresponding Source.

-   Copyright [yyyy] [name of copyright owner]
+The Corresponding Source for a work in source code form is that same work.

-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
+### 2. Basic Permissions

-       http://www.apache.org/licenses/LICENSE-2.0
+All rights granted under this License are granted for the term of copyright on the
+Program, and are irrevocable provided the stated conditions are met. This License
+explicitly affirms your unlimited permission to run the unmodified Program. The
+output from running a covered work is covered by this License only if the output,
+given its content, constitutes a covered work. This License acknowledges your rights
+of fair use or other equivalent, as provided by copyright law.

-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+You may make, run and propagate covered works that you do not convey, without
+conditions so long as your license otherwise remains in force. You may convey covered
+works to others for the sole purpose of having them make modifications exclusively
+for you, or provide you with facilities for running those works, provided that you
+comply with the terms of this License in conveying all material for which you do not
+control copyright. Those thus making or running the covered works for you must do so
+exclusively on your behalf, under your direction and control, on terms that prohibit
+them from making any copies of your copyrighted material outside their relationship
+with you.
+
+Conveying under any other circumstances is permitted solely under the conditions
+stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
+
+### 3. Protecting Users' Legal Rights From Anti-Circumvention Law
+
+No covered work shall be deemed part of an effective technological measure under any
+applicable law fulfilling obligations under article 11 of the WIPO copyright treaty
+adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention
+of such measures.
+
+When you convey a covered work, you waive any legal power to forbid circumvention of
+technological measures to the extent such circumvention is effected by exercising
+rights under this License with respect to the covered work, and you disclaim any
+intention to limit operation or modification of the work as a means of enforcing,
+against the work's users, your or third parties' legal rights to forbid circumvention
+of technological measures.
+
+### 4. Conveying Verbatim Copies
+
+You may convey verbatim copies of the Program's source code as you receive it, in any
+medium, provided that you conspicuously and appropriately publish on each copy an
+appropriate copyright notice; keep intact all notices stating that this License and
+any non-permissive terms added in accord with section 7 apply to the code; keep
+intact all notices of the absence of any warranty; and give all recipients a copy of
+this License along with the Program.
+
+You may charge any price or no price for each copy that you convey, and you may offer
+support or warranty protection for a fee.
+
+### 5. Conveying Modified Source Versions
+
+You may convey a work based on the Program, or the modifications to produce it from
+the Program, in the form of source code under the terms of section 4, provided that
+you also meet all of these conditions:
+
+* **a)** The work must carry prominent notices stating that you modified it, and giving a
+relevant date.
+* **b)** The work must carry prominent notices stating that it is released under this
+License and any conditions added under section 7. This requirement modifies the
+requirement in section 4 to “keep intact all notices”.
+* **c)** You must license the entire work, as a whole, under this License to anyone who
+comes into possession of a copy. This License will therefore apply, along with any
+applicable section 7 additional terms, to the whole of the work, and all its parts,
+regardless of how they are packaged. This License gives no permission to license the
+work in any other way, but it does not invalidate such permission if you have
+separately received it.
+* **d)** If the work has interactive user interfaces, each must display Appropriate Legal
+Notices; however, if the Program has interactive interfaces that do not display
+Appropriate Legal Notices, your work need not make them do so.
+
+A compilation of a covered work with other separate and independent works, which are
+not by their nature extensions of the covered work, and which are not combined with
+it such as to form a larger program, in or on a volume of a storage or distribution
+medium, is called an “aggregate” if the compilation and its resulting
+copyright are not used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work in an aggregate
+does not cause this License to apply to the other parts of the aggregate.
+
+### 6. Conveying Non-Source Forms
+
+You may convey a covered work in object code form under the terms of sections 4 and
+5, provided that you also convey the machine-readable Corresponding Source under the
+terms of this License, in one of these ways:
+
+* **a)** Convey the object code in, or embodied in, a physical product (including a
+physical distribution medium), accompanied by the Corresponding Source fixed on a
+durable physical medium customarily used for software interchange.
+* **b)** Convey the object code in, or embodied in, a physical product (including a
+physical distribution medium), accompanied by a written offer, valid for at least
+three years and valid for as long as you offer spare parts or customer support for
+that product model, to give anyone who possesses the object code either **(1)** a copy of
+the Corresponding Source for all the software in the product that is covered by this
+License, on a durable physical medium customarily used for software interchange, for
+a price no more than your reasonable cost of physically performing this conveying of
+source, or **(2)** access to copy the Corresponding Source from a network server at no
+charge.
+* **c)** Convey individual copies of the object code with a copy of the written offer to
+provide the Corresponding Source. This alternative is allowed only occasionally and
+noncommercially, and only if you received the object code with such an offer, in
+accord with subsection 6b.
+* **d)** Convey the object code by offering access from a designated place (gratis or for
+a charge), and offer equivalent access to the Corresponding Source in the same way
+through the same place at no further charge. You need not require recipients to copy
+the Corresponding Source along with the object code. If the place to copy the object
+code is a network server, the Corresponding Source may be on a different server
+(operated by you or a third party) that supports equivalent copying facilities,
+provided you maintain clear directions next to the object code saying where to find
+the Corresponding Source. Regardless of what server hosts the Corresponding Source,
+you remain obligated to ensure that it is available for as long as needed to satisfy
+these requirements.
+* **e)** Convey the object code using peer-to-peer transmission, provided you inform
+other peers where the object code and Corresponding Source of the work are being
+offered to the general public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded from the
+Corresponding Source as a System Library, need not be included in conveying the
+object code work.
+
+A “User Product” is either **(1)** a “consumer product”, which
+means any tangible personal property which is normally used for personal, family, or
+household purposes, or **(2)** anything designed or sold for incorporation into a
+dwelling. In determining whether a product is a consumer product, doubtful cases
+shall be resolved in favor of coverage. For a particular product received by a
+particular user, “normally used” refers to a typical or common use of
+that class of product, regardless of the status of the particular user or of the way
+in which the particular user actually uses, or expects or is expected to use, the
+product. A product is a consumer product regardless of whether the product has
+substantial commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+“Installation Information” for a User Product means any methods,
+procedures, authorization keys, or other information required to install and execute
+modified versions of a covered work in that User Product from a modified version of
+its Corresponding Source. The information must suffice to ensure that the continued
+functioning of the modified object code is in no case prevented or interfered with
+solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or specifically for
+use in, a User Product, and the conveying occurs as part of a transaction in which
+the right of possession and use of the User Product is transferred to the recipient
+in perpetuity or for a fixed term (regardless of how the transaction is
+characterized), the Corresponding Source conveyed under this section must be
+accompanied by the Installation Information. But this requirement does not apply if
+neither you nor any third party retains the ability to install modified object code
+on the User Product (for example, the work has been installed in ROM).
+
+The requirement to provide Installation Information does not include a requirement to
+continue to provide support service, warranty, or updates for a work that has been
+modified or installed by the recipient, or for the User Product in which it has been
+modified or installed. Access to a network may be denied when the modification itself
+materially and adversely affects the operation of the network or violates the rules
+and protocols for communication across the network.
+
+Corresponding Source conveyed, and Installation Information provided, in accord with
+this section must be in a format that is publicly documented (and with an
+implementation available to the public in source code form), and must require no
+special password or key for unpacking, reading or copying.
+
+### 7. Additional Terms
+
+“Additional permissions” are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions. Additional
+permissions that are applicable to the entire Program shall be treated as though they
+were included in this License, to the extent that they are valid under applicable
+law. If additional permissions apply only to part of the Program, that part may be
+used separately under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option remove any
+additional permissions from that copy, or from any part of it. (Additional
+permissions may be written to require their own removal in certain cases when you
+modify the work.) You may place additional permissions on material, added by you to a
+covered work, for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you add to a
+covered work, you may (if authorized by the copyright holders of that material)
+supplement the terms of this License with terms:
+
+* **a)** Disclaiming warranty or limiting liability differently from the terms of
+sections 15 and 16 of this License; or
+* **b)** Requiring preservation of specified reasonable legal notices or author
+attributions in that material or in the Appropriate Legal Notices displayed by works
+containing it; or
+* **c)** Prohibiting misrepresentation of the origin of that material, or requiring that
+modified versions of such material be marked in reasonable ways as different from the
+original version; or
+* **d)** Limiting the use for publicity purposes of names of licensors or authors of the
+material; or
+* **e)** Declining to grant rights under trademark law for use of some trade names,
+trademarks, or service marks; or
+* **f)** Requiring indemnification of licensors and authors of that material by anyone
+who conveys the material (or modified versions of it) with contractual assumptions of
+liability to the recipient, for any liability that these contractual assumptions
+directly impose on those licensors and authors.
+
+All other non-permissive additional terms are considered “further
+restrictions” within the meaning of section 10. If the Program as you received
+it, or any part of it, contains a notice stating that it is governed by this License
+along with a term that is a further restriction, you may remove that term. If a
+license document contains a further restriction but permits relicensing or conveying
+under this License, you may add to a covered work material governed by the terms of
+that license document, provided that the further restriction does not survive such
+relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you must place, in
+the relevant source files, a statement of the additional terms that apply to those
+files, or a notice indicating where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the form of a
+separately written license, or stated as exceptions; the above requirements apply
+either way.
+
+### 8. Termination
+
+You may not propagate or modify a covered work except as expressly provided under
+this License. Any attempt otherwise to propagate or modify it is void, and will
+automatically terminate your rights under this License (including any patent licenses
+granted under the third paragraph of section 11).
+
+However, if you cease all violation of this License, then your license from a
+particular copyright holder is reinstated **(a)** provisionally, unless and until the
+copyright holder explicitly and finally terminates your license, and **(b)** permanently,
+if the copyright holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is reinstated permanently
+if the copyright holder notifies you of the violation by some reasonable means, this
+is the first time you have received notice of violation of this License (for any
+work) from that copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+Termination of your rights under this section does not terminate the licenses of
+parties who have received copies or rights from you under this License. If your
+rights have been terminated and not permanently reinstated, you do not qualify to
+receive new licenses for the same material under section 10.
+
+### 9. Acceptance Not Required for Having Copies
+
+You are not required to accept this License in order to receive or run a copy of the
+Program. Ancillary propagation of a covered work occurring solely as a consequence of
+using peer-to-peer transmission to receive a copy likewise does not require
+acceptance. However, nothing other than this License grants you permission to
+propagate or modify any covered work. These actions infringe copyright if you do not
+accept this License. Therefore, by modifying or propagating a covered work, you
+indicate your acceptance of this License to do so.
+
+### 10. Automatic Licensing of Downstream Recipients
+
+Each time you convey a covered work, the recipient automatically receives a license
+from the original licensors, to run, modify and propagate that work, subject to this
+License. You are not responsible for enforcing compliance by third parties with this
+License.
+
+An “entity transaction” is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an organization, or
+merging organizations. If propagation of a covered work results from an entity
+transaction, each party to that transaction who receives a copy of the work also
+receives whatever licenses to the work the party's predecessor in interest had or
+could give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if the predecessor
+has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the rights granted or
+affirmed under this License. For example, you may not impose a license fee, royalty,
+or other charge for exercise of rights granted under this License, and you may not
+initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging
+that any patent claim is infringed by making, using, selling, offering for sale, or
+importing the Program or any portion of it.
+
+### 11. Patents
+
+A “contributor” is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The work thus
+licensed is called the contributor's “contributor version”.
+
+A contributor's “essential patent claims” are all patent claims owned or
+controlled by the contributor, whether already acquired or hereafter acquired, that
+would be infringed by some manner, permitted by this License, of making, using, or
+selling its contributor version, but do not include claims that would be infringed
+only as a consequence of further modification of the contributor version. For
+purposes of this definition, “control” includes the right to grant patent
+sublicenses in a manner consistent with the requirements of this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free patent license
+under the contributor's essential patent claims, to make, use, sell, offer for sale,
+import and otherwise run, modify and propagate the contents of its contributor
+version.
+
+In the following three paragraphs, a “patent license” is any express
+agreement or commitment, however denominated, not to enforce a patent (such as an
+express permission to practice a patent or covenant not to sue for patent
+infringement). To “grant” such a patent license to a party means to make
+such an agreement or commitment not to enforce a patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license, and the
+Corresponding Source of the work is not available for anyone to copy, free of charge
+and under the terms of this License, through a publicly available network server or
+other readily accessible means, then you must either **(1)** cause the Corresponding
+Source to be so available, or **(2)** arrange to deprive yourself of the benefit of the
+patent license for this particular work, or **(3)** arrange, in a manner consistent with
+the requirements of this License, to extend the patent license to downstream
+recipients. “Knowingly relying” means you have actual knowledge that, but
+for the patent license, your conveying the covered work in a country, or your
+recipient's use of the covered work in a country, would infringe one or more
+identifiable patents in that country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or arrangement, you
+convey, or propagate by procuring conveyance of, a covered work, and grant a patent
+license to some of the parties receiving the covered work authorizing them to use,
+propagate, modify or convey a specific copy of the covered work, then the patent
+license you grant is automatically extended to all recipients of the covered work and
+works based on it.
+
+A patent license is “discriminatory” if it does not include within the
+scope of its coverage, prohibits the exercise of, or is conditioned on the
+non-exercise of one or more of the rights that are specifically granted under this
+License. You may not convey a covered work if you are a party to an arrangement with
+a third party that is in the business of distributing software, under which you make
+payment to the third party based on the extent of your activity of conveying the
+work, and under which the third party grants, to any of the parties who would receive
+the covered work from you, a discriminatory patent license **(a)** in connection with
+copies of the covered work conveyed by you (or copies made from those copies), or **(b)**
+primarily for and in connection with specific products or compilations that contain
+the covered work, unless you entered into that arrangement, or that patent license
+was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting any implied
+license or other defenses to infringement that may otherwise be available to you
+under applicable patent law.
+
+### 12. No Surrender of Others' Freedom
+
+If conditions are imposed on you (whether by court order, agreement or otherwise)
+that contradict the conditions of this License, they do not excuse you from the
+conditions of this License. If you cannot convey a covered work so as to satisfy
+simultaneously your obligations under this License and any other pertinent
+obligations, then as a consequence you may not convey it at all. For example, if you
+agree to terms that obligate you to collect a royalty for further conveying from
+those to whom you convey the Program, the only way you could satisfy both those terms
+and this License would be to refrain entirely from conveying the Program.
+
+### 13. Use with the GNU Affero General Public License
+
+Notwithstanding any other provision of this License, you have permission to link or
+combine any covered work with a work licensed under version 3 of the GNU Affero
+General Public License into a single combined work, and to convey the resulting work.
+The terms of this License will continue to apply to the part which is the covered
+work, but the special requirements of the GNU Affero General Public License, section
+13, concerning interaction through a network will apply to the combination as such.
+
+### 14. Revised Versions of this License
+
+The Free Software Foundation may publish revised and/or new versions of the GNU
+General Public License from time to time. Such new versions will be similar in spirit
+to the present version, but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program specifies that
+a certain numbered version of the GNU General Public License “or any later
+version” applies to it, you have the option of following the terms and
+conditions either of that numbered version or of any later version published by the
+Free Software Foundation. If the Program does not specify a version number of the GNU
+General Public License, you may choose any version ever published by the Free
+Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions of the GNU
+General Public License can be used, that proxy's public statement of acceptance of a
+version permanently authorizes you to choose that version for the Program.
+
+Later license versions may give you additional or different permissions. However, no
+additional obligations are imposed on any author or copyright holder as a result of
+your choosing to follow a later version.
+
+### 15. Disclaimer of Warranty
+
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER
+EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE
+QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE
+DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+### 16. Limitation of Liability
+
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY
+COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS
+PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL,
+INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE
+OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE
+WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+### 17. Interpretation of Sections 15 and 16
+
+If the disclaimer of warranty and limitation of liability provided above cannot be
+given local legal effect according to their terms, reviewing courts shall apply local
+law that most closely approximates an absolute waiver of all civil liability in
+connection with the Program, unless a warranty or assumption of liability accompanies
+a copy of the Program in return for a fee.
+
+_END OF TERMS AND CONDITIONS_
+
+## How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest possible use to
+the public, the best way to achieve this is to make it free software which everyone
+can redistribute and change under these terms.
+
+To do so, attach the following notices to the program. It is safest to attach them
+to the start of each source file to most effectively state the exclusion of warranty;
+and each file should have at least the “copyright” line and a pointer to
+where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program does terminal interaction, make it output a short notice like this
+when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type 'show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type 'show c' for details.
+
+The hypothetical commands `show w` and `show c` should show the appropriate parts of
+the General Public License. Of course, your program's commands might be different;
+for a GUI interface, you would use an “about box”.
+
+You should also get your employer (if you work as a programmer) or school, if any, to
+sign a “copyright disclaimer” for the program, if necessary. For more
+information on this, and how to apply and follow the GNU GPL, see
+&lt;<http://www.gnu.org/licenses/>&gt;.
+
+The GNU General Public License does not permit incorporating your program into
+proprietary programs. If your program is a subroutine library, you may consider it
+more useful to permit linking proprietary applications with the library. If this is
+what you want to do, use the GNU Lesser General Public License instead of this
+License. But first, please read
+&lt;<http://www.gnu.org/philosophy/why-not-lgpl.html>&gt;.
@@ -1,165 +1,161 @@
 <p align='center'><img src='docs/logo.png' alt='logo' height="400"/><br>
 </p>

-Cirro is a tool that enables security researchers and penetration testers to collect, analyze, and visualize Azure cloud environments and Entra ID relationships through graph databases.
+Cirro is an extensible security research platform that enables researchers and penetration testers to collect, analyze, and visualize cloud environments and identity relationships through graph databases. Built with a modular architecture, Cirro can be extended to support multiple platforms and data sources.

-You can check out the [Documentation](https://crispy-adventure-qre5p1k.pages.github.io/) for more info.
+You can check out the [Documentation](https://bishopfox.github.io/cirro) for more info.

 ## Features

- **Multi-source Data Collection**: Gather data from both Azure Resource Manager (ARM) APIs and Microsoft Graph APIs
- **Flexible Authentication**: Support for multiple authentication methods including Azure CLI, access tokens, client secrets, and client certificates
- **Graph Database Support**: Compatible with both **Neo4j** and **Memgraph** graph databases
- **Data Enrichment**: Additional data collection capabilities for storage accounts, containers, and blob analysis
- **Multi-cloud Support**: Works with Azure Public, China, Germany, and US Government clouds
+- **Multi-platform Data Collection**: Extensible architecture supporting multiple cloud platforms and identity providers
+- **Flexible Authentication**: Support for various authentication methods depending on the target platform
 - **Cross-platform**: Available for Windows, macOS, and Linux
+- **Modular Design**: Optional platform functionality through feature flags and extensible plugin architecture
+- **Network Topology Analysis**: Support for network infrastructure platforms like Tailscale
+- **Entra ID Enrichment**: User managers and password-change timestamps, application creators, agent identity properties, and published permission scopes
+- **Restricted Guest Collection**: Traverse accessible application relationships with built-in, custom, or Microsoft catalog seeds
+
+See the [collection guide](docs/usage/cirro.md) for usage examples and collection coverage.

 ## Architecture

-Cirro consists of two main components:
+Cirro has two main functional areas:

- **`cirro`**: The primary data collection tool that gathers information from Azure and Microsoft Graph APIs
- **`cirro-graph`**: The ingestion tool that loads collected data into graph databases (Neo4j or Memgraph)
+- **Collection (`cirro collect`)**: Gathers information from various platforms and APIs
+- **Graph Operations (`cirro graph`)**: Manages graph database operations including data ingestion and export
+
+The modular architecture uses feature flags to enable platform-specific functionality, allowing users to build only the components they need.
+
+## CLI Structure
+
+Cirro uses a hierarchical command structure organized by function and platform:
+
+```
+cirro <function> <platform> <command> [options]
+```
+
+### Data Collection
+
+**Azure (collect az)**
+
+```bash
+# Available authentication methods:
+cirro collect az azcli           # Azure CLI authentication
+cirro collect az client-secret   # Client ID and secret
+cirro collect az client-cert     # Client certificate
+cirro collect az access-token    # Pre-obtained access token
+cirro collect az user-pass       # Username and password
+```
+
+**Tailscale (collect ts)**
+
+```bash
+# Tailscale data collection
+cirro collect ts <auth-method> [options]
+```
+
+### Graph Operations
+
+**Data Ingestion (graph ingest)**
+
+```bash
+# Ingest collected data into graph database
+cirro graph ingest --type <platform> --file <data-file> [database options]
+```
+
+**Data Export (graph export)**
+
+```bash
+# Export graph data to various formats
+cirro graph export --format <format> [options]
+```

 ## Installation

 ### Pre-built Binaries

-Download the latest release for your platform from the [releases page](https://github.com/bishopfox/cirro/releases).
+Download the latest release for your platform from the [releases page](https://github.com/bishopfox/cirro/releases). The releases are built with all features enabled.

 ### Building from Source

-Requires Rust 1.70 or later:
-
 ```bash
 git clone https://github.com/bishopfox/cirro.git
 cd cirro
 cargo build --release
 ```

-Binaries will be available in `target/release/`.
+**NOTE: BUILDING WITH --RELEASE IS IMPORTANT FOR GRAPH FUNCTIONALITY SINCE IT EMBEDS YAML CONFIGURATION FILES IN THE BINARY!**

-## Quick Start
+The binary will be available at `target/release/cirro`.

-### 1. Data Collection
+#### Build Options

-Collect Azure and Entra ID data using one of the supported authentication methods:
-
-#### Azure CLI Authentication
-Uses existing Azure CLI authentication. Ensure you're logged in with `az login` before running.
+By default, Cirro includes all available functionality. To build with specific features:

 ```bash
-# Collect from current Azure CLI context
-cirro collect azcli
+# Build with only collection features
+cargo build --release --no-default-features --features collector
+
+# Build with only graph features
+cargo build --release --no-default-features --features graph
+
+# Build with specific platform support
+cargo build --release --no-default-features --features "azure"
+cargo build --release --no-default-features --features "tailscale"
 ```

-#### Client Secret Authentication
-Authenticate using an Azure AD application's client ID and secret.
-```bash
-cirro collect client-secret \
-  --client-id <CLIENT_ID> \
-  --client-secret <CLIENT_SECRET> \
-  --tenant-id <TENANT_ID>
-```
+## Data Ingestion

-#### Client Certificate Authentication
-Authenticate using an Azure AD application's client ID and certificate (PEM format).
-```bash
-cirro collect client-cert \
-  --client-id <CLIENT_ID> \
-  --certificate <CERT_PATH> \
-  --tenant-id <TENANT_ID>
-```
-
-#### Access Token Authentication
-Use a pre-obtained access token.
-```bash
-cirro collect access-token --token <ACCESS_TOKEN>
-```
-
-### 2. Data Ingestion
-
-Both Neo4j and Memgraph are supported as graph database backends. Set up your preferred database before ingesting data. There are two docker-compose files in the [tools](/tools/) directory to assist with containerized databases. `cirro-graph` defaults to Neo4j configurations but you might consider using Memgraph for faster ingestion and performance.
+Cirro uses Neo4j as the backend database. There are docker-compose files in the [tools](/tools/) directory to assist with containerized databases. 

 After collecting data, ingest it into your graph database:

-#### Neo4j
 ```bash
-cirro-graph --file cirro_output.db
+# Ingest data for specific platforms
+cirro graph ingest --type az --file cirro_output.db         # Azure data
+cirro graph ingest --type ts --file cirro_ts_socket.json    # Tailscale data
+
+# Specify custom database connection
+cirro graph ingest --type az --file cirro_output.db \
+  --server bolt://localhost:7687 \
+  --user neo4j \
+  --password password
 ```

-#### Memgraph
-```bash
-cirro-graph --file cirro_output.db \
-  --graph-type memgraph \
-  --user cirro \
-  --password cirro
-```
+## Dry-Run Mode

-## Collection Modes
-
- **`both`** (default): Collect from both ARM and Graph APIs
- **`arm`**: Collect only from Azure Resource Manager APIs
- **`graph`**: Collect only from Microsoft Graph APIs
-
-## Data Enrichment
-
-Cirro supports additional data enrichment capabilities that will add additional nodes to the graph:
+Preview what would be ingested and post-processed without writing any data to the graph database:

 ```bash
-# Collect storage account keys
-cirro enrich azcli --storage-keys
+# Preview Azure ingestion and see which resource types have no implemented specs
+cirro graph ingest --type az --file cirro_output.db --dry-run
+
+# Preview Tailscale ingestion
+cirro graph ingest --type ts --file cirro_ts_socket.json --dry-run
 ```

-## Cloud Support
+In dry-run mode, Cirro will:

-Cirro supports multiple Azure cloud environments:
+- Report each spec and its row count that **would** be processed
+- Skip all Neo4j writes (no ingestion or post-processing queries execute)
+- For Azure, list resource types in the input data that have no implemented spec

- **`public`** (default): Azure Public Cloud
- **`china`**: Azure China Cloud
- **`germany`**: Azure Germany Cloud
- **`usgov`**: Azure US Government Cloud
+## Dashboard

-```bash
-cirro collect azcli --cloud usgov
-```
+CirroDash can be located here: [https://github.com/bishopfox/cirrodash](https://github.com/bishopfox/cirrodash)

-## Configuration Options
-
-### Global Options
-
- `--output-path`: Specify the output SQLite database file (default: `cirro_output.db`)
- `--debug`: Enable debug logging for troubleshooting
- `--mode`: Set collection mode (`both`, `arm`, `graph`)
- `--cloud`: Specify Azure cloud environment
-
-### Ingestion Options
-
- `--file`: Path to the Cirro SQLite database
- `--graph-type`: Database type (`neo4j` or `memgraph`)
- `--server`: Database server URL (bolt://, neo4j://, etc.)
- `--user`: Database username
- `--password`: Database password
- `--db-name`: Database name (optional, defaults based on graph type)
-
-
-## Troubleshooting
-
-### Common Issues
-
-1. **Authentication Failures**: Ensure your credentials have appropriate permissions
-2. **HTTP 429 Errors**: This can occur in large Azure environments. Retries are implemented in code but please report if you are still getting these errors.
-3. **Access Token Authentication**: Ensure your access token has the appropriate audience for Microsoft Graph or Azure Resource Manager.
-   
-### Debug Mode
+## Debug Mode

 Enable debug logging for detailed information:

 ```bash
-cirro collect azcli --debug
-cirro-graph --file cirro_output.db --debug
+# Collection debug mode
+cirro collect az azcli --debug
+
+# Ingestion debug mode
+cirro graph ingest --type az --file cirro_output.db --debug
 ```

 ---

-**Note**: Cirro is designed for authorized security testing and research. Ensure you have proper permissions before running against any Azure environment.
+**Note**: Cirro is designed for authorized security testing and research. Ensure you have proper permissions before running against any cloud or network environment.
@@ -0,0 +1,108 @@
+# git-cliff ~ configuration file
+# https://git-cliff.org/docs/configuration
+
+[changelog]
+# A Tera template to be rendered as the changelog's header.
+# See https://keats.github.io/tera/docs/#introduction
+header = """
+# Changelog\n
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n
+"""
+# A Tera template to be rendered for each release in the changelog.
+# See https://keats.github.io/tera/docs/#introduction
+body = """
+{%- macro remote_url() -%}
+  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
+{%- endmacro -%}
+
+{% if version -%}
+    ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
+{% else -%}
+    ## [Unreleased]
+{% endif -%}
+
+{% for group, commits in commits | group_by(attribute="group") %}
+    ### {{ group | upper_first }}
+    {% for commit in commits | unique(attribute="message") %}
+        - {{ commit.message | split(pat="\n") | first | upper_first | trim }}\
+            {% if commit.remote.username %} by @{{ commit.remote.username }}{%- endif -%}
+            {% if commit.remote.pr_number %} in \
+            [#{{ commit.remote.pr_number }}]({{ self::remote_url() }}/pull/{{ commit.remote.pr_number }}) \
+            {%- endif -%}
+    {% endfor %}
+{% endfor %}
+
+{%- if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
+    ### New Contributors
+{%- endif -%}
+
+{% for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
+  * @{{ contributor.username }} made their first contribution
+    {%- if contributor.pr_number %} in \
+      [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
+    {%- endif %}
+{%- endfor %}\n
+
+{%- if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}{% raw %}\n{% endraw -%}{% endif %}
+
+"""
+# A Tera template to be rendered as the changelog's footer.
+# See https://keats.github.io/tera/docs/#introduction
+footer = """
+{%- macro remote_url() -%}
+  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
+{%- endmacro -%}
+
+{% for release in releases -%}
+    {% if release.version -%}
+        {% if release.previous.version -%}
+            [{{ release.version | trim_start_matches(pat="v") }}]: \
+                {{ self::remote_url() }}/compare/{{ release.previous.version }}...{{ release.version }}
+        {% endif -%}
+    {% else -%}
+        [unreleased]: {{ self::remote_url() }}/compare/{{ release.previous.version }}...HEAD
+    {% endif -%}
+{% endfor %}
+<!-- generated by git-cliff -->
+"""
+# Remove leading and trailing whitespaces from the changelog's body.
+trim = true
+
+[git]
+# Parse commits according to the conventional commits specification.
+# See https://www.conventionalcommits.org
+conventional_commits = true
+# Exclude commits that do not match the conventional commits specification.
+filter_unconventional = true
+# An array of regex based parsers to modify commit messages prior to further processing.
+commit_preprocessors = [
+    # Remove issue numbers.
+    { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "" },
+]
+# An array of regex based parsers for extracting data from the commit message.
+# Assigns commits to groups.
+# Optionally sets the commit's scope and can decide to exclude commits from further processing.
+commit_parsers = [
+    { message = "^[a|A]dd", group = "Added" },
+    { message = "^[s|S]upport", group = "Added" },
+    { message = "^[r|R]emove", group = "Removed" },
+    { message = "^.*: add", group = "Added" },
+    { message = "^.*: support", group = "Added" },
+    { message = "^.*: remove", group = "Removed" },
+    { message = "^.*: delete", group = "Removed" },
+    { message = "^test", group = "Fixed" },
+    { message = "^fix", group = "Fixed" },
+    { message = "^.*: fix", group = "Fixed" },
+    { message = "^.*", group = "Changed" },
+    { body = "$^", skip = true },
+]
+# Exclude commits that are not matched by any commit parser.
+filter_commits = false
+# Order releases topologically instead of chronologically.
+topo_order = false
+# Order of commits in each group/release within the changelog.
+# Allowed values: newest, oldest
+sort_commits = "newest"
@@ -4,7 +4,7 @@ members = ["cargo:."]
 # Config for 'dist'
 [dist]
 # The preferred dist version to use in CI (Cargo.toml SemVer syntax)
-cargo-dist-version = "0.28.6"
+cargo-dist-version = "0.30.2"
 # CI backends to support
 ci = "github"
 # The installers to generate for each app
@@ -23,11 +23,7 @@ install-path = "CARGO_HOME"
 # Whether to install an updater program
 install-updater = false

-[dist.github-custom-runners.aarch64-unknown-linux-gnu.container]
-host = "x86_64-unknown-linux-musl"
-image = "quay.io/pypa/manylinux_2_28_x86_64"
-
-[dist.github-action-commits]
-"actions/checkout" = "11bd71901bbe5b1630ceea73d27597364c9af683"        # v4
-"actions/upload-artifact" = "ea165f8d65b6e75b540449e92b4886f43607fa02" # v4.6.2
-"actions/download-artifact" = "95815c38cf2ff2164869cbab79da8d1f422bc89e" # v4.2.1
+[dist.github-custom-runners]
+aarch64-apple-darwin = "macos-15"
+aarch64-unknown-linux-gnu.container = "ghcr.io/rust-cross/cargo-zigbuild"
+aarch64-unknown-linux-musl.container = "ghcr.io/rust-cross/cargo-zigbuild"
@@ -7,15 +7,36 @@ These nodes are not direct objects in Entra ID or Azure but are created as a res
 - **[BastionIPConfig](additional-nodes/bastion-ip-config.md)** - IP configurations for Bastion hosts
 - **[Certificate](additional-nodes/certificate.md)** - X.509 certificates used for authentication
 - **[ClientSecret](additional-nodes/client-secret.md)** - Client secrets used for application authentication
+- **[Container](additional-nodes/container.md)** - Individual containers within container groups
 - **[CustomDnsConfig](additional-nodes/custom-dns-config.md)** - Custom DNS configurations for private endpoints
+- **[ExpressRouteCircuitPeering](additional-nodes/expressroute-circuit-peering.md)** - ExpressRoute peering configurations attached to circuits
 - **[FederatedIdentityCredential](additional-nodes/federated-identity-credential.md)** - Federated identity credentials for applications
- **[GraphAppRole](additional-nodes/graph-app-role.md)** - Application roles within Azure AD applications
+- **[GraphAppRole](additional-nodes/graph-app-role.md)** - Application roles within Entra ID applications
+- **[HybridExtension](additional-nodes/hybrid-extension.md)** - Extensions attached to hybrid machines
+- **[HybridIPAddress](additional-nodes/hybrid-ip-address.md)** - IP addresses discovered for hybrid machines
 - **[IPConfig](additional-nodes/ip-config.md)** - IP configuration details for network interfaces
+- **[KeyVaultCertificate](additional-nodes/key-vault-certificate.md)** - Key Vault certificate metadata
+- **[KeyVaultCertificateValue](additional-nodes/key-vault-certificate-value.md)** - Versioned Key Vault certificate data and policy details
+- **[KeyVaultSecret](additional-nodes/key-vault-secret.md)** - Key Vault secret metadata
+- **[KeyVaultSecretValue](additional-nodes/key-vault-secret-value.md)** - Versioned Key Vault secret values
+- **[LoadBalancerBackendAddressPool](additional-nodes/load-balancer-backend-address-pool.md)** - Backend address pools attached to load balancers
+- **[LoadBalancerFrontendIPConfiguration](additional-nodes/load-balancer-frontend-ip-configuration.md)** - Frontend IP configurations for load balancers
+- **[LoadBalancerRule](additional-nodes/load-balancer-rule.md)** - Rule definitions attached to load balancers
 - **[NetworkGateway](additional-nodes/network-gateway.md)** - Virtual network gateways
 - **[NetworkPeering](additional-nodes/network-peering.md)** - Virtual network peering connections
 - **[NetworkRoute](additional-nodes/network-route.md)** - Individual routes within route tables
+- **[NetAppAccountADDomain](additional-nodes/netapp-account-ad-domain.md)** - Active Directory domain configurations for NetApp accounts
+- **[NetAppVolumeMount](additional-nodes/netapp-volume-mount.md)** - Mount targets for NetApp volumes
 - **[NSGRule](additional-nodes/nsg-rule.md)** - Network security group rules
+- **[PrivateEndpointConnection](additional-nodes/private-endpoint-connection.md)** - Embedded private endpoint connection objects on ARM resources
 - **[PrivateLinkServiceConnection](additional-nodes/private-link-service-connection.md)** - Private link service connections
+- **[RegistryCredential](additional-nodes/registry-credential.md)** - Container registry credentials associated with container groups
+- **[RunbookParameter](additional-nodes/runbook-parameter.md)** - Parameters defined for automation runbooks
+- **[ServicePrincipalEndpoint](additional-nodes/service-principal-endpoint.md)** - Service principal endpoints and metadata
 - **[StorageAccountKey](additional-nodes/storage-account-key.md)** - Storage account access keys
+- **[StorageAccountDFS](additional-nodes/storage-account-dfs.md)** - Data Lake Storage Gen2 filesystems
 - **[Subnet](additional-nodes/subnet.md)** - Virtual network subnets
- **[VerifiedDomain](additional-nodes/verified-domain.md)** - Verified domains for Azure AD organizations
+- **[VerifiedDomain](additional-nodes/verified-domain.md)** - Verified domains for Entra ID organizations
+- **[VMExtension](additional-nodes/vm-extension.md)** - Extensions attached to Azure virtual machines
+- **[VMRunCommand](additional-nodes/vm-run-command.md)** - Run command resources for Azure virtual machines
+- **[VMRunCommandParameter](additional-nodes/vm-run-command-parameter.md)** - Parameters for virtual machine run commands
@@ -0,0 +1,27 @@
+# AnalysisServiceFirewallRule
+
+Represents firewall rule entries attached to an Analysis Services server.
+
+**Labels:** `:AnalysisServiceFirewallRule`
+
+**Properties:**
+
+- `name` - Firewall rule name
+- `serverId` - Parent Analysis Services server resource ID (used with `name` as a composite key)
+- `rangeStart` - Start of allowed IPv4 range
+- `rangeEnd` - End of allowed IPv4 range
+
+## Relationships
+
+### Incoming
+
+- **AnalysisServiceServer** → `HAS_RULE` → **AnalysisServiceFirewallRule** - Server that owns the firewall rule
+
+## Examples
+
+```cypher
+// List firewall rules per Analysis Services server
+MATCH (s:AnalysisServiceServer)-[:HAS_RULE]->(r:AnalysisServiceFirewallRule)
+RETURN s.serverFullName, r.name, r.rangeStart, r.rangeEnd
+ORDER BY s.serverFullName, r.name
+```
@@ -0,0 +1,29 @@
+# AzureStackEdgeMachineNic
+
+Represents network interface cards attached to Azure Stack HCI edge machines (not an ARM resource itself).
+
+**Labels:** `:AzureStackEdgeMachineNic`
+
+**Properties:**
+
+- `machineId` - Parent edge machine ID (composite key with `adapterName`)
+- `adapterName` - Network adapter name (composite key with `machineId`)
+- `dnsServers` - DNS server addresses
+- `ip4Address` - IPv4 address
+- `macAddress` - MAC address
+- `rdmaCapability` - RDMA capability of the adapter
+- `subnetMask` - Subnet mask
+
+## Relationships
+
+### Incoming
+
+- **AzureStackEdgeMachine** → `HAS_NIC` → **AzureStackEdgeMachineNic** - Parent edge machine
+
+## Examples
+
+```cypher
+// Find edge machines and their NIC details
+MATCH (em:AzureStackEdgeMachine)-[:HAS_NIC]->(nic:AzureStackEdgeMachineNic)
+RETURN em.id, nic.adapterName, nic.ip4Address, nic.macAddress, nic.rdmaCapability
+```
@@ -0,0 +1,25 @@
+# ContainerImage
+
+Represents a container image reference used by Container Apps (including tag/digest in the name).
+
+**Labels:** `:ContainerImage`
+
+**Properties:**
+
+- `name` - Full image name (including registry prefix and tag/digest)
+
+## Relationships
+
+### Incoming
+- **ContainerRegistry** → `CONTAINS_IMAGE` → **ContainerImage** - Registry that hosts the image reference
+
+### Outgoing
+- **ContainerImage** → `HAS_ENVVAR` → **EnvVar** - Environment variables defined for the image in a Container App template
+
+## Examples
+
+```cypher
+// List images and their registries
+MATCH (acr:ContainerRegistry)-[:CONTAINS_IMAGE]->(img:ContainerImage)
+RETURN acr.loginServer, img.name
+```
@@ -0,0 +1,15 @@
+# Container
+
+Represents an individual container within an Azure Container Instances container group.
+
+**Labels:** `:Container`
+
+**Properties:**
+
+- `image` - Container image name (primary key)
+- `name` - Container name
+- `environmentVariables` - List of environment variables in "name:value" format
+
+## Relationships
+
+- **ContainerGroup** → **HAS_CONTAINER** → **Container** - Container within container groups
@@ -0,0 +1,25 @@
+# EnvVar
+
+Represents an environment variable defined for a container in a Container App template.
+
+**Labels:** `:EnvVar`
+
+**Properties:**
+
+- `name` - Variable name (primary key per image edge)
+- `value` - Literal value (if provided)
+- `secretRef` - Secret reference name (if value is sourced from a secret)
+
+## Relationships
+
+### Incoming
+- **ContainerImage** → `HAS_ENVVAR` → **EnvVar** - Environment variable attached to an image definition
+
+## Examples
+
+```cypher
+// Find env vars that reference secrets
+MATCH (img:ContainerImage)-[:HAS_ENVVAR]->(e:EnvVar)
+WHERE e.secretRef IS NOT NULL
+RETURN img.name, e.name, e.secretRef
+```
@@ -0,0 +1,33 @@
+# ExpressRouteCircuitPeering
+
+Represents an ExpressRoute peering object attached to an ExpressRoute circuit.
+
+**Labels:** `:ExpressRouteCircuitPeering`
+
+**Properties:**
+
+- `id` - Peering resource ID (primary key)
+- `name` - Peering name
+- `azureASN` - Azure ASN value
+- `peerASN` - Customer/provider ASN value
+- `primaryPeerAddressPrefix` - Primary peering CIDR
+- `secondaryPeerAddressPrefix` - Secondary peering CIDR
+- `primaryAzurePort` - Primary Azure port
+- `secondaryAzurePort` - Secondary Azure port
+- `vlanId` - VLAN ID used for peering
+- `peeringType` - Peering type
+- `state` - Peering state
+
+## Relationships
+
+### Incoming
+
+- **ExpressRouteCircuit** → `HAS_PEERING` → **ExpressRouteCircuitPeering** - Circuit-to-peering linkage
+
+## Examples
+
+```cypher
+// List ExpressRoute circuits and their peerings
+MATCH (c:ExpressRouteCircuit)-[:HAS_PEERING]->(p:ExpressRouteCircuitPeering)
+RETURN c.name, p.name, p.peeringType, p.state
+```
@@ -14,4 +14,4 @@ Represents federated identity credentials for applications.
 - `description` - Credential description

 **Relationships:**
- `FEDERATED_CREDENTIAL` ← GraphApplication
+- `AUTHENTICATES` → GraphApplication
@@ -1,6 +1,6 @@
 # GraphAppRole

-Represents application roles within Azure AD applications.
+Represents application roles within Entra ID applications.

 **Labels:** `:GraphAppRole`

@@ -0,0 +1,34 @@
+# HybridIPAddress
+
+Represents IP addresses associated with hybrid machines (not an ARM resource itself).
+
+**Labels:** `:HybridIPAddress`
+
+**Properties:**
+
+- `id` - IP address ID (primary key)
+- `ipAddress` - The IP address value
+- `type` - IP address type (e.g., private, public)
+- `subnetId` - Associated subnet ID if applicable
+- `isPrimary` - Whether this is the primary IP address
+
+## Relationships
+
+### Incoming
+
+- **HybridMachine** → `HAS_IP` → HybridIPAddress - Parent hybrid machine
+
+## Examples
+
+```cypher
+// Find all hybrid machines and their IP addresses
+MATCH (hm:HybridMachine)-[:HAS_IP]->(ip:HybridIPAddress)
+RETURN hm.displayName, ip.ipAddress, ip.type, ip.isPrimary
+```
+
+```cypher
+// Find hybrid machines with private IP addresses
+MATCH (hm:HybridMachine)-[:HAS_IP]->(ip:HybridIPAddress)
+WHERE ip.type = "private"
+RETURN hm.displayName, ip.ipAddress
+```
@@ -0,0 +1,17 @@
+# HybridRunCommandParameter
+
+Represents a parameter for a hybrid machine run command.
+
+**Labels:** `:HybridRunCommandParameter`
+
+**Properties:**
+
+- `name` - Parameter name (composite key with `commandId`)
+- `commandId` - Parent run command ID (composite key)
+- `value` - Parameter value
+
+## Relationships
+
+### Incoming
+
+- **HybridRunCommand** → `HAS_PARAMETER` → **HybridRunCommandParameter** - Parent run command
@@ -0,0 +1,34 @@
+# HybridRunCommand
+
+Represents a run command resource associated with an Azure Arc-enabled hybrid machine.
+
+**Labels:** `:ArmResource:HybridRunCommand`
+
+**Properties:**
+
+- `id` - Run command resource ID (primary key)
+- `asyncExecution` - Whether execution is asynchronous
+- `runAsUser` - User context used to run the command
+- `timeoutInSeconds` - Command timeout in seconds
+- `treatFailureAsDeploymentFailure` - Failure handling behavior
+- `script` - Script body
+- `output` - Command output from the last execution
+
+## Relationships
+
+### Incoming
+
+- **HybridMachine** → `HAS_RUN_COMMAND` → **HybridRunCommand** - Parent hybrid machine
+
+### Outgoing
+
+- **HybridRunCommand** → `HAS_PARAMETER` → **HybridRunCommandParameter** - Parameters bound to the run command
+
+## Examples
+
+```cypher
+// Find hybrid run commands and their parameters
+MATCH (hm:HybridMachine)-[:HAS_RUN_COMMAND]->(cmd:HybridRunCommand)
+OPTIONAL MATCH (cmd)-[:HAS_PARAMETER]->(p:HybridRunCommandParameter)
+RETURN hm.displayName, cmd.id, collect(p.name) AS parameterNames
+```
@@ -1,13 +1,40 @@
-# IPConfig
+# IPConfiguration

-Represents IP configurations for network interfaces.
+Represents IP configurations for network interfaces (not an ARM resource itself).

-**Labels:** `:IPConfig`
+**Labels:** `:IPConfiguration`

 **Properties:**

+- `id` - IP configuration ID (primary key)
 - `name` - Configuration name
- `primary` - Whether this is the primary IP configuration
+- `type` - Configuration type
 - `privateIPAddress` - Private IP address
- `privateIPAllocationMethod` - Private IP allocation method
- `publicIPAddress` - Associated public IP address
+- `privateIPAddressVersion` - IP address version (IPv4/IPv6)
+- `privateIPAllocationMethod` - Private IP allocation method (Static/Dynamic)
+
+## Relationships
+
+### Incoming
+
+- **NetworkInterface** → `HAS_CONFIG` → **IPConfiguration** - Parent network interface
+- **Subnet** → `CONTAINS` → **IPConfiguration** - Subnet containing this IP configuration
+
+### Outgoing
+
+- **IPConfiguration** → `HAS_IP` → **PublicIPAddress** - Associated public IP address (if any)
+
+## Examples
+
+```cypher
+// Find all static IP configurations
+MATCH (ip:IPConfiguration)
+WHERE ip.privateIPAllocationMethod = "Static"
+RETURN ip.name, ip.privateIPAddress, ip.privateIPAddressVersion
+```
+
+```cypher
+// Find IP configurations with public IPs
+MATCH (ip:IPConfiguration)-[:HAS_IP]->(pub:PublicIPAddress)
+RETURN ip.privateIPAddress, pub.ipAddress
+```
@@ -0,0 +1,48 @@
+# KeyVaultCertificateValue
+
+Represents versioned Azure Key Vault certificate value objects, including certificate material and issuance policy metadata.
+
+**Labels:** `:KeyVaultCertificateValue`
+
+**Properties:**
+
+- `id` - Certificate value version ID (primary key)
+- `name` - Certificate name
+- `cer` - Encoded certificate content
+- `contentType` - Certificate content type
+- `kid` - Related Key Vault key ID
+- `sid` - Related Key Vault secret ID
+- `x509Thumbprint` - Thumbprint value
+- `x509ThumbprintHex` - Hex-encoded thumbprint
+- `enabled` - Whether the certificate value is enabled
+- `notBefore` - Time before which the certificate value is invalid
+- `expires` - Expiration time
+- `created` - Creation time
+- `updated` - Last update time
+- `recoverableDays` - Number of recoverable days
+- `recoveryLevel` - Recovery level
+- `issuerTransparency` - Certificate transparency setting from the issuer policy
+- `issuerType` - Issuer certificate type
+- `issuerName` - Issuer name
+- `exportable` - Whether the private key is exportable
+- `keyType` - Key algorithm or key type
+- `secretContentType` - Content type used for the backing secret
+- `keyUsage` - X.509 key usage values
+- `x509SubjectName` - X.509 subject name from the policy
+- `x509DnsNames` - DNS subject alternative names
+- `x509Emails` - Email subject alternative names
+- `x509Upns` - UPN subject alternative names
+- `tags` - Certificate tags as `key:value` strings
+
+**Relationships:**
+
+- `HAS_VERSION` ← KeyVaultCertificate - Parent certificate metadata node
+
+## Example Queries
+
+Find versioned Key Vault certificate values and their issuance details:
+
+```cypher
+MATCH (c:KeyVaultCertificate)-[:HAS_VERSION]->(v:KeyVaultCertificateValue)
+RETURN c.name, v.x509SubjectName, v.secretContentType, v.expires
+```
@@ -0,0 +1,38 @@
+# KeyVaultCertificate
+
+Represents Azure Key Vault certificate metadata.
+
+**Labels:** `:KeyVaultCertificate`
+
+**Properties:**
+
+- `id` - Certificate ID (primary key)
+- `name` - Certificate name
+- `subject` - Certificate subject
+- `x509Thumbprint` - Thumbprint value
+- `x509ThumbprintHex` - Hex-encoded thumbprint
+- `enabled` - Whether the certificate is enabled
+- `notBefore` - Time before which the certificate is invalid
+- `expires` - Expiration time
+- `created` - Creation time
+- `updated` - Last update time
+- `recoverableDays` - Number of recoverable days
+- `recoveryLevel` - Recovery level
+- `tags` - Certificate tags as `key:value` strings
+
+**Relationships:**
+
+- `HAS_CERTIFICATE` ← KeyVault - Parent Key Vault
+- `HAS_VERSION` → KeyVaultCertificateValue - Versioned certificate value objects
+- `MATCHES_CERT` → Certificate - Matched application or service principal certificates by thumbprint
+
+## Example Queries
+
+Find Key Vault certificates, their versions, and any matched Entra certificates:
+
+```cypher
+MATCH (kv:KeyVault)-[:HAS_CERTIFICATE]->(c:KeyVaultCertificate)
+OPTIONAL MATCH (c)-[:HAS_VERSION]->(v:KeyVaultCertificateValue)
+OPTIONAL MATCH (c)-[:MATCHES_CERT]->(cert:Certificate)
+RETURN kv.name, c.name, collect(DISTINCT v.id) AS versions, collect(DISTINCT cert.thumbprint) AS matchedThumbprints
+```
@@ -0,0 +1,37 @@
+# KeyVaultSecretValue
+
+Represents versioned Azure Key Vault secret values.
+
+**Labels:** `:KeyVaultSecretValue`
+
+**Properties:**
+
+- `id` - Secret value version ID (primary key)
+- `name` - Secret name
+- `value` - Secret value collected from Key Vault
+- `managed` - Whether Azure manages the secret
+- `contentType` - Secret content type
+- `kid` - Related Key Vault key ID, when present
+- `enabled` - Whether the secret value is enabled
+- `notBefore` - Time before which the secret value is invalid
+- `expires` - Expiration time
+- `created` - Creation time
+- `updated` - Last update time
+- `recoverableDays` - Number of recoverable days
+- `recoveryLevel` - Recovery level
+- `tags` - Secret tags as `key:value` strings
+
+**Relationships:**
+
+- `HAS_VERSION` ← KeyVaultSecret - Parent secret metadata node
+- `MATCHES_SECRET` → ClientSecret - Matched client secrets discovered during post-processing
+
+## Example Queries
+
+Find versioned Key Vault secret values and any matched client secrets:
+
+```cypher
+MATCH (s:KeyVaultSecret)-[:HAS_VERSION]->(v:KeyVaultSecretValue)
+OPTIONAL MATCH (v)-[:MATCHES_SECRET]->(c:ClientSecret)
+RETURN s.name, v.id, c.hint
+```
@@ -0,0 +1,38 @@
+# KeyVaultSecret
+
+Represents Azure Key Vault secret metadata.
+
+**Labels:** `:KeyVaultSecret`
+
+**Properties:**
+
+- `id` - Secret ID (primary key)
+- `name` - Secret name
+- `managed` - Whether Azure manages the secret
+- `contentType` - Secret content type
+- `kid` - Related Key Vault key ID, when present
+- `enabled` - Whether the secret is enabled
+- `notBefore` - Time before which the secret is invalid
+- `expires` - Expiration time
+- `created` - Creation time
+- `updated` - Last update time
+- `recoverableDays` - Number of recoverable days
+- `recoveryLevel` - Recovery level
+- `tags` - Secret tags as `key:value` strings
+
+**Relationships:**
+
+- `HAS_SECRET` ← KeyVault - Parent Key Vault
+- `HAS_VERSION` → KeyVaultSecretValue - Versioned secret values
+- `USED_BY` → WebCertificate - Web certificates backed by this secret
+
+## Example Queries
+
+Find Key Vault secrets, their versions, and any web certificates that consume them:
+
+```cypher
+MATCH (kv:KeyVault)-[:HAS_SECRET]->(s:KeyVaultSecret)
+OPTIONAL MATCH (s)-[:HAS_VERSION]->(v:KeyVaultSecretValue)
+OPTIONAL MATCH (s)-[:USED_BY]->(wc:WebCertificate)
+RETURN kv.name, s.name, collect(DISTINCT v.id) AS versions, collect(DISTINCT wc.name) AS webCertificates
+```
@@ -0,0 +1,22 @@
+# LoadBalancerBackendAddressPool
+
+Represents backend address pool objects attached to a load balancer.
+
+**Labels:** `:LoadBalancerBackendAddressPool`
+
+**Properties:**
+
+- `id` - Backend address pool resource ID (primary key)
+- `name` - Backend pool name
+- `provisioningState` - Current provisioning state
+- `type` - Azure resource type value
+
+## Relationships
+
+### Incoming
+
+- **LoadBalancer** -> `HAS_BACKEND_POOL` -> **LoadBalancerBackendAddressPool** - Parent load balancer
+
+### Outgoing
+
+- **LoadBalancerBackendAddressPool** -> `ASSOCIATED_WITH` -> **NetworkInterface** - Backend NIC configuration reference
@@ -0,0 +1,23 @@
+# LoadBalancerFrontendIPConfiguration
+
+Represents frontend IP configuration objects for a load balancer.
+
+**Labels:** `:LoadBalancerFrontendIPConfiguration`
+
+**Properties:**
+
+- `id` - Frontend configuration resource ID (primary key)
+- `name` - Frontend configuration name
+- `privateIPAllocationMethod` - Private IP allocation method
+- `provisioningState` - Current provisioning state
+- `type` - Azure resource type value
+
+## Relationships
+
+### Incoming
+
+- **LoadBalancer** -> `HAS_LB_FRONTEND` -> **LoadBalancerFrontendIPConfiguration** - Parent load balancer
+
+### Outgoing
+
+- **LoadBalancerFrontendIPConfiguration** -> `HAS_IP` -> **PublicIPAddress** - Associated public IP (if present)
@@ -0,0 +1,29 @@
+# LoadBalancerRule
+
+Represents load balancing rule definitions attached to a load balancer.
+
+**Labels:** `:LoadBalancerRule`
+
+**Properties:**
+
+- `id` - Rule resource ID (primary key)
+- `name` - Rule name
+- `protocol` - Protocol used by the rule
+- `frontendPort` - Frontend listening port
+- `backendPort` - Backend target port
+- `allowBackendPortConflict` - Whether backend port conflict is allowed
+- `disableConnectionTracking` - Whether connection tracking is disabled
+- `disableOutboundSnat` - Whether outbound SNAT is disabled
+- `enableConnectionTracking` - Whether connection tracking is enabled
+- `enableDestinationServiceEndpoint` - Whether destination service endpoint is enabled
+- `enableFloatingIP` - Whether floating IP is enabled
+- `enableTcpReset` - Whether TCP reset is enabled
+- `idleTimeoutInMinutes` - Idle timeout value
+- `provisioningState` - Current provisioning state
+- `type` - Azure resource type value
+
+## Relationships
+
+### Incoming
+
+- **LoadBalancer** -> `HAS_RULE` -> **LoadBalancerRule** - Load balancer that owns the rule
@@ -0,0 +1,28 @@
+# NetAppAccountADDomain
+
+Represents an Active Directory domain configuration for an Azure NetApp Files account.
+
+**Labels:** `:NetAppAccountADDomain`
+
+**Properties:**
+
+- `activeDirectoryId` - Active Directory identifier (primary key)
+- `administrators` - List of administrator accounts
+- `aesEncryption` - Whether AES encryption is enabled
+- `allowLocalNfsUsersWithLdap` - Whether local NFS users are allowed with LDAP
+- `backupOperators` - Backup operator accounts for the AD domain
+- `dns` - DNS server configuration
+- `domain` - Active Directory domain name
+- `encryptDCConnections` - Whether domain controller connections are encrypted
+- `kdcIP` - Kerberos KDC IP address
+- `ldapOverTLS` - Whether LDAP over TLS is enabled
+- `ldapSigning` - LDAP signing configuration
+- `organizationalUnit` - Organizational unit for computer accounts
+- `site` - Active Directory site name
+- `smbServerName` - SMB server name
+- `status` - Current status of the AD configuration
+- `username` - Username for domain authentication
+
+## Relationships
+
+- **NetAppAccount** → **IS_DEPLOYED** → **NetAppAccountADDomain** - AD domain where NetApp is deployed
@@ -0,0 +1,16 @@
+# NetAppVolumeMount
+
+Represents a mount target for an Azure NetApp Files volume.
+
+**Labels:** `:NetAppVolumeMount`
+
+**Properties:**
+
+- `mountTargetId` - Mount target identifier (primary key)
+- `fileSystemId` - File system identifier
+- `ipAddress` - IP address for mounting
+- `smbServerFqdn` - SMB server fully qualified domain name
+
+## Relationships
+
+- **NetAppVolume** → **MOUNTS** → **NetAppVolumeMount** - Mount targets for volumes
@@ -1,6 +1,6 @@
 # NetworkPeering

-Represents virtual network peering connections.
+Represents virtual network peering connections (not an ARM resource itself).

 **Labels:** `:NetworkPeering`

@@ -8,18 +8,34 @@ Represents virtual network peering connections.

 - `id` - Peering ID (primary key)
 - `name` - Peering name
- `type` - Peering type
+- `allowVirtualNetworkAccess` - Whether virtual network access is allowed
 - `allowForwardedTraffic` - Whether forwarded traffic is allowed
 - `allowGatewayTransit` - Whether gateway transit is allowed
- `allowVirtualNetworkAccess` - Whether virtual network access is allowed
- `doNotVerifyRemoteGateway` - Whether to skip remote gateway verification
- `peerCompleteVnets` - Whether to peer complete VNets
- `peeringState` - Peering state
- `peeringSyncLevel` - Peering sync level
- `remoteAddressPrefixes` - Remote address prefixes
 - `useRemoteGateways` - Whether to use remote gateways
+- `peeringState` - Current state of the peering (Connected, Disconnected, etc.)

-**Relationships:**
- `HAS_PEERING` ← VirtualNetwork
- `HAS_GATEWAY` → NetworkGateway
- `PEER_TO` → VirtualNetwork
+## Relationships
+
+### Incoming
+
+- **VirtualNetwork** → `HAS_PEERING` → **NetworkPeering** - Source virtual network
+
+### Outgoing
+
+- **NetworkPeering** → `PEERS_WITH` → **ArmResource** - Target virtual network
+
+## Examples
+
+```cypher
+// Find all connected peering relationships
+MATCH (vnet:VirtualNetwork)-[:HAS_PEERING]->(peering:NetworkPeering)
+WHERE peering.peeringState = "Connected"
+RETURN vnet.name, peering.name, peering.allowForwardedTraffic
+```
+
+```cypher
+// Find bidirectional peering relationships
+MATCH (vnet1:VirtualNetwork)-[:HAS_PEERING]->(p1:NetworkPeering)-[:PEERS_WITH]->(vnet2:VirtualNetwork)
+MATCH (vnet2)-[:HAS_PEERING]->(p2:NetworkPeering)-[:PEERS_WITH]->(vnet1)
+RETURN vnet1.name, vnet2.name, p1.peeringState, p2.peeringState
+```
@@ -0,0 +1,26 @@
+# PrivateEndpointConnection
+
+Represents an embedded private endpoint connection object found on ARM resources.
+
+**Labels:** `:PrivateEndpointConnection`
+
+**Properties:**
+
+- `id` - Private endpoint connection ID (primary key)
+- `name` - Connection name
+- `type` - Resource type
+- `groupIds` - Target group IDs used by the connection
+
+## Relationships
+
+### Incoming
+
+- **ArmResource** → `HAS_PRIVATE_ENDPOINT` → **PrivateEndpointConnection** - Parent resource references this connection object
+
+## Examples
+
+```cypher
+// Find resources with private endpoint connections
+MATCH (r:ArmResource)-[:HAS_PRIVATE_ENDPOINT]->(p:PrivateEndpointConnection)
+RETURN r.name, r.type, p.name, p.groupIds
+```
@@ -0,0 +1,25 @@
+# RegistryCredential
+
+Represents container image registry credentials associated with container groups.
+
+**Labels:** `:RegistryCredential`
+
+**Properties:**
+
+- `username` - Registry username (primary key component)
+- `server` - Registry server name (primary key component)
+- `isDelegatedIdentity` - Whether delegated identity is used
+
+## Relationships
+
+### Outgoing
+
+- **RegistryCredential** → `AUTHENTICATES` → **ContainerGroup** - Credential used to authenticate pulls for a container group
+
+## Examples
+
+```cypher
+// Find registry credentials used by container groups
+MATCH (cred:RegistryCredential)-[:AUTHENTICATES]->(cg:ContainerGroup)
+RETURN cred.server, cred.username, cred.isDelegatedIdentity, cg.name
+```
@@ -0,0 +1,36 @@
+# RunbookParameter
+
+Represents parameters defined for automation runbooks (not an ARM resource itself).
+
+**Labels:** `:RunbookParameter`
+
+**Properties:**
+
+- `id` - Parameter ID (primary key)
+- `name` - Parameter name
+- `defaultValue` - Default value for the parameter
+- `isMandatory` - Whether the parameter is mandatory
+- `position` - Parameter position
+- `type` - Parameter type
+
+## Relationships
+
+### Incoming
+
+- **AutomationRunbook** → `HAS_PARAMETER` → RunbookParameter - Parent runbook
+
+## Examples
+
+```cypher
+// Find all mandatory parameters
+MATCH (p:RunbookParameter)
+WHERE p.isMandatory = true
+RETURN p.name, p.type, p.defaultValue
+```
+
+```cypher
+// Find runbooks with the most parameters
+MATCH (rb:AutomationRunbook)-[:HAS_PARAMETER]->(p:RunbookParameter)
+RETURN rb.name, count(p) AS parameterCount
+ORDER BY parameterCount DESC
+```
@@ -0,0 +1,35 @@
+# ServicePrincipalEndpoint
+
+Represents service principal endpoints (not an ARM resource itself).
+
+**Labels:** `:ServicePrincipalEndpoint`
+
+**Properties:**
+
+- `id` - Endpoint ID (primary key)
+- `type` - Endpoint type
+- `uri` - Endpoint URI
+- `customKeyIdentifier` - Custom key identifier
+- `displayName` - Endpoint display name
+- `usage` - Endpoint usage description
+
+## Relationships
+
+### Incoming
+
+- **ServicePrincipal** → `HAS_ENDPOINT` → ServicePrincipalEndpoint - Parent service principal
+
+## Examples
+
+```cypher
+// Find all service principal endpoints
+MATCH (sp:ServicePrincipal)-[:HAS_ENDPOINT]->(endpoint:ServicePrincipalEndpoint)
+RETURN sp.displayName, endpoint.type, endpoint.uri, endpoint.displayName
+```
+
+```cypher
+// Find service principals with specific endpoint types
+MATCH (sp:ServicePrincipal)-[:HAS_ENDPOINT]->(endpoint:ServicePrincipalEndpoint)
+WHERE endpoint.type = "oauth2"
+RETURN sp.displayName, endpoint.uri
+```
@@ -0,0 +1,14 @@
+# StorageAccountDFS
+
+Represents Data Lake Storage Gen2 filesystems within Azure Storage Accounts.
+
+**Labels:** `:StorageAccountDFS`
+
+**Properties:**
+
+- `id` - DFS filesystem ID (primary key)  
+- `name` - Filesystem name
+
+**Relationships:**
+- Connected from Storage Account via `HAS_DFS_FILESYSTEM` relationship
+- `USED_BY` → Various services that use DFS storage (e.g., Synapse Workspaces)
@@ -1,6 +1,6 @@
 # VerifiedDomain

-Represents verified domains associated with Azure AD organizations. These are domains that have been verified as belonging to the organization.
+Represents verified domains associated with Entra ID organizations. These are domains that have been verified as belonging to the organization.

 **Labels:** `:VerifiedDomain`

@@ -0,0 +1,33 @@
+# VMExtension
+
+Represents an extension attached to an Azure virtual machine.
+
+**Labels:** `:ArmResource:VMExtension`
+
+**Properties:**
+
+- `id` - Extension resource ID (primary key)
+- `name` - Extension name
+- `extType` - Extension type
+- `location` - Resource location
+- `provisioningState` - Provisioning state
+- `publisher` - Extension publisher
+- `autoUpgradeMinorVersion` - Auto-upgrade behavior
+- `triggerForceUpgrade` - Force-upgrade trigger
+- `vmType` - VM type metadata from extension settings
+- `settings` - Serialized extension settings
+
+## Relationships
+
+### Incoming
+
+- **VirtualMachine** → `HAS_EXTENSION` → **VMExtension** - Extension bound to a VM
+- **HybridMachine** → `HAS_EXTENSION` → **VMExtension** - Extension attached to an Arc/hybrid machine
+
+## Examples
+
+```cypher
+// Find extensions by publisher across VMs
+MATCH (vm:VirtualMachine)-[:HAS_EXTENSION]->(ext:VMExtension)
+RETURN vm.name, ext.name, ext.publisher, ext.provisioningState
+```
@@ -0,0 +1,15 @@
+# VMRunCommandParameter
+
+Represents a parameter for a virtual machine run command.
+
+**Labels:** `:VMRunCommandParameter`
+
+**Properties:**
+
+- `name` - Parameter name (composite key with `commandId`)
+- `commandId` - Parent run command ID (composite key)
+- `value` - Parameter value
+
+## Relationships
+
+- **VMRunCommand** → **HAS_PARAMETER** → **VMRunCommandParameter** - Parameters for run commands
@@ -0,0 +1,33 @@
+# VMRunCommand
+
+Represents a run command resource associated with a virtual machine.
+
+**Labels:** `:VMRunCommand`
+
+**Properties:**
+
+- `id` - Run command resource ID (primary key)
+- `asyncExecution` - Whether execution is asynchronous
+- `runAsUser` - User context used to run command
+- `timeoutInSeconds` - Command timeout
+- `treatFailureAsDeploymentFailure` - Failure handling behavior
+- `script` - Script body
+
+## Relationships
+
+### Incoming
+
+- **VirtualMachine** → `HAS_RUN_COMMAND` → **VMRunCommand** - VM run-command association
+
+### Outgoing
+
+- **VMRunCommand** → `HAS_PARAMETER` → **VMRunCommandParameter** - Parameters bound to the run command
+
+## Examples
+
+```cypher
+// Find VM run commands and parameters
+MATCH (vm:VirtualMachine)-[:HAS_RUN_COMMAND]->(cmd:VMRunCommand)
+OPTIONAL MATCH (cmd)-[:HAS_PARAMETER]->(p:VMRunCommandParameter)
+RETURN vm.name, cmd.id, collect(p.name) AS parameterNames
+```
@@ -18,4 +18,4 @@ Base properties inherited by all Azure Resource Manager resources.
 - `tags` - Resource tags as key:value pairs

 **Relationships:**
- `HAS_IDENTITY` → GraphObject (for managed identities)
+- `HAS_IDENTITY` → GraphObject (for managed identities)
@@ -0,0 +1,41 @@
+# AnalysisServiceServer
+
+Represents Azure Analysis Services server resources.
+
+**Labels:** `:ArmResource:AnalysisServiceServer`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `managedMode` - Indicates whether the server is managed
+- `serverFullName` - Full server name
+- `serverMonitorMode` - Monitoring mode for the server
+- `state` - Current state of the server
+- `administrators` - Raw administrator member entries from the resource
+- `enablePowerBIService` - Whether Power BI service access is enabled
+
+## Relationships
+
+### Incoming
+
+- **GraphServicePrincipal** → `IS_ADMIN` → **AnalysisServiceServer** - Service principal listed as administrator
+- **GraphObject** → `IS_ADMIN` → **AnalysisServiceServer** - Directory object listed as administrator
+- **GraphUser** → `IS_ADMIN` → **AnalysisServiceServer** - User listed as administrator
+
+### Outgoing
+
+- **AnalysisServiceServer** → `HAS_RULE` → **AnalysisServiceFirewallRule** - Firewall rules defined on the server
+
+## Examples
+
+```cypher
+// Find Analysis Services servers and administrator principals
+MATCH (admin)-[:IS_ADMIN]->(s:AnalysisServiceServer)
+RETURN s.serverFullName, labels(admin), admin
+```
+
+```cypher
+// Find Analysis Services servers and their firewall rules
+MATCH (s:AnalysisServiceServer)-[:HAS_RULE]->(r:AnalysisServiceFirewallRule)
+RETURN s.serverFullName, r.name, r.rangeStart, r.rangeEnd
+```
@@ -0,0 +1,39 @@
+# ApimService
+
+Represents Azure API Management Service instances.
+
+**Labels:** `:ArmResource:ApimService`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `createdAt` - Creation timestamp
+- `developerPortalStatus` - Developer portal status
+- `developerPortalUrl` - Developer portal URL
+- `gatewayRegionalUrl` - Gateway regional URL
+- `gatewayUrl` - Gateway URL
+- `legacyPortalStatus` - Legacy portal status
+- `managementApiUrl` - Management API URL
+- `outboundPublicIpAddresses` - Outbound public IP addresses
+- `portalUrl` - Portal URL
+- `publicIpAddresses` - Public IP addresses
+- `publicNetworkAccess` - Public network access setting
+- `publisherEmail` - Publisher email
+- `publisherName` - Publisher name
+- `publisherChannel` - Publisher channel
+- `scmUrl` - SCM URL
+
+## Relationships
+
+### Outgoing
+
+- **Tenant** → `MANAGES` → **Tenant** - Managed by tenant relationship (from managed tenants)
+
+## Examples
+
+```cypher
+// Find APIM services with public access
+MATCH (a:ApimService)
+WHERE a.publicNetworkAccess = 'Enabled'
+RETURN a.name, a.gatewayUrl, a.publisherName
+```
@@ -0,0 +1,17 @@
+# AppBuilder
+
+Represents Azure App Builders resources.
+
+**Labels:** `:ArmResource:AppBuilder`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+
+## Examples
+
+```cypher
+// List App Builders
+MATCH (b:AppBuilder)
+RETURN b.id
+```
@@ -0,0 +1,29 @@
+# AppManagedEnvironment
+
+Represents Azure Container App managed environments.
+
+**Labels:** `:ArmResource:AppManagedEnvironment`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `daprAIConnectionString` - Dapr Application Insights connection string
+- `defaultDomain` - Default domain for the environment
+- `eventStreamEndpoint` - Event stream endpoint
+- `infrastructureResourceGroup` - Backing infrastructure resource group
+- `mtls` - Mutual TLS enabled
+- `encryption` - Peer traffic encryption enabled
+- `staticIp` - Static IP assigned to the environment
+
+## Relationships
+
+### Outgoing
+- **AppManagedEnvironment** → `DEPLOYS` → **ContainerApp** - Container Apps deployed into this environment
+
+## Examples
+
+```cypher
+// Find environments and their apps
+MATCH (env:AppManagedEnvironment)-[:DEPLOYS]->(app:ContainerApp)
+RETURN env.defaultDomain, collect(app.fqdn) AS apps
+```
@@ -0,0 +1,41 @@
+# ContainerApp
+
+Represents Azure Container Apps.
+
+**Labels:** `:ArmResource:ContainerApp`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `runningStatus` - Current running status
+- `allowInsecure` - Allow insecure ingress
+- `fqdn` - Fully qualified domain name
+- `clientCertificateMode` - Client certificate mode for ingress
+- `external` - External ingress enabled
+- `exposedPort` - Exposed ingress port
+- `targetPort` - Target application port
+- `secretNames` - Secret names referenced by the app
+
+## Relationships
+
+### Incoming
+- **AppManagedEnvironment** → `DEPLOYS` → **ContainerApp** - Deployment into a managed environment
+
+### Outgoing
+- **ContainerApp** → `CAN_ACCESS_REGISTRY` → **ContainerRegistry** - Registry access for image pulls (with identity/secret details)
+- **ContainerRegistry** → `CONTAINS_IMAGE` → **ContainerImage** - Images referenced by this app (by registry server and image string)
+- **ContainerImage** → `HAS_ENVVAR` → **EnvVar** - Environment variables defined on containers
+
+## Examples
+
+```cypher
+// Container Apps and their registries
+MATCH (app:ContainerApp)-[r:CAN_ACCESS_REGISTRY]->(acr:ContainerRegistry)
+RETURN app.fqdn, acr.loginServer, r.identity, r.username, r.passwordSecretRef
+```
+
+```cypher
+// Container Apps with images and env vars
+MATCH (acr:ContainerRegistry)-[:CONTAINS_IMAGE]->(img:ContainerImage)-[:HAS_ENVVAR]->(e:EnvVar)
+RETURN acr.loginServer, img.name, collect({name: e.name, value: e.value, secretRef: e.secretRef}) AS env
+```
@@ -0,0 +1,24 @@
+# AppConfigurationStore
+
+Represents Azure App Configuration Stores.
+
+**Labels:** `:ArmResource:AppConfigurationStore`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `creationDate` - Creation date
+- `endpoint` - Configuration store endpoint
+- `disableLocalAuth` - Whether local authentication is disabled
+- `enablePurgeProtection` - Whether purge protection is enabled
+- `softDeleteRetentionInDays` - Soft delete retention period in days
+- `defaultKeyValueRevisionRetentionPeriodInSeconds` - Default key-value revision retention period in seconds
+
+## Examples
+
+```cypher
+// Find App Configuration stores with local auth enabled
+MATCH (ac:AppConfigurationStore)
+WHERE ac.disableLocalAuth = false OR ac.disableLocalAuth IS NULL
+RETURN ac.name, ac.endpoint
+```
@@ -9,3 +9,25 @@ Represents Azure Automation accounts.
 - `id` - Automation account resource ID (primary key)
 - `creationTime` - Account creation timestamp
 - `lastModifiedTime` - Last modification timestamp
+- `registrationUrl` - Registration URL for the automation account
+- `automationHybridServiceUrl` - Automation hybrid service URL
+
+## Relationships
+
+### Outgoing
+
+- **AutomationAccount** → `HAS_RUNBOOK` → **AutomationRunbook** - Runbooks in this automation account
+
+## Examples
+
+```cypher
+// Find all automation accounts
+MATCH (aa:AutomationAccount)
+RETURN aa.name, aa.creationTime, aa.registrationUrl
+```
+
+```cypher
+// Find automation accounts and their runbooks
+MATCH (aa:AutomationAccount)-[:HAS_RUNBOOK]->(rb:AutomationRunbook)
+RETURN aa.name, rb.name, rb.runbookType
+```
@@ -0,0 +1,41 @@
+# AutomationRunbook
+
+Represents Azure Automation runbooks.
+
+**Labels:** `:ArmResource:AutomationRunbook`
+
+**Properties:**
+
+- `id` - Automation runbook resource ID (primary key)
+- `creationTime` - Runbook creation timestamp
+- `lastModifiedTime` - Last modification timestamp
+- `description` - Runbook description
+- `jobCount` - Number of jobs for this runbook
+- `runbookType` - Type of runbook (e.g., PowerShell, Python)
+- `state` - Current state of the runbook
+- `runtimeEnvironment` - Runtime environment for the runbook
+
+## Relationships
+
+### Outgoing
+
+- `HAS_PARAMETER` → **RunbookParameter** - Parameters defined for this runbook
+
+### Incoming
+
+- **AutomationAccount** → `HAS_RUNBOOK` → AutomationRunbook - Parent automation account
+
+## Examples
+
+```cypher
+// Find all PowerShell runbooks
+MATCH (rb:AutomationRunbook)
+WHERE rb.runbookType = "PowerShell"
+RETURN rb.name, rb.description, rb.state
+```
+
+```cypher
+// Find runbooks with their parameters
+MATCH (rb:AutomationRunbook)-[:HAS_PARAMETER]->(p:RunbookParameter)
+RETURN rb.name, collect(p.name) AS parameters
+```
@@ -11,6 +11,6 @@ Azure Management Groups provide a way to efficiently manage access, policies, an

 ## Relationships

- `Tenant` → `HAS_ENTITY` → `ManagementGroup` - Root management groups under tenants
- `ManagementGroup` → `HAS_ENTITY` → `ManagementGroup` - Parent-child management group hierarchy
- `ManagementGroup` → `HAS_SUBSCRIPTION` → `Subscription` - Management groups containing subscriptions
+- `Tenant` → `CONTAINS` → `ManagementGroup` - Root management groups under tenants
+- `ManagementGroup` → `CONTAINS` → `ManagementGroup` - Parent-child management group hierarchy
+- `ManagementGroup` → `CONTAINS` → `Subscription` - Management groups containing subscriptions
@@ -13,4 +13,4 @@ Represents Azure resource groups - logical containers for Azure resources.
 - `subscriptionId` - Parent subscription ID

 **Relationships:**
- `HAS_RESOURCE` → Various ARM resources
+- `CONTAINS` → Various ARM resources
@@ -16,5 +16,5 @@ Represents Azure tenants - the top-level organizational units in Azure.
 - `tenantType` - Tenant type

 **Relationships:**
- `CONTAINS` → Subscription
+- `CONTAINS` → ManagementGroup
 - `ASSOCIATED_WITH` → GraphOrg (bidirectional)
@@ -0,0 +1,13 @@
+# B2CDirectory
+
+Represents Azure Active Directory B2C directories.
+
+**Labels:** `:ArmResource:B2CDirectory`
+
+**Properties:**
+
+- `id` - B2C directory resource ID (primary key)
+- `tenantId` - Associated tenant ID
+
+**Relationships:**
+- `ASSOCIATED_WITH` → Tenant
@@ -0,0 +1,39 @@
+# AzureStackEdgeMachine
+
+Represents Azure Stack HCI edge machine resources.
+
+**Labels:** `:ArmResource:AzureStackEdgeMachine`
+
+**Properties:**
+
+- `id` - Edge machine resource ID (primary key)
+- `arcMachineResourceGroupId` - Resource group ID of the associated Arc machine
+- `arcMachineResourceId` - Resource ID of the associated Arc machine
+- `cloudId` - Cloud identifier this edge machine is registered with
+- `connectivityStatus` - Connectivity status of the edge machine
+- `devicePoolResourceId` - Device pool resource ID
+- `edgeMachineKind` - Kind/type of edge machine
+- `lastUpdated` - Last update timestamp
+- `lastSyncTimestamp` - Last synchronization timestamp
+- `machineState` - Current machine state
+
+## Relationships
+
+### Outgoing
+
+- **AzureStackEdgeMachine** → `REGISTERED_BY` → **GraphObject** - Identity that registered this edge machine
+- **AzureStackEdgeMachine** → `HAS_NIC` → **AzureStackEdgeMachineNic** - Network interfaces attached to this edge machine
+
+## Examples
+
+```cypher
+// Find all edge machines and their connectivity status
+MATCH (em:AzureStackEdgeMachine)
+RETURN em.id, em.edgeMachineKind, em.connectivityStatus, em.machineState
+```
+
+```cypher
+// Find edge machines and their network interfaces
+MATCH (em:AzureStackEdgeMachine)-[:HAS_NIC]->(nic:AzureStackEdgeMachineNic)
+RETURN em.id, nic.adapterName, nic.ip4Address, nic.macAddress
+```
@@ -0,0 +1,30 @@
+# AzureStackRegistration
+
+Represents Azure Stack registration resources, which link on-premises Azure Stack hardware to an Azure subscription.
+
+**Labels:** `:ArmResource:AzureStackRegistration`
+
+**Properties:**
+
+- `id` - Registration resource ID (primary key)
+- `cloudId` - Cloud identifier for the registered Azure Stack
+
+## Relationships
+
+### Outgoing
+
+- **AzureStackRegistration** → `REGISTERED_BY` → **GraphObject** - Identity that registered this Azure Stack
+
+## Examples
+
+```cypher
+// Find all Azure Stack registrations
+MATCH (r:AzureStackRegistration)
+RETURN r.id, r.cloudId
+```
+
+```cypher
+// Find registrations and who registered them
+MATCH (r:AzureStackRegistration)-[:REGISTERED_BY]->(obj:GraphObject)
+RETURN r.id, r.cloudId, obj.id
+```
@@ -0,0 +1,27 @@
+# RedisCache
+
+Represents Azure Cache for Redis instances.
+
+**Labels:** `:ArmResource:RedisCache`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `hostname` - Host name
+- `disableAccessKeyAuthentication` - Whether access key authentication is disabled
+- `enableNonSslPort` - Whether non-SSL port is enabled
+- `minimumTlsVersion` - Minimum TLS version
+- `port` - Redis port
+- `sslPort` - Redis SSL port
+- `redisVersion` - Redis version
+- `updateChannel` - Update channel
+- `instancePorts` - List of SSL ports for instances
+
+## Examples
+
+```cypher
+// Find Redis caches with non-SSL port enabled
+MATCH (r:RedisCache)
+WHERE r.enableNonSslPort = true
+RETURN r.name, r.hostname, r.minimumTlsVersion
+```
@@ -0,0 +1,16 @@
+# AfdEndpoint
+
+Represents Azure Front Door (AFD) endpoints within CDN profiles.
+
+**Labels:** `:ArmResource:AfdEndpoint`
+
+**Properties:**
+
+- `id` - AFD endpoint resource ID (primary key)
+- `deploymentStatus` - Current deployment status of the endpoint
+- `hostName` - Host name of the endpoint
+- `enabledState` - Whether the endpoint is enabled or disabled
+- `enforceMtls` - Whether mutual TLS is enforced
+
+**Relationships:**
+- Connected to CDN Profile via `HAS_ENDPOINT` relationship (reverse direction)
@@ -0,0 +1,15 @@
+# CdnProfile
+
+Represents Azure Content Delivery Network (CDN) profiles.
+
+**Labels:** `:ArmResource:CdnProfile`
+
+**Properties:**
+
+- `id` - CDN profile resource ID (primary key)
+- `frontDoorId` - Front Door ID (if applicable)
+- `resourceState` - Current state of the CDN profile
+- `sku` - SKU/pricing tier of the CDN profile
+
+**Relationships:**
+- `HAS_ENDPOINT` → AfdEndpoint (for Azure Front Door endpoints)
@@ -0,0 +1,19 @@
+# ComputeImage
+
+Represents a compute image resource that can be used to create virtual machines.
+
+**Labels:** `:ArmResource`, `:ComputeImage`
+
+**Properties:**
+
+- `id` - Resource identifier (primary key)
+- `hyperVGeneration` - Hyper-V generation of the image
+- `provisioningState` - Current provisioning state
+- `blobUri` - URI of the blob containing the image (when applicable)
+- `osType` - Operating system type (Linux/Windows)
+- `osState` - Operating system state (Generalized/Specialized)
+- `diskSizeGB` - Size of the disk in gigabytes
+
+## Relationships
+
+- **HAS_SOURCE** → **VirtualMachine** - Links to the source virtual machine if the image was created from a VM
@@ -0,0 +1,26 @@
+# DiskEncryptionSet
+
+Represents Azure Disk Encryption Sets (DES).
+
+**Labels:** `:ArmResource:DiskEncryptionSet`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `activeKey` - Active key URL
+- `encryptionType` - Encryption type
+- `lastKeyRotationTimestamp` - Last key rotation time
+- `rotationToLatestKeyVersionEnabled` - Automatic rotation enabled
+
+## Relationships
+
+### Outgoing
+- **DiskEncryptionSet** → `USES_KEY_VAULT` → **KeyVault** - Key Vault that holds the active key
+
+## Examples
+
+```cypher
+// DES with their Key Vaults
+MATCH (des:DiskEncryptionSet)-[:USES_KEY_VAULT]->(kv:KeyVault)
+RETURN des.id, kv.vaultUri, des.activeKey
+```
@@ -10,8 +10,15 @@ Represents Azure managed disks.
 - `diskSizeGB` - Disk size in GB
 - `diskState` - Current disk state
 - `osType` - OS type (if OS disk)
+- `hyperVGeneration` - Hyper-V generation
 - `networkAccessPolicy` - Network access policy
 - `publicNetworkAccess` - Public network access setting
+- `timeCreated` - Creation timestamp
+- `uniqueId` - Unique identifier
+- `fromImage` - Source image ID when created FromImage
+- `sourceUri` - Source URI or resource when imported/copied

 **Relationships:**
 - `HAS_SNAPSHOT` ← Snapshot
+- `HAS_SOURCE` ← StorageAccount - Source storage for Import/Copy operations
+- `ENCRYPTED_BY` → DiskEncryptionSet - Encryption configuration
@@ -0,0 +1,28 @@
+# GalleryImageVersion
+
+Represents Azure Compute Gallery Image Versions.
+
+**Labels:** `:ArmResource:GalleryImageVersion`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `excludedFromLatest` - Whether excluded from latest
+- `publishedDate` - Published date
+- `replicaCount` - Replica count
+- `storageAccountType` - Storage account type
+
+## Relationships
+
+### Outgoing
+
+- **GalleryImageVersion** → `HAS_SOURCE` → **Disk** - Source OS disk image
+- **GalleryImageVersion** → `HAS_SOURCE` → **ComputeImage** - Source compute image
+
+## Examples
+
+```cypher
+// Find gallery image versions and their sources
+MATCH (giv:GalleryImageVersion)-[:HAS_SOURCE]->(src)
+RETURN giv.name, giv.publishedDate, labels(src), src.id
+```
@@ -0,0 +1,35 @@
+# GalleryImage
+
+Represents Azure Compute Gallery Image definitions.
+
+**Labels:** `:ArmResource:GalleryImage`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `architecture` - CPU architecture (e.g. x64, Arm64)
+- `osType` - OS type (Windows or Linux)
+- `hyperVGeneration` - Hyper-V generation (V1 or V2)
+- `offer` - Image offer identifier
+- `publisher` - Image publisher
+- `sku` - Image SKU
+- `osState` - OS state (Generalized or Specialized)
+- `provisioningState` - Provisioning state
+
+## Relationships
+
+### Incoming
+
+- **Gallery** → `HAS_GALLERY_IMAGE` → **GalleryImage** - Parent gallery contains this image definition
+
+### Outgoing
+
+- **GalleryImage** → `HAS_VERSION` → **GalleryImageVersion** - Versions of this image definition
+
+## Examples
+
+```cypher
+// Find gallery images and their parent galleries
+MATCH (g)-[:HAS_GALLERY_IMAGE]->(gi:GalleryImage)
+RETURN g.name, gi.name, gi.osType, gi.publisher, gi.offer, gi.sku
+```
@@ -7,6 +7,8 @@ Represents VM restore point collections.
 **Properties:**

 - `id` - Restore point collection resource ID (primary key)
+- `restorePointCollectionId` - Collection identifier used for VM correlation

 **Relationships:**
- `HAS_RESTOREPOINT` ← ArmResource (source VM)
+- `HAS_RESTOREPOINTS` <- VirtualMachine (source VM)
+- `HAS_INSTANCE` -> RestorePoint (instances in the collection)
@@ -0,0 +1,14 @@
+# RestorePoint
+
+Represents individual restore point instances inside a restore point collection.
+
+**Labels:** `:ArmResource:RestorePoint`
+
+**Properties:**
+
+- `id` - Restore point ARM resource ID (primary key)
+- `consistencyMode` - Snapshot consistency mode
+- `timeCreated` - Time the restore point was created
+
+**Relationships:**
+- `HAS_INSTANCE` <- RestorePointCollection (parent collection)
@@ -0,0 +1,23 @@
+# VMScaleSet
+
+Represents Azure Virtual Machine Scale Sets.
+
+**Labels:** `:ArmResource:VMScaleSet`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `constrainedMaximumCapacity` - Max capacity when constrained
+- `orchestrationMode` - Orchestration mode (Flexible/Uniform)
+- `uniqueId` - Unique identifier
+- `timeCreated` - Creation timestamp
+- `adminUsername` - Admin username on the VM profile
+- `computerNamePrefix` - Computer name prefix for instances
+
+## Examples
+
+```cypher
+// List VMSS with orchestration mode
+MATCH (s:VMScaleSet)
+RETURN s.id, s.orchestrationMode, s.constrainedMaximumCapacity
+```
@@ -14,4 +14,31 @@ Represents Azure virtual machines.
 - `vmId` - Virtual machine ID
 - `os` - Operating system type
 - `image` - VM image offer
- `imageVersion` - VM image version
+- `imageVersion` - VM image version
+
+## Relationships
+
+### Outgoing
+
+- **VirtualMachine** → `HAS_NIC` → **NetworkInterface** - Network interfaces attached to the VM
+- **VirtualMachine** → `HAS_EXTENSION` → **VMExtension** - Extensions installed on the VM
+
+## Examples
+
+```cypher
+// Find all VMs with their sizes
+MATCH (vm:VirtualMachine)
+RETURN vm.computerName, vm.vmSize, vm.os
+```
+
+```cypher
+// Find VMs and their network interfaces
+MATCH (vm:VirtualMachine)-[:HAS_NIC]->(nic:NetworkInterface)
+RETURN vm.computerName, collect(nic.name) AS networkInterfaces
+```
+
+```cypher
+// Find VMs with extensions
+MATCH (vm:VirtualMachine)-[:HAS_EXTENSION]->(ext:VMExtension)
+RETURN vm.computerName, ext.name, ext.type
+```
@@ -11,6 +11,7 @@ Represents virtual machine extensions (not an ARM resource itself).
 - `type` - Extension type
 - `location` - Extension location
 - `provisioningState` - Provisioning state
+- `settings` - Extension settings

 **Relationships:**
 - `HAS_EXTENSION` ← VirtualMachine
@@ -0,0 +1,19 @@
+# VMRunCommand
+
+Represents a run command associated with a virtual machine for executing scripts and commands.
+
+**Labels:** `:ArmResource`, `:VMRunCommand`
+
+**Properties:**
+
+- `id` - Resource identifier (primary key)
+- `asyncExecution` - Whether the command executes asynchronously
+- `runAsUser` - User context for command execution
+- `timeoutInSeconds` - Command execution timeout
+- `treatFailureAsDeploymentFailure` - Whether command failure should be treated as deployment failure
+- `script` - Script content to execute
+
+## Relationships
+
+- **VirtualMachine** → **HAS_RUN_COMMAND** → **VMRunCommand** - Associated with virtual machines
+- **HAS_PARAMETER** → **VMRunCommandParameter** - Contains command parameters
@@ -0,0 +1,14 @@
+# ContainerGroup
+
+Represents an Azure Container Instances container group that hosts one or more containers.
+
+**Labels:** `:ArmResource`, `:ContainerGroup`
+
+**Properties:**
+
+- `id` - Resource identifier (primary key)
+- `nameservers` - DNS nameservers configuration
+
+## Relationships
+
+- **HAS_CONTAINER** → **Container** - Contains individual containers
@@ -17,9 +17,4 @@ Represents Azure Container Registry instances.
 - `metadataSearch` - Metadata search setting
 - `networkRuleBypassOptions` - Network rule bypass options
 - `publicNetworkAccess` - Public network access setting
- `createdAt` - System creation timestamp
- `createdBy` - Created by user
- `createdByType` - Created by type
- `lastModifiedAt` - Last modification timestamp
- `lastModifiedBy` - Last modified by user
- `lastModifiedByType` - Last modified by type
+- `roleAssignmentMode` - Role assignment mode
@@ -0,0 +1,17 @@
+# GrafanaDashboard
+
+Represents Azure Managed Grafana instances.
+
+**Labels:** `:ArmResource:GrafanaDashboard`
+
+**Properties:**
+
+- `id` - Grafana instance resource ID (primary key)
+- `apiKey` - API key for the Grafana instance
+- `creatorCanAdmin` - Whether the creator has admin privileges
+- `deterministicOutboundIp` - Whether deterministic outbound IP is enabled
+- `endpoint` - Grafana endpoint URL
+- `smtpEnabled` - Whether SMTP is enabled
+- `grafanaMajorVersion` - Major version of Grafana
+- `grafanaVersion` - Full version of Grafana
+- `publicNetworkAccess` - Public network access setting
@@ -0,0 +1,28 @@
+# DocumentDB
+
+Represents Azure Cosmos DB (DocumentDB) Database Accounts.
+
+**Labels:** `:ArmResource:DocumentDB`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `enabledApiTypes` - Enabled API types
+- `documentEndpoint` - Document endpoint
+- `instanceId` - Instance ID
+- `networkAclBypass` - Network ACL bypass setting
+- `publicNetworkAccess` - Public network access setting
+- `sqlEndpoint` - SQL endpoint
+- `readLocations` - List of read location endpoints
+- `writeLocations` - List of write location endpoints
+- `ipRules` - List of IP rules
+- `isVirtualNetworkFilterEnabled` - Whether virtual network filter is enabled
+
+## Examples
+
+```cypher
+// Find Cosmos DB accounts with public access
+MATCH (db:DocumentDB)
+WHERE db.publicNetworkAccess = 'Enabled'
+RETURN db.name, db.enabledApiTypes, db.documentEndpoint
+```
@@ -0,0 +1,33 @@
+# EventGridSystemTopic
+
+Represents Azure Event Grid system topics.
+
+**Labels:** `:ArmResource:EventGridTopic`
+
+**Properties:**
+
+- `id` - Event Grid system topic resource ID (primary key)
+- `metricResourceId` - Metric resource identifier
+- `source` - Source of the system topic
+- `topicType` - Type of the system topic
+
+## Relationships
+
+### Outgoing
+
+- **EventGridSystemTopic** → `HAS_SOURCE` → **ArmResource** - Source resource for the system topic
+
+## Examples
+
+```cypher
+// Find all Event Grid system topics
+MATCH (topic:EventGridTopic)
+WHERE topic.topicType IS NOT NULL
+RETURN topic.name, topic.source, topic.topicType
+```
+
+```cypher
+// Find system topics and their source resources
+MATCH (topic:EventGridTopic)-[:HAS_SOURCE]->(source:ArmResource)
+RETURN topic.name, topic.topicType, source.name
+```
@@ -0,0 +1,17 @@
+# EventHubNamespace
+
+Represents an Event Hub namespace resource for streaming and event ingestion.
+
+**Labels:** `:ArmResource`, `:EventHubNamespace`
+
+**Properties:**
+
+- `id` - Resource identifier (primary key)
+- `createdAt` - Timestamp when the namespace was created
+- `disableLocalAuth` - Whether local authentication is disabled
+- `isAutoInflateEnabled` - Whether auto-inflate is enabled for throughput units
+- `kafkaEnabled` - Whether Kafka is enabled for the namespace
+- `publicNetworkAccess` - Public network access configuration
+- `serviceBusEndpoint` - Service Bus endpoint URL
+- `status` - Current status of the namespace
+- `updatedAt` - Timestamp when the namespace was last updated
@@ -0,0 +1,17 @@
+# FabricCapacity
+
+Represents Microsoft Fabric capacities.
+
+**Labels:** `:ArmResource:FabricCapacity`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `members` - Administration members list
+
+## Examples
+
+```cypher
+MATCH (c:FabricCapacity)
+RETURN c.id, c.members
+```
@@ -1,20 +1,41 @@
 # HybridExtension

-Represents extensions installed on hybrid machines (not an ARM resource itself).
+Represents extensions installed on Azure Arc-enabled hybrid machines.

-**Labels:** `:HybridExtension`
+**Labels:** `:ArmResource:HybridExtension`

 **Properties:**

- `id` - Extension ID (primary key)
+- `id` - Extension resource ID (primary key)
 - `name` - Extension name
- `type` - Extension type
- `location` - Extension location
+- `type` - Resource type (`microsoft.hybridcompute/machines/extensions`)
+- `location` - Resource location
+- `extType` - Extension type (e.g. `CustomScriptExtension`)
 - `typeHandlerVersion` - Type handler version
 - `autoUpgradeMinorVersion` - Auto upgrade minor version
 - `enableAutomaticUpgrade` - Enable automatic upgrade
- `statusMessage` - Status message
+- `statusMessage` - Extension status message
 - `provisioningState` - Provisioning state
+- `publisher` - Extension publisher
+- `settings` - Serialized extension settings (JSON)

-**Relationships:**
- `HAS_EXTENSION` ← HybridMachine
+## Relationships
+
+### Incoming
+
+- **HybridMachine** → `HAS_EXTENSION` → **HybridExtension** - Parent hybrid machine
+
+## Examples
+
+```cypher
+// Find all hybrid machine extensions
+MATCH (hm:HybridMachine)-[:HAS_EXTENSION]->(ext:HybridExtension)
+RETURN hm.displayName, ext.name, ext.extType, ext.provisioningState
+```
+
+```cypher
+// Find extensions with auto upgrade enabled
+MATCH (ext:HybridExtension)
+WHERE ext.enableAutomaticUpgrade = true
+RETURN ext.name, ext.extType, ext.typeHandlerVersion
+```
@@ -0,0 +1,23 @@
+# HybridGateway
+
+Represents an Azure Arc gateway resource used to connect hybrid machines to Azure through a managed endpoint.
+
+**Labels:** `:ArmResource:HybridGateway`
+
+**Properties:**
+
+- `id` - Gateway resource ID (primary key)
+- `allowedFeatures` - Features allowed through the gateway
+- `gatewayEndpoint` - Gateway endpoint URL
+- `gatewayId` - Unique gateway identifier
+- `gatewayType` - Type of gateway
+- `lastUpdateTime` - Last update timestamp
+- `provisioningState` - Provisioning state
+
+## Examples
+
+```cypher
+// Find all hybrid gateways
+MATCH (gw:HybridGateway)
+RETURN gw.id, gw.gatewayType, gw.gatewayEndpoint, gw.provisioningState
+```
@@ -0,0 +1,21 @@
+# HybridPrivateLinkScope
+
+Represents an Azure Arc private link scope resource used to connect hybrid machines over private endpoints.
+
+**Labels:** `:ArmResource:HybridPrivateLinkScope`
+
+**Properties:**
+
+- `id` - Private link scope resource ID (primary key)
+- `privateLinkScopeId` - Unique private link scope identifier
+- `provisioningState` - Provisioning state
+- `publicNetworkAccess` - Public network access setting
+
+## Examples
+
+```cypher
+// Find private link scopes with public access enabled
+MATCH (pls:HybridPrivateLinkScope)
+WHERE pls.publicNetworkAccess = "Enabled"
+RETURN pls.id, pls.privateLinkScopeId
+```
@@ -0,0 +1,27 @@
+# ActivityLogAlert
+
+Represents Azure Monitor Activity Log Alerts.
+
+**Labels:** `:ArmResource:ActivityLogAlert`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `description` - Alert description
+- `enabled` - Whether the alert is enabled
+- `condition` - Alert condition (JSON)
+
+## Relationships
+
+### Incoming
+
+- **ArmResource** → `HAS_ALERT` → **ActivityLogAlert** - Any ARM resource in scope fires this alert
+
+## Examples
+
+```cypher
+// Find all enabled alerts and their scoped resources
+MATCH (r:ArmResource)-[:HAS_ALERT]->(a:ActivityLogAlert)
+WHERE a.enabled = true
+RETURN r.id, labels(r), a.id, a.description
+```
@@ -13,6 +13,11 @@ Represents Azure Key Vault instances.
 - `publicNetworkAccess` - Public network access setting
 - `softDeleteRetentionInDays` - Soft delete retention period
 - `vaultUri` - Key Vault URI
+- `networkAclBypass` - Network ACL bypass setting
+- `networkAclDefaultAction` - Network ACL default action
+- `allowedIps` - Allowed IP rules

 **Relationships:**
 - `HAS_POLICY` → GraphObject (access policies for users/service principals)
+- `HAS_SECRET` → KeyVaultSecret
+- `HAS_CERTIFICATE` → KeyVaultCertificate
@@ -0,0 +1,31 @@
+# ManagedHSM
+
+Represents Azure Key Vault Managed HSM resources.
+
+**Labels:** `:ManagedHSM`
+
+**Properties:**
+
+- `id` - Managed HSM resource ID (primary key)
+- `enablePurgeProtection` - Whether purge protection is enabled
+- `enableSoftDelete` - Whether soft delete is enabled
+- `hsmUri` - Managed HSM URI
+- `publicNetworkAccess` - Public network access setting
+- `activationStatus` - Security domain activation status
+- `activationStatusMessage` - Security domain activation status message
+- `softDeleteRetentionInDays` - Soft delete retention period
+- `statusMessage` - Service status message
+
+## Relationships
+
+### Incoming
+
+- **GraphObject** → `IS_ADMIN` → **ManagedHSM** - Directory object configured as initial HSM administrator
+
+## Examples
+
+```cypher
+// Find Managed HSM resources and their administrators
+MATCH (go:GraphObject)-[:IS_ADMIN]->(hsm:ManagedHSM)
+RETURN hsm.id, hsm.hsmUri, go.id
+```
@@ -0,0 +1,41 @@
+# KustoCluster
+
+Represents Azure Data Explorer (Kusto) cluster resources.
+
+**Labels:** `:ArmResource:KustoCluster`
+
+**Properties:**
+
+- `id` - Cluster resource ID (primary key)
+- `acceptedAudiences` - Audiences accepted by the cluster
+- `allowedFqdnList` - List of allowed fully qualified domain names
+- `allowedIpRangeList` - List of allowed IP ranges
+- `dataIngestionUri` - URI for data ingestion
+- `enableAutoStop` - Whether auto-stop is enabled
+- `enableDiskEncryption` - Whether disk encryption is enabled
+- `enableDoubleEncryption` - Whether double encryption is enabled
+- `enablePurge` - Whether purge is enabled
+- `enableStreamingIngest` - Whether streaming ingestion is enabled
+- `engineType` - Type of engine (e.g., V3)
+- `publicIpType` - Type of public IP configuration
+- `publicNetworkAccess` - Public network access setting
+- `restrictOutboundNetworkAccess` - Whether outbound network access is restricted
+- `state` - Cluster state (e.g., Running, Unavailable)
+- `stateReason` - Reason for the cluster state
+- `trustedExternalTenants` - List of trusted external tenant IDs
+- `uri` - Cluster URI/endpoint
+
+## Examples
+
+```cypher
+// Find all Kusto clusters and their states
+MATCH (kc:KustoCluster)
+RETURN kc.id, kc.state, kc.uri, kc.enableAutoStop
+```
+
+```cypher
+// Find Kusto clusters with specific security settings
+MATCH (kc:KustoCluster)
+WHERE kc.enableDoubleEncryption = true AND kc.publicNetworkAccess = 'Disabled'
+RETURN kc.id, kc.uri
+```
@@ -0,0 +1,29 @@
+# MLWorkspace
+
+Represents Azure Machine Learning Workspaces.
+
+**Labels:** `:ArmResource:MLWorkspace`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `allowRoleAssignmentOnRG` - Allow role assignment on resource group
+- `creationTime` - Creation time
+- `discoveryUrl` - Discovery URL
+- `friendlyName` - Friendly name
+- `networkAclBypass` - Network ACL bypass setting
+- `networkAclDefaultAction` - Network ACL default action
+- `notebookInfoFqdn` - Notebook info FQDN
+- `isPrivateLinkEnabled` - Whether private link is enabled
+- `publicNetworkAccess` - Public network access setting
+- `softDeleteEnabled` - Whether soft delete is enabled
+- `tenantId` - Tenant ID
+
+## Examples
+
+```cypher
+// Find ML workspaces with public network access
+MATCH (ml:MLWorkspace)
+WHERE ml.publicNetworkAccess = 'Enabled'
+RETURN ml.name, ml.friendlyName
+```
@@ -0,0 +1,19 @@
+# NetAppAccount
+
+Represents an Azure NetApp Files account for managing file storage pools and volumes.
+
+**Labels:** `:ArmResource`, `:NetAppAccount`
+
+**Properties:**
+
+- `id` - Resource identifier (primary key)
+- `multiADStatus` - Status of multi-Active Directory configuration
+- `provisioningState` - Current provisioning state
+- `encryptionKeySource` - Source of encryption keys
+
+## Relationships
+
+- **IS_DEPLOYED** → **NetAppAccountADDomain** - Links to Active Directory domain configurations
+- **CONTAINS** → **NetAppCapacityPool** - Contains capacity pools
+- **HAS_BACKUP_VAULT** → **NetAppBackupVault** - Associated backup vaults
+- **HAS_POLICY** → **NetAppSnapshotPolicy** - Associated snapshot policies
@@ -0,0 +1,14 @@
+# NetAppBackupVault
+
+Represents a backup vault for Azure NetApp Files account backups.
+
+**Labels:** `:ArmResource`, `:NetAppBackupVault`
+
+**Properties:**
+
+- `id` - Resource identifier (primary key)
+- `provisioningState` - Current provisioning state
+
+## Relationships
+
+- **NetAppAccount** → **HAS_BACKUP_VAULT** → **NetAppBackupVault** - Associated backup vault for the NetApp account
@@ -0,0 +1,19 @@
+# NetAppCapacityPool
+
+Represents a capacity pool within an Azure NetApp Files account for managing storage capacity and performance tiers.
+
+**Labels:** `:ArmResource`, `:NetAppCapacityPool`
+
+**Properties:**
+
+- `id` - Resource identifier (primary key)
+- `coolAccess` - Whether cool access tier is enabled
+- `encryptionType` - Type of encryption applied
+- `poolId` - Unique pool identifier
+- `qosType` - Quality of Service type (Auto/Manual)
+- `size` - Size of the capacity pool in bytes
+
+## Relationships
+
+- **NetAppAccount** → **CONTAINS** → **NetAppCapacityPool** - Contained within NetApp accounts
+- **CONTAINS** → **NetAppVolume** - Contains volumes
@@ -0,0 +1,27 @@
+# NetAppSnapshotPolicy
+
+Represents a snapshot policy for Azure NetApp Files volumes that defines automated backup schedules.
+
+**Labels:** `:ArmResource`, `:NetAppSnapshotPolicy`
+
+**Properties:**
+
+- `id` - Resource identifier (primary key)
+- `enabled` - Whether the policy is enabled
+- `dailyScheduleHour` - Hour for daily snapshots
+- `dailyScheduleMinute` - Minute for daily snapshots
+- `dailyScheduleSnapshotsToKeep` - Number of daily snapshots to retain
+- `hourlyScheduleMinute` - Minute for hourly snapshots
+- `hourlyScheduleSnapshotsToKeep` - Number of hourly snapshots to retain
+- `weeklyScheduleDay` - Day of week for weekly snapshots
+- `weeklyScheduleHour` - Hour for weekly snapshots
+- `weeklyScheduleMinute` - Minute for weekly snapshots
+- `weeklyScheduleSnapshotsToKeep` - Number of weekly snapshots to retain
+- `monthlyScheduleDaysOfMonth` - Days of month for monthly snapshots
+- `monthlyScheduleHour` - Hour for monthly snapshots
+- `monthlyScheduleMinute` - Minute for monthly snapshots
+- `monthlyScheduleSnapshotsToKeep` - Number of monthly snapshots to retain
+
+## Relationships
+
+- **NetAppAccount** → **HAS_POLICY** → **NetAppSnapshotPolicy** - Associated with NetApp accounts
@@ -0,0 +1,34 @@
+# NetAppVolume
+
+Represents a volume within an Azure NetApp Files capacity pool.
+
+**Labels:** `:ArmResource`, `:NetAppVolume`
+
+**Properties:**
+
+- `id` - Resource identifier (primary key)
+- `baremetalTenantId` - Bare metal tenant identifier
+- `coolAccess` - Cool access configuration
+- `creationToken` - Unique creation token for the volume
+- `enableSubvolumes` - Whether subvolumes are enabled
+- `encryptionKeySource` - Source of encryption keys
+- `fileSystemId` - File system identifier
+- `isDefaultQuotaEnabled` - Whether default quota is enabled
+- `isLargeVolume` - Whether this is a large volume
+- `kerberosEnabled` - Whether Kerberos authentication is enabled
+- `ldapEnabled` - Whether LDAP is enabled
+- `maximumNumberOfFiles` - Maximum number of files allowed
+- `protocolTypes` - Supported protocol types (NFSv3, NFSv4.1, SMB, etc.)
+- `securityStyle` - Security style (Unix/NTFS/Mixed)
+- `smbAccessBasedEnumeration` - SMB access-based enumeration setting
+- `smbContinuouslyAvailable` - SMB continuously available setting
+- `smbEncryption` - SMB encryption setting
+- `smbNonBrowsable` - SMB non-browsable setting
+- `snapshotDirectoryVisible` - Whether snapshot directory is visible
+- `usageThreshold` - Usage threshold in bytes
+- `volumeType` - Type of volume
+
+## Relationships
+
+- **NetAppCapacityPool** → **CONTAINS** → **NetAppVolume** - Contained within capacity pools
+- **MOUNTS** → **NetAppVolumeMount** - Associated mount targets
@@ -0,0 +1,31 @@
+# ExpressRouteCircuit
+
+Represents Azure ExpressRoute Circuit resources.
+
+**Labels:** `:ArmResource:ExpressRouteCircuit`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `allowClassicOperations` - Whether classic operations are allowed
+- `allowGlobalReach` - Whether Global Reach is allowed
+- `authorizationKey` - Authorization key
+- `circuitProvisioningState` - Circuit provisioning state
+- `serviceProviderProvisioningState` - Service provider provisioning state
+- `bandwidthInMbps` - Bandwidth in Mbps
+- `peeringLocation` - Peering location
+- `serviceProviderName` - Service provider name
+
+## Relationships
+
+### Outgoing
+
+- **ExpressRouteCircuit** → `HAS_PEERING` → **ExpressRouteCircuitPeering** - Circuit peering configurations
+
+## Examples
+
+```cypher
+// Find ExpressRoute circuits and their peerings
+MATCH (erc:ExpressRouteCircuit)-[:HAS_PEERING]->(p:ExpressRouteCircuitPeering)
+RETURN erc.name, p.peeringType, p.state, erc.bandwidthInMbps
+```
@@ -0,0 +1,24 @@
+# GitHub Network Settings
+
+Represents Azure GitHub network settings resources used to associate GitHub connectivity settings with a subnet.
+
+**Labels:** `:ArmResource:GithubNetworkSettings`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `businessId` - GitHub business identifier associated with the network setting
+
+## Relationships
+
+### Incoming
+
+- **ArmResource** → `HAS_GITHUB_SETTING` → **GithubNetworkSettings** - Subnet resource associated with this GitHub network setting
+
+## Examples
+
+```cypher
+// Find GitHub network settings and their linked subnet resources
+MATCH (sub:ArmResource)-[:HAS_GITHUB_SETTING]->(setting:GithubNetworkSettings)
+RETURN sub.id, setting.businessId
+```
@@ -0,0 +1,29 @@
+# LoadBalancer
+
+Represents Azure Load Balancer resources.
+
+**Labels:** `:ArmResource:LoadBalancer`
+
+**Properties:**
+
+- `id` - Load balancer resource ID (primary key)
+- `resourceGuid` - Azure-generated unique resource GUID
+- `provisioningState` - Current provisioning state
+
+## Relationships
+
+### Outgoing
+
+- **LoadBalancer** -> `HAS_RULE` -> **LoadBalancerRule** - Load balancing rules attached to the load balancer
+- **LoadBalancer** -> `HAS_LB_FRONTEND` -> **LoadBalancerFrontendIPConfiguration** - Frontend IP configurations
+- **LoadBalancer** -> `HAS_BACKEND_POOL` -> **LoadBalancerBackendAddressPool** - Backend address pools
+
+## Examples
+
+```cypher
+// Find load balancers with frontend and backend topology
+MATCH (lb:LoadBalancer)
+OPTIONAL MATCH (lb)-[:HAS_LB_FRONTEND]->(fe:LoadBalancerFrontendIPConfiguration)
+OPTIONAL MATCH (lb)-[:HAS_BACKEND_POOL]->(be:LoadBalancerBackendAddressPool)
+RETURN lb.name, count(DISTINCT fe) AS frontendCount, count(DISTINCT be) AS backendPoolCount
+```
@@ -12,7 +12,27 @@ Represents network interfaces attached to VMs.
 - `appliedDnsServers` - Applied DNS servers
 - `dnsServers` - Configured DNS servers

-**Relationships:**
- `HAS_CONFIG` → IPConfig
- `HAS_NSG` → NSG (Network Security Group)
- `HAS_NIC` ← VirtualMachine
+## Relationships
+
+### Incoming
+
+- **VirtualMachine** → `HAS_NIC` → **NetworkInterface** - VM using this network interface
+
+### Outgoing
+
+- **NetworkInterface** → `HAS_NSG` → **NetworkSecurityGroup** - Associated network security group
+- **NetworkInterface** → `HAS_CONFIG` → **IPConfiguration** - IP configurations
+
+## Examples
+
+```cypher
+// Find network interfaces and their VMs
+MATCH (vm:VirtualMachine)-[:HAS_NIC]->(nic:NetworkInterface)
+RETURN vm.computerName, nic.macAddress, nic.allowPort25Out
+```
+
+```cypher
+// Find network interfaces with their IP configurations
+MATCH (nic:NetworkInterface)-[:HAS_CONFIG]->(ip:IPConfiguration)
+RETURN nic.name, ip.privateIPAddress, ip.privateIPAllocationMethod
+```
@@ -0,0 +1,12 @@
+# NetworkWatcher
+
+Represents Azure Network Watcher resources.
+
+**Labels:** `:ArmResource:NetworkWatcher`
+
+**Properties:**
+
+- `id` - Network Watcher resource ID (primary key)
+- `provisioningState` - Current provisioning state
+
+No additional relationships are created for NetworkWatcher nodes by the current ingestion config.
Author	SHA1	Message	Date
Leron Gray	7d0f7532aa	Update CHANGELOG for version 1.4.0 release date	2026-11-05 12:49:38 -08:00
Leron Gray	229f16c11c	fix(ci): use supported macOS runner for Apple Silicon releases (#40 )	2026-11-05 12:09:45 -08:00
Leron Gray	e4dbdb8461	Release/v1.4.0 (#39 )	2026-11-05 11:50:47 -08:00
Leron Gray	cb298b7751	chore(release): release v1.3.0	2026-09-29 16:51:37 -05:00
Leron Gray	6f190b187e	fix(collect): use correct base64 decoding for tokens (#38 )	2026-09-21 19:41:29 -05:00
Leron Gray	ae93706be7	fix(graph): check site serverfarmid for null (#37 )	2026-09-09 16:02:55 -05:00
Leron Gray	7ad8d94596	feat(collect): add user manager and password change datetime (#36 )	2026-09-09 15:53:32 -05:00
Leron Gray	9300fc2d6f	feat(graph): add odata types and agent id relations (#35 )	2026-08-24 11:05:51 -07:00
Leron Gray	30242d25d6	feat(graph): process createdByAppId (#34 )	2026-07-27 19:54:56 -07:00
Leron Gray	b43fd05c53	chore(release): release v1.2.1	2026-06-01 16:33:22 -07:00
Leron Gray	e6337a796f	fix(graph): fix merges in loadbalancer (#33 )	2026-06-01 16:27:28 -07:00
Leron Gray	3b53d223af	chore(release): release v1.2.0 (#32 )	2026-05-12 17:42:38 -05:00
Leron Gray	764aea00cb	chore(docs): update docs (#31 )	2026-05-12 17:30:24 -05:00
Leron Gray	64f09986ad	feat(graph): add network LoadBalancer nodes and VirtualHub (#30 )	2026-05-12 17:22:53 -05:00
Leron Gray	754a21ad3a	fix(graph): re-add WITH before CALLs in Cypher (#29 ) and minor bugs	2026-05-12 16:26:33 -05:00
Leron Gray	8301c64176	fix(collect): add subject for FIC collection (#28 )	2026-05-12 12:08:35 -05:00
Leron Gray	d0f5723493	chore(graph): update cypher to Cypher 25 syntax (#27 )	2026-05-11 18:58:44 -05:00
Leron Gray	36f12788a9	feat(graph): update netapp nodes (#26 )	2026-05-11 16:37:48 -05:00
Leron Gray	6f08291c70	feat(graph): add KustoCluster node (#25 )	2026-05-04 15:26:52 -07:00
Leron Gray	73839f1e98	feat(graph): add SyntexDocumentProcessor (#24 )	2026-05-04 14:57:06 -07:00
Leron Gray	bf862723d6	feat(graph): add azure stack nodes and edges (#23 )	2026-05-04 14:43:24 -07:00
Leron Gray	cdc8795d88	feat(graph): add oracle autonomous db (#22 )	2026-05-04 13:24:54 -07:00
Leron Gray	eac3b286e0	feat(graph): add multiple Hybrid nodes and parity with virtual machines (#21 )	2026-05-04 12:44:59 -07:00
Leron Gray	8ace4163e2	chore(skills): update docs skill for zensical (#20 )	2026-05-04 12:35:28 -07:00
Leron Gray	28f785fced	chore(docs): migrate docs to zensical (#19 )	2026-05-01 17:46:04 -05:00
Leron Gray	bc1c617c56	chore(docs): migrate docs to zensical (#18 )	2026-05-01 17:30:54 -05:00
Leron Gray	d0ea34d71c	fix(graph): change generic resource MI checks to CONTAINS (#17 )	2026-04-28 14:06:44 -05:00
Leron Gray	19ea3a1ac2	chore(vscode): turn off git AI CoAuthor setting (#16 )	2026-04-27 22:23:03 -05:00
Leron Gray	7364321e93	feat(graph): add ManagedHSM (#15 )	2026-04-27 22:15:24 -05:00
Leron Gray	b1826298de	feat(graph): add AnalysisServiceServer and AnalysisServiceFirewallRule (#14 )	2026-04-27 18:36:34 -05:00
Leron Gray	b99fa73eed	feat(graph): add composite index and constraints syntax (#13 )	2026-04-27 18:19:12 -05:00
Leron Gray	af36fd9141	feat(graph): add GithubNetworkSettings (#12 ) Added Nodes: GitHubNetworkSettings Added Labels: HAS_GITHUB_SETTING	2026-04-27 16:41:42 -05:00
Leron Gray	7eabae58f7	feat(graph-cli): add dry run switch for ingest (#11 )	2026-04-27 16:15:21 -05:00
Leron Gray	6ec3b0359c	feat(cli): add argument validation to applicable arguments (#7 ) (#10 )	2026-04-27 14:24:10 -05:00
Leron Gray	c26cd4c972	chore(docs): update restore point changes (#9 )	2026-04-27 13:22:53 -05:00
Leron Gray	7fd63ad662	feat(graph): improve restorepointcollections (#8 )	2026-04-27 13:08:55 -05:00
Leron Gray	bce94268a7	chore(docs): update cliff and changelog (#6 ) * chore(release): bump version to 1.1.0 * chore(docs): update cliff and changelog	2026-04-13 13:19:48 -05:00
Leron Gray	75d124a6a3	chore(release): bump version to 1.1.0 (#5 )	2026-04-13 13:05:38 -05:00
Leron Gray	5c228a5701	feat(graph): add NetworkWatcher, KeyVaultCertificate, KeyVaultCertificateValue	2026-04-13 12:44:03 -05:00
Leron Gray	0ed7fd04c4	chore(deps): add cargo.lock	2026-04-13 12:33:40 -05:00
Leron Gray	118b91685d	chore(docs): sync docs with schemas	2026-04-13 12:30:02 -05:00
Leron Gray	ad3d8f16d0	feat: add NetworkWatcher, KeyVaultCertificate, KeyVaultCertificateValue nodes	2026-04-10 16:11:46 -05:00
George Robbins	a07d3e1387	Merge pull request #2 from BishopFox/CLD-10728/add-codeowners chore(doc): add CODEOWNERS for bf-red-team (CLD-10728)	2026-04-07 16:10:05 -06:00
George RobbinsandClaude	f91e667746	chore(doc): add CODEOWNERS for bf-red-team (CLD-10728) Co-authored-by: Claude <[email protected]>	2026-04-07 16:31:51 -05:00
Leron Gray	e6adb1784a	(docs): update documentation link in README.md	2026-04-06 11:25:09 -05:00
Leron Gray	ff302f3970	Merge pull request #1 from BishopFox/docs/mkdocs-site (docs): update site_url to new domain	2026-04-03 15:02:11 -05:00
Leron Gray	473b7ce739	(docs): update site_url to new domain	2026-04-03 15:01:55 -05:00
Leron Gray	5092b5f9ea	Initial release ci: bump 1.0.0 ci: update docs-deploy.yml	2026-03-31 16:46:37 -05:00