Update CHANGELOG for version 1.4.0 release date

Added Nodes: GitHubNetworkSettings
Added Labels: HAS_GITHUB_SETTING

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @BishopFox/bf-red-team

.github/skills/SKILL.md

@@ -1,177 +0,0 @@
-# Skill: Sync Cirro Config Documentation
-
-## Description
-
-This skill synchronizes documentation in `docs/analysis/` and `mkdocs.yml` with the Cirro configuration YAML files in `src/graph/config/` and the constants defined in `src/graph/config/constants.yaml`. Use this skill when Cirro configs or constants are added or changed and documentation needs to be updated.
-
-## Trigger Phrases
-
-- "sync cirro docs"
-- "update node and edge documentation"
-- "ensure docs match cirro config"
-- "add missing cirro documentation"
-
-## Steps
-
-### 1. Read constants and identify all labels and relations
-
-Read `src/graph/config/constants.yaml` to get the full list of:
-- **REL**: All relationship/edge type constants
-- **LABELS**: All node label constants (ARM resources, Graph objects, specialized nodes, Tailscale nodes)
-
-### 2. Inventory existing documentation
-
-Collect all existing doc files:
-- `docs/analysis/graph-nodes/*.md` — Entra ID / Microsoft Graph node docs
-- `docs/analysis/arm-nodes/**/*.md` — ARM resource node docs
-- `docs/analysis/additional-nodes/*.md` — Specialized Azure node docs
-- `docs/analysis/tailscale-nodes/*.md` — Tailscale node docs
-- `docs/analysis/edges/*.md` — Edge/relationship docs
-- `docs/analysis/post-processing/*.md` — Post-processing step docs
-
-Also read `mkdocs.yml` nav section to know what's already registered.
-
-### 3. Scan all YAML config files
-
-Read all `.tera.yaml` files in:
-- `src/graph/config/azure/arm/**/*.tera.yaml` — ARM resource configs
-- `src/graph/config/azure/msgraph/*.tera.yaml` — Microsoft Graph configs
-- `src/graph/config/post_processing/*.tera.yaml` — Post-processing step configs
-- `src/graph/config/tailscale/**/*.tera.yaml` — Tailscale configs
-
-For each YAML file, extract:
-- `name` — Display name
-- `label` — Node label (references `LABELS.*` constants)
-- `properties` — Property paths collected
-- `cypher` — The Cypher query, which defines relationships (`REL.*`) and any inline child nodes
-
-### 4. Cross-reference and find gaps
-
-Compare what exists in docs vs what's defined in config:
-
-#### Missing node docs
-For each `LABELS.*` constant, check if a corresponding doc file exists. Map labels to doc paths:
-- ARM labels → `docs/analysis/arm-nodes/<provider>/<node-name>.md`
-- Graph labels → `docs/analysis/graph-nodes/graph-<name>.md`
-- Specialized labels → `docs/analysis/additional-nodes/<name>.md`
-- Tailscale labels → `docs/analysis/tailscale-nodes/ts-<name>.md`
-
-#### Missing edge docs
-For each `REL.*` constant, check if `docs/analysis/edges/<name>.md` exists (convert `UPPER_SNAKE` to `lower-kebab`).
-
-#### Missing post-processing docs
-For each file in `src/graph/config/post_processing/`, check if a corresponding doc exists in `docs/analysis/post-processing/`.
-
-#### Missing mkdocs.yml nav entries
-Check that every doc file under `docs/analysis/` is listed in the `nav:` section of `mkdocs.yml`.
-
-### 5. Create missing documentation
-
-Use the following templates based on node/edge type.
-
-#### ARM Node Template
-File path: `docs/analysis/arm-nodes/<provider>/<node-name>.md`
-
-```markdown
-# NodeDisplayName
-
-Description of what the node represents.
-
-**Labels:** `:ArmResource:NodeLabel`
-
-**Properties:**
-
-- `id` - Resource ID (primary key)
-- `propertyName` - Description
-
-## Relationships
-
-### Outgoing
-
-- **NodeLabel** → `REL_NAME` → **TargetLabel** - Description
-
-## Examples
-
-\`\`\`cypher
-// Example query
-MATCH (n:NodeLabel)
-RETURN n.name, n.property
-\`\`\`
-```
-
-#### Graph Node Template
-File path: `docs/analysis/graph-nodes/graph-<name>.md`
-
-Same structure as ARM but use **Labels:** `:GraphObject:NodeLabel`
-
-#### Edge Template
-File path: `docs/analysis/edges/<rel-name>.md`
-
-```markdown
-# REL_NAME
-
-Description of the relationship.
-
-## Usage
-
-- **SourceLabel** → `REL_NAME` → **TargetLabel** - Description
-
-## Properties
-
-No additional properties on the relationship.
-_(Or list properties if the cypher sets them on the relationship.)_
-
-## Examples
-
-\`\`\`cypher
-// Example query
-MATCH (a)-[r:REL_NAME]->(b)
-RETURN a.name, b.name
-\`\`\`
-```
-
-#### Post-Processing Template
-File path: `docs/analysis/post-processing/<step-name>.md`
-
-```markdown
-# Step Display Name
-
-Description of what this post-processing step does.
-
-**Priority:** N _(if specified in YAML)_
-
-## Details
-
-Explanation of the logic.
-
-## Cypher
-
-\`\`\`cypher
-// Cleaned-up cypher from the YAML (resolve tera template variables to readable names)
-\`\`\`
-```
-
-### 6. Create directories as needed
-
-Run `mkdir -p` for any new subdirectories before creating files (e.g., `docs/analysis/arm-nodes/paloalto/`).
-
-### 7. Update mkdocs.yml
-
-Add new pages to the `nav:` section of `mkdocs.yml` in the appropriate location:
-- **Graph Nodes** go under `Nodes and Edges > Graph Nodes`
-- **ARM Nodes** go under `Nodes and Edges > ARM Nodes > <Provider>` (create new provider section if needed)
-- **Additional Nodes** go under `Nodes and Edges > Additional Nodes`
-- **Edges** go under `Nodes and Edges > Edges` (alphabetical order)
-- **Post-Processing** goes under a top-level `Post-Processing` section
-
-Keep entries alphabetically sorted within each section.
-
-### 8. Confirm unknown items with the user
-
-If a `LABELS.*` or `REL.*` constant exists in `constants.yaml` but is **not referenced** in any `.tera.yaml` config file, ask the user whether documentation should be created for it or if it's deprecated.
-
-## Notes
-
-- The `mkdocs.yml` uses 2-space indentation for nav entries.
-- Some YAML configs define multiple node types inline in cypher (e.g., virtual networks also create Subnet and NetworkPeering nodes). Check the cypher `MERGE` statements for child nodes.
-- Post-processing configs use `apoc.periodic.iterate()` and have a `priority` field (0 = runs first).

.github/skills/cirro-schema-docs/SKILL.md

@@ -0,0 +1,153 @@
+---
+name: cirro-schema-docs
+description: Synchronize Cirro analysis documentation and mkdocs navigation with schema constants and graph config YAML files.
+---
+
+# Cirro Schema Docs Skill
+
+## Purpose
+
+Use this skill when Cirro graph config files or schema constants change and documentation must be updated to match.
+
+Primary sources of truth:
+- `src/graph/config/constants.yaml`
+- `src/graph/config/**/*.tera.yaml`
+
+Primary documentation targets:
+- `docs/analysis/**`
+- `zensical.toml` nav entries
+
+## When To Use
+
+Trigger examples:
+- sync cirro docs
+- update node and edge documentation
+- ensure docs match cirro config
+- add missing cirro documentation
+
+## Required Workflow
+
+1. Read constants.
+	- Parse `REL.*` and `LABELS.*` from `src/graph/config/constants.yaml`.
+
+2. Inventory existing docs.
+	- `docs/analysis/graph-nodes/*.md`
+	- `docs/analysis/arm-nodes/**/*.md`
+	- `docs/analysis/additional-nodes/*.md`
+	- `docs/analysis/tailscale-nodes/*.md`
+	- `docs/analysis/edges/*.md`
+	- `docs/analysis/post-processing/*.md`
+	- Also inspect the `nav:` section in `zensical.toml`.
+
+3. Scan config YAML.
+	- `src/graph/config/azure/arm/**/*.tera.yaml`
+	- `src/graph/config/azure/msgraph/*.tera.yaml`
+	- `src/graph/config/post_processing/*.tera.yaml`
+	- `src/graph/config/tailscale/**/*.tera.yaml`
+	- For each file, extract `name`, `label`, `properties`, and all relationship usage from `cypher`.
+
+4. Cross-reference and find gaps.
+	- Missing node docs from `LABELS.*`
+	- Missing edge docs from `REL.*` (convert `UPPER_SNAKE` to `lower-kebab`)
+	- Missing post-processing docs from files in `src/graph/config/post_processing/`
+	- Missing `zensical.toml` nav entries for all docs under `docs/analysis/`
+
+5. Create or update docs.
+	- Prefer minimal edits and keep style consistent with nearby files.
+	- Create missing directories before creating files.
+
+6. Update `zensical.toml` nav.
+	- Place docs in the correct analysis sections.
+	- Keep entries alphabetically sorted within each section.
+	- Preserve existing indentation and structure.
+
+7. Ask for confirmation on unused constants.
+	- If a `LABELS.*` or `REL.*` constant is not referenced by any `.tera.yaml`, ask whether to document it or treat it as deprecated.
+
+## Mapping Rules
+
+- ARM labels -> `docs/analysis/arm-nodes/<provider>/<node-name>.md`
+- Graph labels -> `docs/analysis/graph-nodes/graph-<name>.md`
+- Additional labels -> `docs/analysis/additional-nodes/<name>.md`
+- Tailscale labels -> `docs/analysis/tailscale-nodes/ts-<name>.md`
+- Edge docs -> `docs/analysis/edges/<rel-name>.md`
+- Post-processing docs -> `docs/analysis/post-processing/<step-name>.md`
+
+## Content Templates
+
+Use these as baseline structures.
+
+### Node Doc
+
+~~~markdown
+# NodeDisplayName
+
+Description of what the node represents.
+
+**Labels:** `:ArmResource:NodeLabel`
+
+**Properties:**
+- `id` - Resource ID (primary key)
+- `propertyName` - Description
+
+## Relationships
+
+### Outgoing
+- **NodeLabel** -> `REL_NAME` -> **TargetLabel** - Description
+
+## Examples
+
+```cypher
+MATCH (n:NodeLabel)
+RETURN n.name, n.property
+```
+~~~
+
+For Graph nodes, use `:GraphObject:NodeLabel` in `Labels`.
+
+### Edge Doc
+
+~~~markdown
+# REL_NAME
+
+Description of the relationship.
+
+## Usage
+- **SourceLabel** -> `REL_NAME` -> **TargetLabel** - Description
+
+## Properties
+No additional properties on the relationship.
+
+## Examples
+
+```cypher
+MATCH (a)-[r:REL_NAME]->(b)
+RETURN a.name, b.name
+```
+~~~
+
+### Post-Processing Doc
+
+~~~markdown
+# Step Display Name
+
+Description of what this post-processing step does.
+
+**Priority:** N
+
+## Details
+Explanation of the logic.
+
+## Cypher
+
+```cypher
+// Cleaned-up cypher from YAML
+```
+~~~
+
+## Guardrails
+
+- Treat YAML config and constants as source of truth.
+- Do not invent labels or relationships not present in source files.
+- Keep edits deterministic, concise, and sorted where applicable.
+- Preserve existing docs style and naming conventions.

.github/workflows/docs-deploy.yml

@@ -1,41 +0,0 @@
-name: docs-deploy
-on:
-  push:
-    paths:
-      - "docs/**"
-      - "mkdocs.yml"
-      - ".github/workflows/docs-deploy.yml"
-    branches:
-      - main
-  pull_request:
-    paths:
-      - "docs/**"
-      - "mkdocs.yml"
-      - ".github/workflows/docs-deploy.yml"
-    branches:
-      - main
-    types: [closed]
-
-permissions:
-  contents: write
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Configure Git Credentials
-        run: |
-          git config user.name github-actions[bot]
-          git config user.email github-actions[bot]@users.noreply.github.com
-      - uses: actions/setup-python@v5
-        with:
-          python-version: 3.x
-      - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-      - uses: actions/cache@v4
-        with:
-          key: mkdocs-material-${{ env.cache_id }}
-          path: ~/.cache
-          restore-keys: |
-            mkdocs-material-
-      - run: pip install mkdocs-material
-      - run: mkdocs gh-deploy --force

.github/workflows/docs.yml

@@ -0,0 +1,32 @@
+name: Documentation
+on:
+  push:
+    paths:
+      - "docs/**"
+      - "zensical.toml"
+      - ".github/workflows/docs.yml"
+    branches:
+      - main
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/configure-pages@v6
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: 3.x
+      - run: pip install zensical
+      - run: zensical build --clean
+      - uses: actions/upload-pages-artifact@v5
+        with:
+          path: site
+      - uses: actions/deploy-pages@v5
+        id: deployment

.gitignore

@@ -9,7 +9,7 @@ target/
 
 # Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
 # More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
-Cargo.lock
+# Cargo.lock
 
 # These are backup files generated by rustfmt
 **/*.rs.bk
@@ -53,3 +53,4 @@ cirro_*.json
 neo4j/
 site/
 *.csv
+demo/

.vscode/settings.json

@@ -13,5 +13,6 @@
   ],
   "python-envs.defaultEnvManager": "ms-python.python:system",
   "python-envs.pythonProjects": [],
-  "rust-analyzer.cargo.target": "x86_64-pc-windows-gnu"
+  "rust-analyzer.cargo.target": "x86_64-pc-windows-gnu",
+  "git.addAICoAuthor": "off"
 }

CHANGELOG.md

@@ -0,0 +1,93 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.4.0] - 2026-11-05
+
+### Added
+
+- Restricted guest Microsoft Graph collection through service principal relationships with `--restricted-guest`.
+- Custom application ID seeds with `--restricted-appids` and an optional Microsoft application catalog with `--restricted-guest-msapps`.
+
+## [1.3.0] - 2026-09-22
+
+### Added
+
+- Add user manager and password change datetime by @daddycocoaman in [#36](https://github.com/bishopfox/cirro/pull/36)
+- Add odata types and agent id relations by @daddycocoaman in [#35](https://github.com/bishopfox/cirro/pull/35)
+
+### Changed
+
+- Process createdByAppId by @daddycocoaman in [#34](https://github.com/bishopfox/cirro/pull/34)
+
+### Fixed
+
+- Use correct base64 decoding for tokens by @daddycocoaman in [#38](https://github.com/bishopfox/cirro/pull/38)
+- Check site serverfarmid for null by @daddycocoaman in [#37](https://github.com/bishopfox/cirro/pull/37)
+
+## [1.2.1] - 2026-06-01
+
+### Fixed
+
+- Fix merges in loadbalancer by @daddycocoaman in [#33](https://github.com/bishopfox/cirro/pull/33)
+
+## [1.2.0] - 2026-05-12
+
+### Added
+
+- Add network LoadBalancer nodes and VirtualHub by @daddycocoaman in [#30](https://github.com/bishopfox/cirro/pull/30)
+- Add subject for FIC collection by @daddycocoaman in [#28](https://github.com/bishopfox/cirro/pull/28)
+- Add KustoCluster node by @daddycocoaman in [#25](https://github.com/bishopfox/cirro/pull/25)
+- Add SyntexDocumentProcessor by @daddycocoaman in [#24](https://github.com/bishopfox/cirro/pull/24)
+- Add azure stack nodes and edges by @daddycocoaman in [#23](https://github.com/bishopfox/cirro/pull/23)
+- Add oracle autonomous db by @daddycocoaman in [#22](https://github.com/bishopfox/cirro/pull/22)
+- Add multiple Hybrid nodes and parity with virtual machines by @daddycocoaman in [#21](https://github.com/bishopfox/cirro/pull/21)
+- Add ManagedHSM by @daddycocoaman in [#15](https://github.com/bishopfox/cirro/pull/15)
+- Add AnalysisServiceServer and AnalysisServiceFirewallRule by @daddycocoaman in [#14](https://github.com/bishopfox/cirro/pull/14)
+- Add composite index and constraints syntax by @daddycocoaman in [#13](https://github.com/bishopfox/cirro/pull/13)
+- Add GithubNetworkSettings by @daddycocoaman in [#12](https://github.com/bishopfox/cirro/pull/12)
+- Add dry run switch for ingest by @daddycocoaman in [#11](https://github.com/bishopfox/cirro/pull/11)
+- Add argument validation to applicable arguments by @daddycocoaman in [#10](https://github.com/bishopfox/cirro/pull/10)
+
+### Changed
+
+- Update docs by @daddycocoaman in [#31](https://github.com/bishopfox/cirro/pull/31)
+- Update cypher to Cypher 25 syntax by @daddycocoaman in [#27](https://github.com/bishopfox/cirro/pull/27)
+- Update netapp nodes by @daddycocoaman in [#26](https://github.com/bishopfox/cirro/pull/26)
+- Update docs skill for zensical by @daddycocoaman in [#20](https://github.com/bishopfox/cirro/pull/20)
+- Migrate docs to zensical by @daddycocoaman in [#19](https://github.com/bishopfox/cirro/pull/19)
+- Turn off git AI CoAuthor setting by @daddycocoaman in [#16](https://github.com/bishopfox/cirro/pull/16)
+- Update restore point changes by @daddycocoaman in [#9](https://github.com/bishopfox/cirro/pull/9)
+- Improve restorepointcollections by @daddycocoaman in [#8](https://github.com/bishopfox/cirro/pull/8)
+
+### Fixed
+
+- Re-add WITH before CALLs in Cypher  and minor bugs by @daddycocoaman in [#29](https://github.com/bishopfox/cirro/pull/29)
+- Change generic resource MI checks to CONTAINS by @daddycocoaman in [#17](https://github.com/bishopfox/cirro/pull/17)
+
+## [1.1.0] - 2026-04-13
+
+### Added
+
+- Add NetworkWatcher, KeyVaultCertificate, KeyVaultCertificateValue by @daddycocoaman in [#3](https://github.com/BishopFox/cirro/pull/3)
+- Add CODEOWNERS for bf-red-team (CLD-10728) by @grobbinsBF
+
+### Changed
+
+- Bump version to 1.1.0
+- Sync docs with schemas by @daddycocoaman
+
+### New Contributors
+* @grobbinsBF made their first contribution in [#2](https://github.com/BishopFox/cirro/pull/2)
+
+## [1.0.0] - 2026-03-31
+
+### Initial Release
+* Initial release by @daddycocoaman
+
+[1.1.0]: https://github.com/BishopFox/cirro/compare/v1.0.0...v1.1.0
+
+<!-- generated by git-cliff -->

Cargo.toml

@@ -2,7 +2,7 @@
 edition = "2024"
 name = "cirro"
 repository = "https://github.com/bishopfox/cirro"
-version = "0.6.0"
+version = "1.4.0"
 
 [features]
 azure = ["collector"]
@@ -15,6 +15,7 @@ collector = [
     "dep:jsonwebtoken",
     "dep:once_cell",
     "dep:pem",
+    "dep:regex",
     "dep:reqwest",
     "dep:rsa",
     "dep:sha1",
@@ -52,13 +53,19 @@ base64 = { version = "0.22.1", optional = true }
 chrono = { version = "0.4.41", optional = true }
 dashmap = { version = "5.5.3", optional = true }
 futures = { version = "0.3.31", optional = true }
-jsonwebtoken = { version = "9.3.1", features = ["use_pem"], optional = true }
+jsonwebtoken = { version = "10.3.0", features = [
+    "use_pem",
+    "aws_lc_rs",
+], optional = true }
 once_cell = { version = "1.19.0", optional = true }
 pem = { version = "3.0.5", optional = true }
-reqwest = { version = "0.13.1", features = [
+regex = { version = "1.12.3", optional = true }
+reqwest = { version = "0.13.2", features = [
     "json",
     "query",
     "form",
+    "gzip",
+    "brotli",
 ], optional = true }
 rsa = { version = "0.9.8", features = ["sha1", "sha2"], optional = true }
 sha1 = { version = "0.10.6", optional = true }

LICENSE

@@ -1,202 +1,595 @@
+GNU General Public License
+==========================
 
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+_Version 3, 29 June 2007_  
+_Copyright © 2007 Free Software Foundation, Inc. &lt;<http://fsf.org/>&gt;_
 
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+Everyone is permitted to copy and distribute verbatim copies of this license
+document, but changing it is not allowed.
 
-   1. Definitions.
+## Preamble
 
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
+The GNU General Public License is a free, copyleft license for software and other
+kinds of works.
 
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
+The licenses for most software and other practical works are designed to take away
+your freedom to share and change the works. By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change all versions of a
+program--to make sure it remains free software for all its users. We, the Free
+Software Foundation, use the GNU General Public License for most of our software; it
+applies also to any other work released this way by its authors. You can apply it to
+your programs, too.
 
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
+When we speak of free software, we are referring to freedom, not price. Our General
+Public Licenses are designed to make sure that you have the freedom to distribute
+copies of free software (and charge for them if you wish), that you receive source
+code or can get it if you want it, that you can change the software or use pieces of
+it in new free programs, and that you know you can do these things.
 
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
+To protect your rights, we need to prevent others from denying you these rights or
+asking you to surrender the rights. Therefore, you have certain responsibilities if
+you distribute copies of the software, or if you modify it: responsibilities to
+respect the freedom of others.
 
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
+For example, if you distribute copies of such a program, whether gratis or for a fee,
+you must pass on to the recipients the same freedoms that you received. You must make
+sure that they, too, receive or can get the source code. And you must show them these
+terms so they know their rights.
 
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
+Developers that use the GNU GPL protect your rights with two steps: **(1)** assert
+copyright on the software, and **(2)** offer you this License giving you legal permission
+to copy, distribute and/or modify it.
 
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
+For the developers' and authors' protection, the GPL clearly explains that there is
+no warranty for this free software. For both users' and authors' sake, the GPL
+requires that modified versions be marked as changed, so that their problems will not
+be attributed erroneously to authors of previous versions.
 
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
+Some devices are designed to deny users access to install or run modified versions of
+the software inside them, although the manufacturer can do so. This is fundamentally
+incompatible with the aim of protecting users' freedom to change the software. The
+systematic pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable. Therefore, we have designed
+this version of the GPL to prohibit the practice for those products. If such problems
+arise substantially in other domains, we stand ready to extend this provision to
+those domains in future versions of the GPL, as needed to protect the freedom of
+users.
 
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
+Finally, every program is threatened constantly by software patents. States should
+not allow patents to restrict development and use of software on general-purpose
+computers, but in those that do, we wish to avoid the special danger that patents
+applied to a free program could make it effectively proprietary. To prevent this, the
+GPL assures that patents cannot be used to render the program non-free.
 
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
+The precise terms and conditions for copying, distribution and modification follow.
 
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
+## TERMS AND CONDITIONS
 
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
+### 0. Definitions
 
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
+“This License” refers to version 3 of the GNU General Public License.
 
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
+“Copyright” also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
 
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
+“The Program” refers to any copyrightable work licensed under this
+License. Each licensee is addressed as “you”. “Licensees” and
+“recipients” may be individuals or organizations.
 
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
+To “modify” a work means to copy from or adapt all or part of the work in
+a fashion requiring copyright permission, other than the making of an exact copy. The
+resulting work is called a “modified version” of the earlier work or a
+work “based on” the earlier work.
 
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
+A “covered work” means either the unmodified Program or a work based on
+the Program.
 
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
+To “propagate” a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for infringement under
+applicable copyright law, except executing it on a computer or modifying a private
+copy. Propagation includes copying, distribution (with or without modification),
+making available to the public, and in some countries other activities as well.
 
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
+To “convey” a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user through a computer
+network, with no transfer of a copy, is not conveying.
 
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
+An interactive user interface displays “Appropriate Legal Notices” to the
+extent that it includes a convenient and prominently visible feature that **(1)**
+displays an appropriate copyright notice, and **(2)** tells the user that there is no
+warranty for the work (except to the extent that warranties are provided), that
+licensees may convey the work under this License, and how to view a copy of this
+License. If the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
 
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
+### 1. Source Code
 
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
+The “source code” for a work means the preferred form of the work for
+making modifications to it. “Object code” means any non-source form of a
+work.
 
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
+A “Standard Interface” means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of interfaces
+specified for a particular programming language, one that is widely used among
+developers working in that language.
 
-   END OF TERMS AND CONDITIONS
+The “System Libraries” of an executable work include anything, other than
+the work as a whole, that **(a)** is included in the normal form of packaging a Major
+Component, but which is not part of that Major Component, and **(b)** serves only to
+enable use of the work with that Major Component, or to implement a Standard
+Interface for which an implementation is available to the public in source code form.
+A “Major Component”, in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system (if any) on which
+the executable work runs, or a compiler used to produce the work, or an object code
+interpreter used to run it.
 
-   APPENDIX: How to apply the Apache License to your work.
+The “Corresponding Source” for a work in object code form means all the
+source code needed to generate, install, and (for an executable work) run the object
+code and to modify the work, including scripts to control those activities. However,
+it does not include the work's System Libraries, or general-purpose tools or
+generally available free programs which are used unmodified in performing those
+activities but which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for the work, and
+the source code for shared libraries and dynamically linked subprograms that the work
+is specifically designed to require, such as by intimate data communication or
+control flow between those subprograms and other parts of the work.
 
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
+The Corresponding Source need not include anything that users can regenerate
+automatically from other parts of the Corresponding Source.
 
-   Copyright [yyyy] [name of copyright owner]
+The Corresponding Source for a work in source code form is that same work.
 
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
+### 2. Basic Permissions
 
-       http://www.apache.org/licenses/LICENSE-2.0
+All rights granted under this License are granted for the term of copyright on the
+Program, and are irrevocable provided the stated conditions are met. This License
+explicitly affirms your unlimited permission to run the unmodified Program. The
+output from running a covered work is covered by this License only if the output,
+given its content, constitutes a covered work. This License acknowledges your rights
+of fair use or other equivalent, as provided by copyright law.
 
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+You may make, run and propagate covered works that you do not convey, without
+conditions so long as your license otherwise remains in force. You may convey covered
+works to others for the sole purpose of having them make modifications exclusively
+for you, or provide you with facilities for running those works, provided that you
+comply with the terms of this License in conveying all material for which you do not
+control copyright. Those thus making or running the covered works for you must do so
+exclusively on your behalf, under your direction and control, on terms that prohibit
+them from making any copies of your copyrighted material outside their relationship
+with you.
+
+Conveying under any other circumstances is permitted solely under the conditions
+stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
+
+### 3. Protecting Users' Legal Rights From Anti-Circumvention Law
+
+No covered work shall be deemed part of an effective technological measure under any
+applicable law fulfilling obligations under article 11 of the WIPO copyright treaty
+adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention
+of such measures.
+
+When you convey a covered work, you waive any legal power to forbid circumvention of
+technological measures to the extent such circumvention is effected by exercising
+rights under this License with respect to the covered work, and you disclaim any
+intention to limit operation or modification of the work as a means of enforcing,
+against the work's users, your or third parties' legal rights to forbid circumvention
+of technological measures.
+
+### 4. Conveying Verbatim Copies
+
+You may convey verbatim copies of the Program's source code as you receive it, in any
+medium, provided that you conspicuously and appropriately publish on each copy an
+appropriate copyright notice; keep intact all notices stating that this License and
+any non-permissive terms added in accord with section 7 apply to the code; keep
+intact all notices of the absence of any warranty; and give all recipients a copy of
+this License along with the Program.
+
+You may charge any price or no price for each copy that you convey, and you may offer
+support or warranty protection for a fee.
+
+### 5. Conveying Modified Source Versions
+
+You may convey a work based on the Program, or the modifications to produce it from
+the Program, in the form of source code under the terms of section 4, provided that
+you also meet all of these conditions:
+
+* **a)** The work must carry prominent notices stating that you modified it, and giving a
+relevant date.
+* **b)** The work must carry prominent notices stating that it is released under this
+License and any conditions added under section 7. This requirement modifies the
+requirement in section 4 to “keep intact all notices”.
+* **c)** You must license the entire work, as a whole, under this License to anyone who
+comes into possession of a copy. This License will therefore apply, along with any
+applicable section 7 additional terms, to the whole of the work, and all its parts,
+regardless of how they are packaged. This License gives no permission to license the
+work in any other way, but it does not invalidate such permission if you have
+separately received it.
+* **d)** If the work has interactive user interfaces, each must display Appropriate Legal
+Notices; however, if the Program has interactive interfaces that do not display
+Appropriate Legal Notices, your work need not make them do so.
+
+A compilation of a covered work with other separate and independent works, which are
+not by their nature extensions of the covered work, and which are not combined with
+it such as to form a larger program, in or on a volume of a storage or distribution
+medium, is called an “aggregate” if the compilation and its resulting
+copyright are not used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work in an aggregate
+does not cause this License to apply to the other parts of the aggregate.
+
+### 6. Conveying Non-Source Forms
+
+You may convey a covered work in object code form under the terms of sections 4 and
+5, provided that you also convey the machine-readable Corresponding Source under the
+terms of this License, in one of these ways:
+
+* **a)** Convey the object code in, or embodied in, a physical product (including a
+physical distribution medium), accompanied by the Corresponding Source fixed on a
+durable physical medium customarily used for software interchange.
+* **b)** Convey the object code in, or embodied in, a physical product (including a
+physical distribution medium), accompanied by a written offer, valid for at least
+three years and valid for as long as you offer spare parts or customer support for
+that product model, to give anyone who possesses the object code either **(1)** a copy of
+the Corresponding Source for all the software in the product that is covered by this
+License, on a durable physical medium customarily used for software interchange, for
+a price no more than your reasonable cost of physically performing this conveying of
+source, or **(2)** access to copy the Corresponding Source from a network server at no
+charge.
+* **c)** Convey individual copies of the object code with a copy of the written offer to
+provide the Corresponding Source. This alternative is allowed only occasionally and
+noncommercially, and only if you received the object code with such an offer, in
+accord with subsection 6b.
+* **d)** Convey the object code by offering access from a designated place (gratis or for
+a charge), and offer equivalent access to the Corresponding Source in the same way
+through the same place at no further charge. You need not require recipients to copy
+the Corresponding Source along with the object code. If the place to copy the object
+code is a network server, the Corresponding Source may be on a different server
+(operated by you or a third party) that supports equivalent copying facilities,
+provided you maintain clear directions next to the object code saying where to find
+the Corresponding Source. Regardless of what server hosts the Corresponding Source,
+you remain obligated to ensure that it is available for as long as needed to satisfy
+these requirements.
+* **e)** Convey the object code using peer-to-peer transmission, provided you inform
+other peers where the object code and Corresponding Source of the work are being
+offered to the general public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded from the
+Corresponding Source as a System Library, need not be included in conveying the
+object code work.
+
+A “User Product” is either **(1)** a “consumer product”, which
+means any tangible personal property which is normally used for personal, family, or
+household purposes, or **(2)** anything designed or sold for incorporation into a
+dwelling. In determining whether a product is a consumer product, doubtful cases
+shall be resolved in favor of coverage. For a particular product received by a
+particular user, “normally used” refers to a typical or common use of
+that class of product, regardless of the status of the particular user or of the way
+in which the particular user actually uses, or expects or is expected to use, the
+product. A product is a consumer product regardless of whether the product has
+substantial commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+“Installation Information” for a User Product means any methods,
+procedures, authorization keys, or other information required to install and execute
+modified versions of a covered work in that User Product from a modified version of
+its Corresponding Source. The information must suffice to ensure that the continued
+functioning of the modified object code is in no case prevented or interfered with
+solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or specifically for
+use in, a User Product, and the conveying occurs as part of a transaction in which
+the right of possession and use of the User Product is transferred to the recipient
+in perpetuity or for a fixed term (regardless of how the transaction is
+characterized), the Corresponding Source conveyed under this section must be
+accompanied by the Installation Information. But this requirement does not apply if
+neither you nor any third party retains the ability to install modified object code
+on the User Product (for example, the work has been installed in ROM).
+
+The requirement to provide Installation Information does not include a requirement to
+continue to provide support service, warranty, or updates for a work that has been
+modified or installed by the recipient, or for the User Product in which it has been
+modified or installed. Access to a network may be denied when the modification itself
+materially and adversely affects the operation of the network or violates the rules
+and protocols for communication across the network.
+
+Corresponding Source conveyed, and Installation Information provided, in accord with
+this section must be in a format that is publicly documented (and with an
+implementation available to the public in source code form), and must require no
+special password or key for unpacking, reading or copying.
+
+### 7. Additional Terms
+
+“Additional permissions” are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions. Additional
+permissions that are applicable to the entire Program shall be treated as though they
+were included in this License, to the extent that they are valid under applicable
+law. If additional permissions apply only to part of the Program, that part may be
+used separately under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option remove any
+additional permissions from that copy, or from any part of it. (Additional
+permissions may be written to require their own removal in certain cases when you
+modify the work.) You may place additional permissions on material, added by you to a
+covered work, for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you add to a
+covered work, you may (if authorized by the copyright holders of that material)
+supplement the terms of this License with terms:
+
+* **a)** Disclaiming warranty or limiting liability differently from the terms of
+sections 15 and 16 of this License; or
+* **b)** Requiring preservation of specified reasonable legal notices or author
+attributions in that material or in the Appropriate Legal Notices displayed by works
+containing it; or
+* **c)** Prohibiting misrepresentation of the origin of that material, or requiring that
+modified versions of such material be marked in reasonable ways as different from the
+original version; or
+* **d)** Limiting the use for publicity purposes of names of licensors or authors of the
+material; or
+* **e)** Declining to grant rights under trademark law for use of some trade names,
+trademarks, or service marks; or
+* **f)** Requiring indemnification of licensors and authors of that material by anyone
+who conveys the material (or modified versions of it) with contractual assumptions of
+liability to the recipient, for any liability that these contractual assumptions
+directly impose on those licensors and authors.
+
+All other non-permissive additional terms are considered “further
+restrictions” within the meaning of section 10. If the Program as you received
+it, or any part of it, contains a notice stating that it is governed by this License
+along with a term that is a further restriction, you may remove that term. If a
+license document contains a further restriction but permits relicensing or conveying
+under this License, you may add to a covered work material governed by the terms of
+that license document, provided that the further restriction does not survive such
+relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you must place, in
+the relevant source files, a statement of the additional terms that apply to those
+files, or a notice indicating where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the form of a
+separately written license, or stated as exceptions; the above requirements apply
+either way.
+
+### 8. Termination
+
+You may not propagate or modify a covered work except as expressly provided under
+this License. Any attempt otherwise to propagate or modify it is void, and will
+automatically terminate your rights under this License (including any patent licenses
+granted under the third paragraph of section 11).
+
+However, if you cease all violation of this License, then your license from a
+particular copyright holder is reinstated **(a)** provisionally, unless and until the
+copyright holder explicitly and finally terminates your license, and **(b)** permanently,
+if the copyright holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is reinstated permanently
+if the copyright holder notifies you of the violation by some reasonable means, this
+is the first time you have received notice of violation of this License (for any
+work) from that copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+Termination of your rights under this section does not terminate the licenses of
+parties who have received copies or rights from you under this License. If your
+rights have been terminated and not permanently reinstated, you do not qualify to
+receive new licenses for the same material under section 10.
+
+### 9. Acceptance Not Required for Having Copies
+
+You are not required to accept this License in order to receive or run a copy of the
+Program. Ancillary propagation of a covered work occurring solely as a consequence of
+using peer-to-peer transmission to receive a copy likewise does not require
+acceptance. However, nothing other than this License grants you permission to
+propagate or modify any covered work. These actions infringe copyright if you do not
+accept this License. Therefore, by modifying or propagating a covered work, you
+indicate your acceptance of this License to do so.
+
+### 10. Automatic Licensing of Downstream Recipients
+
+Each time you convey a covered work, the recipient automatically receives a license
+from the original licensors, to run, modify and propagate that work, subject to this
+License. You are not responsible for enforcing compliance by third parties with this
+License.
+
+An “entity transaction” is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an organization, or
+merging organizations. If propagation of a covered work results from an entity
+transaction, each party to that transaction who receives a copy of the work also
+receives whatever licenses to the work the party's predecessor in interest had or
+could give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if the predecessor
+has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the rights granted or
+affirmed under this License. For example, you may not impose a license fee, royalty,
+or other charge for exercise of rights granted under this License, and you may not
+initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging
+that any patent claim is infringed by making, using, selling, offering for sale, or
+importing the Program or any portion of it.
+
+### 11. Patents
+
+A “contributor” is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The work thus
+licensed is called the contributor's “contributor version”.
+
+A contributor's “essential patent claims” are all patent claims owned or
+controlled by the contributor, whether already acquired or hereafter acquired, that
+would be infringed by some manner, permitted by this License, of making, using, or
+selling its contributor version, but do not include claims that would be infringed
+only as a consequence of further modification of the contributor version. For
+purposes of this definition, “control” includes the right to grant patent
+sublicenses in a manner consistent with the requirements of this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free patent license
+under the contributor's essential patent claims, to make, use, sell, offer for sale,
+import and otherwise run, modify and propagate the contents of its contributor
+version.
+
+In the following three paragraphs, a “patent license” is any express
+agreement or commitment, however denominated, not to enforce a patent (such as an
+express permission to practice a patent or covenant not to sue for patent
+infringement). To “grant” such a patent license to a party means to make
+such an agreement or commitment not to enforce a patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license, and the
+Corresponding Source of the work is not available for anyone to copy, free of charge
+and under the terms of this License, through a publicly available network server or
+other readily accessible means, then you must either **(1)** cause the Corresponding
+Source to be so available, or **(2)** arrange to deprive yourself of the benefit of the
+patent license for this particular work, or **(3)** arrange, in a manner consistent with
+the requirements of this License, to extend the patent license to downstream
+recipients. “Knowingly relying” means you have actual knowledge that, but
+for the patent license, your conveying the covered work in a country, or your
+recipient's use of the covered work in a country, would infringe one or more
+identifiable patents in that country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or arrangement, you
+convey, or propagate by procuring conveyance of, a covered work, and grant a patent
+license to some of the parties receiving the covered work authorizing them to use,
+propagate, modify or convey a specific copy of the covered work, then the patent
+license you grant is automatically extended to all recipients of the covered work and
+works based on it.
+
+A patent license is “discriminatory” if it does not include within the
+scope of its coverage, prohibits the exercise of, or is conditioned on the
+non-exercise of one or more of the rights that are specifically granted under this
+License. You may not convey a covered work if you are a party to an arrangement with
+a third party that is in the business of distributing software, under which you make
+payment to the third party based on the extent of your activity of conveying the
+work, and under which the third party grants, to any of the parties who would receive
+the covered work from you, a discriminatory patent license **(a)** in connection with
+copies of the covered work conveyed by you (or copies made from those copies), or **(b)**
+primarily for and in connection with specific products or compilations that contain
+the covered work, unless you entered into that arrangement, or that patent license
+was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting any implied
+license or other defenses to infringement that may otherwise be available to you
+under applicable patent law.
+
+### 12. No Surrender of Others' Freedom
+
+If conditions are imposed on you (whether by court order, agreement or otherwise)
+that contradict the conditions of this License, they do not excuse you from the
+conditions of this License. If you cannot convey a covered work so as to satisfy
+simultaneously your obligations under this License and any other pertinent
+obligations, then as a consequence you may not convey it at all. For example, if you
+agree to terms that obligate you to collect a royalty for further conveying from
+those to whom you convey the Program, the only way you could satisfy both those terms
+and this License would be to refrain entirely from conveying the Program.
+
+### 13. Use with the GNU Affero General Public License
+
+Notwithstanding any other provision of this License, you have permission to link or
+combine any covered work with a work licensed under version 3 of the GNU Affero
+General Public License into a single combined work, and to convey the resulting work.
+The terms of this License will continue to apply to the part which is the covered
+work, but the special requirements of the GNU Affero General Public License, section
+13, concerning interaction through a network will apply to the combination as such.
+
+### 14. Revised Versions of this License
+
+The Free Software Foundation may publish revised and/or new versions of the GNU
+General Public License from time to time. Such new versions will be similar in spirit
+to the present version, but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program specifies that
+a certain numbered version of the GNU General Public License “or any later
+version” applies to it, you have the option of following the terms and
+conditions either of that numbered version or of any later version published by the
+Free Software Foundation. If the Program does not specify a version number of the GNU
+General Public License, you may choose any version ever published by the Free
+Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions of the GNU
+General Public License can be used, that proxy's public statement of acceptance of a
+version permanently authorizes you to choose that version for the Program.
+
+Later license versions may give you additional or different permissions. However, no
+additional obligations are imposed on any author or copyright holder as a result of
+your choosing to follow a later version.
+
+### 15. Disclaimer of Warranty
+
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER
+EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE
+QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE
+DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+### 16. Limitation of Liability
+
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY
+COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS
+PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL,
+INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE
+OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE
+WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+### 17. Interpretation of Sections 15 and 16
+
+If the disclaimer of warranty and limitation of liability provided above cannot be
+given local legal effect according to their terms, reviewing courts shall apply local
+law that most closely approximates an absolute waiver of all civil liability in
+connection with the Program, unless a warranty or assumption of liability accompanies
+a copy of the Program in return for a fee.
+
+_END OF TERMS AND CONDITIONS_
+
+## How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest possible use to
+the public, the best way to achieve this is to make it free software which everyone
+can redistribute and change under these terms.
+
+To do so, attach the following notices to the program. It is safest to attach them
+to the start of each source file to most effectively state the exclusion of warranty;
+and each file should have at least the “copyright” line and a pointer to
+where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program does terminal interaction, make it output a short notice like this
+when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type 'show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type 'show c' for details.
+
+The hypothetical commands `show w` and `show c` should show the appropriate parts of
+the General Public License. Of course, your program's commands might be different;
+for a GUI interface, you would use an “about box”.
+
+You should also get your employer (if you work as a programmer) or school, if any, to
+sign a “copyright disclaimer” for the program, if necessary. For more
+information on this, and how to apply and follow the GNU GPL, see
+&lt;<http://www.gnu.org/licenses/>&gt;.
+
+The GNU General Public License does not permit incorporating your program into
+proprietary programs. If your program is a subroutine library, you may consider it
+more useful to permit linking proprietary applications with the library. If this is
+what you want to do, use the GNU Lesser General Public License instead of this
+License. But first, please read
+&lt;<http://www.gnu.org/philosophy/why-not-lgpl.html>&gt;.

README.md

@@ -3,7 +3,7 @@
 
 Cirro is an extensible security research platform that enables researchers and penetration testers to collect, analyze, and visualize cloud environments and identity relationships through graph databases. Built with a modular architecture, Cirro can be extended to support multiple platforms and data sources.
 
-You can check out the [Documentation](https://crispy-adventure-qre5p1k.pages.github.io/) for more info.
+You can check out the [Documentation](https://bishopfox.github.io/cirro) for more info.
 
 ## Features
 
@@ -12,6 +12,10 @@ You can check out the [Documentation](https://crispy-adventure-qre5p1k.pages.git
 - **Cross-platform**: Available for Windows, macOS, and Linux
 - **Modular Design**: Optional platform functionality through feature flags and extensible plugin architecture
 - **Network Topology Analysis**: Support for network infrastructure platforms like Tailscale
+- **Entra ID Enrichment**: User managers and password-change timestamps, application creators, agent identity properties, and published permission scopes
+- **Restricted Guest Collection**: Traverse accessible application relationships with built-in, custom, or Microsoft catalog seeds
+
+See the [collection guide](docs/usage/cirro.md) for usage examples and collection coverage.
 
 ## Architecture
 
@@ -118,6 +122,24 @@ cirro graph ingest --type az --file cirro_output.db \
   --password password
 ```
 
+## Dry-Run Mode
+
+Preview what would be ingested and post-processed without writing any data to the graph database:
+
+```bash
+# Preview Azure ingestion and see which resource types have no implemented specs
+cirro graph ingest --type az --file cirro_output.db --dry-run
+
+# Preview Tailscale ingestion
+cirro graph ingest --type ts --file cirro_ts_socket.json --dry-run
+```
+
+In dry-run mode, Cirro will:
+
+- Report each spec and its row count that **would** be processed
+- Skip all Neo4j writes (no ingestion or post-processing queries execute)
+- For Azure, list resource types in the input data that have no implemented spec
+
 ## Dashboard
 
 CirroDash can be located here: [https://github.com/bishopfox/cirrodash](https://github.com/bishopfox/cirrodash)

cliff.toml

@@ -0,0 +1,108 @@
+# git-cliff ~ configuration file
+# https://git-cliff.org/docs/configuration
+
+[changelog]
+# A Tera template to be rendered as the changelog's header.
+# See https://keats.github.io/tera/docs/#introduction
+header = """
+# Changelog\n
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n
+"""
+# A Tera template to be rendered for each release in the changelog.
+# See https://keats.github.io/tera/docs/#introduction
+body = """
+{%- macro remote_url() -%}
+  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
+{%- endmacro -%}
+
+{% if version -%}
+    ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
+{% else -%}
+    ## [Unreleased]
+{% endif -%}
+
+{% for group, commits in commits | group_by(attribute="group") %}
+    ### {{ group | upper_first }}
+    {% for commit in commits | unique(attribute="message") %}
+        - {{ commit.message | split(pat="\n") | first | upper_first | trim }}\
+            {% if commit.remote.username %} by @{{ commit.remote.username }}{%- endif -%}
+            {% if commit.remote.pr_number %} in \
+            [#{{ commit.remote.pr_number }}]({{ self::remote_url() }}/pull/{{ commit.remote.pr_number }}) \
+            {%- endif -%}
+    {% endfor %}
+{% endfor %}
+
+{%- if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
+    ### New Contributors
+{%- endif -%}
+
+{% for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
+  * @{{ contributor.username }} made their first contribution
+    {%- if contributor.pr_number %} in \
+      [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
+    {%- endif %}
+{%- endfor %}\n
+
+{%- if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}{% raw %}\n{% endraw -%}{% endif %}
+
+"""
+# A Tera template to be rendered as the changelog's footer.
+# See https://keats.github.io/tera/docs/#introduction
+footer = """
+{%- macro remote_url() -%}
+  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
+{%- endmacro -%}
+
+{% for release in releases -%}
+    {% if release.version -%}
+        {% if release.previous.version -%}
+            [{{ release.version | trim_start_matches(pat="v") }}]: \
+                {{ self::remote_url() }}/compare/{{ release.previous.version }}...{{ release.version }}
+        {% endif -%}
+    {% else -%}
+        [unreleased]: {{ self::remote_url() }}/compare/{{ release.previous.version }}...HEAD
+    {% endif -%}
+{% endfor %}
+<!-- generated by git-cliff -->
+"""
+# Remove leading and trailing whitespaces from the changelog's body.
+trim = true
+
+[git]
+# Parse commits according to the conventional commits specification.
+# See https://www.conventionalcommits.org
+conventional_commits = true
+# Exclude commits that do not match the conventional commits specification.
+filter_unconventional = true
+# An array of regex based parsers to modify commit messages prior to further processing.
+commit_preprocessors = [
+    # Remove issue numbers.
+    { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "" },
+]
+# An array of regex based parsers for extracting data from the commit message.
+# Assigns commits to groups.
+# Optionally sets the commit's scope and can decide to exclude commits from further processing.
+commit_parsers = [
+    { message = "^[a|A]dd", group = "Added" },
+    { message = "^[s|S]upport", group = "Added" },
+    { message = "^[r|R]emove", group = "Removed" },
+    { message = "^.*: add", group = "Added" },
+    { message = "^.*: support", group = "Added" },
+    { message = "^.*: remove", group = "Removed" },
+    { message = "^.*: delete", group = "Removed" },
+    { message = "^test", group = "Fixed" },
+    { message = "^fix", group = "Fixed" },
+    { message = "^.*: fix", group = "Fixed" },
+    { message = "^.*", group = "Changed" },
+    { body = "$^", skip = true },
+]
+# Exclude commits that are not matched by any commit parser.
+filter_commits = false
+# Order releases topologically instead of chronologically.
+topo_order = false
+# Order of commits in each group/release within the changelog.
+# Allowed values: newest, oldest
+sort_commits = "newest"

dist-workspace.toml

@@ -24,5 +24,6 @@ install-path = "CARGO_HOME"
 install-updater = false
 
 [dist.github-custom-runners]
+aarch64-apple-darwin = "macos-15"
 aarch64-unknown-linux-gnu.container = "ghcr.io/rust-cross/cargo-zigbuild"
 aarch64-unknown-linux-musl.container = "ghcr.io/rust-cross/cargo-zigbuild"

docs/analysis/additional-nodes.md

@@ -15,6 +15,13 @@ These nodes are not direct objects in Entra ID or Azure but are created as a res
 - **[HybridExtension](additional-nodes/hybrid-extension.md)** - Extensions attached to hybrid machines
 - **[HybridIPAddress](additional-nodes/hybrid-ip-address.md)** - IP addresses discovered for hybrid machines
 - **[IPConfig](additional-nodes/ip-config.md)** - IP configuration details for network interfaces
+- **[KeyVaultCertificate](additional-nodes/key-vault-certificate.md)** - Key Vault certificate metadata
+- **[KeyVaultCertificateValue](additional-nodes/key-vault-certificate-value.md)** - Versioned Key Vault certificate data and policy details
+- **[KeyVaultSecret](additional-nodes/key-vault-secret.md)** - Key Vault secret metadata
+- **[KeyVaultSecretValue](additional-nodes/key-vault-secret-value.md)** - Versioned Key Vault secret values
+- **[LoadBalancerBackendAddressPool](additional-nodes/load-balancer-backend-address-pool.md)** - Backend address pools attached to load balancers
+- **[LoadBalancerFrontendIPConfiguration](additional-nodes/load-balancer-frontend-ip-configuration.md)** - Frontend IP configurations for load balancers
+- **[LoadBalancerRule](additional-nodes/load-balancer-rule.md)** - Rule definitions attached to load balancers
 - **[NetworkGateway](additional-nodes/network-gateway.md)** - Virtual network gateways
 - **[NetworkPeering](additional-nodes/network-peering.md)** - Virtual network peering connections
 - **[NetworkRoute](additional-nodes/network-route.md)** - Individual routes within route tables

docs/analysis/additional-nodes/analysis-service-firewall-rule.md

@@ -0,0 +1,27 @@
+# AnalysisServiceFirewallRule
+
+Represents firewall rule entries attached to an Analysis Services server.
+
+**Labels:** `:AnalysisServiceFirewallRule`
+
+**Properties:**
+
+- `name` - Firewall rule name
+- `serverId` - Parent Analysis Services server resource ID (used with `name` as a composite key)
+- `rangeStart` - Start of allowed IPv4 range
+- `rangeEnd` - End of allowed IPv4 range
+
+## Relationships
+
+### Incoming
+
+- **AnalysisServiceServer** → `HAS_RULE` → **AnalysisServiceFirewallRule** - Server that owns the firewall rule
+
+## Examples
+
+```cypher
+// List firewall rules per Analysis Services server
+MATCH (s:AnalysisServiceServer)-[:HAS_RULE]->(r:AnalysisServiceFirewallRule)
+RETURN s.serverFullName, r.name, r.rangeStart, r.rangeEnd
+ORDER BY s.serverFullName, r.name
+```

docs/analysis/additional-nodes/azure-stack-edge-machine-nic.md

@@ -0,0 +1,29 @@
+# AzureStackEdgeMachineNic
+
+Represents network interface cards attached to Azure Stack HCI edge machines (not an ARM resource itself).
+
+**Labels:** `:AzureStackEdgeMachineNic`
+
+**Properties:**
+
+- `machineId` - Parent edge machine ID (composite key with `adapterName`)
+- `adapterName` - Network adapter name (composite key with `machineId`)
+- `dnsServers` - DNS server addresses
+- `ip4Address` - IPv4 address
+- `macAddress` - MAC address
+- `rdmaCapability` - RDMA capability of the adapter
+- `subnetMask` - Subnet mask
+
+## Relationships
+
+### Incoming
+
+- **AzureStackEdgeMachine** → `HAS_NIC` → **AzureStackEdgeMachineNic** - Parent edge machine
+
+## Examples
+
+```cypher
+// Find edge machines and their NIC details
+MATCH (em:AzureStackEdgeMachine)-[:HAS_NIC]->(nic:AzureStackEdgeMachineNic)
+RETURN em.id, nic.adapterName, nic.ip4Address, nic.macAddress, nic.rdmaCapability
+```

docs/analysis/additional-nodes/federated-identity-credential.md

@@ -14,4 +14,4 @@ Represents federated identity credentials for applications.
 - `description` - Credential description
 
 **Relationships:**
-- `FEDERATED_CREDENTIAL` ← GraphApplication
+- `AUTHENTICATES` → GraphApplication

docs/analysis/additional-nodes/hybrid-extension.md

@@ -1,38 +0,0 @@
-# HybridExtension
-
-Represents extensions installed on hybrid machines (not an ARM resource itself).
-
-**Labels:** `:HybridExtension`
-
-**Properties:**
-
-- `id` - Extension ID (primary key)
-- `name` - Extension name
-- `type` - Extension type
-- `location` - Extension location
-- `typeHandlerVersion` - Type handler version
-- `autoUpgradeMinorVersion` - Auto upgrade minor version setting
-- `enableAutomaticUpgrade` - Enable automatic upgrade setting
-- `statusMessage` - Extension status message
-- `provisioningState` - Provisioning state
-
-## Relationships
-
-### Incoming
-
-- **HybridMachine** → `HAS_EXTENSION` → HybridExtension - Parent hybrid machine
-
-## Examples
-
-```cypher
-// Find all hybrid machine extensions
-MATCH (hm:HybridMachine)-[:HAS_EXTENSION]->(ext:HybridExtension)
-RETURN hm.displayName, ext.name, ext.type, ext.provisioningState
-```
-
-```cypher
-// Find extensions with auto upgrade enabled
-MATCH (ext:HybridExtension)
-WHERE ext.enableAutomaticUpgrade = true
-RETURN ext.name, ext.typeHandlerVersion
-```

docs/analysis/additional-nodes/hybrid-run-command-parameter.md

@@ -0,0 +1,17 @@
+# HybridRunCommandParameter
+
+Represents a parameter for a hybrid machine run command.
+
+**Labels:** `:HybridRunCommandParameter`
+
+**Properties:**
+
+- `name` - Parameter name (composite key with `commandId`)
+- `commandId` - Parent run command ID (composite key)
+- `value` - Parameter value
+
+## Relationships
+
+### Incoming
+
+- **HybridRunCommand** → `HAS_PARAMETER` → **HybridRunCommandParameter** - Parent run command

docs/analysis/additional-nodes/hybrid-run-command.md

@@ -0,0 +1,34 @@
+# HybridRunCommand
+
+Represents a run command resource associated with an Azure Arc-enabled hybrid machine.
+
+**Labels:** `:ArmResource:HybridRunCommand`
+
+**Properties:**
+
+- `id` - Run command resource ID (primary key)
+- `asyncExecution` - Whether execution is asynchronous
+- `runAsUser` - User context used to run the command
+- `timeoutInSeconds` - Command timeout in seconds
+- `treatFailureAsDeploymentFailure` - Failure handling behavior
+- `script` - Script body
+- `output` - Command output from the last execution
+
+## Relationships
+
+### Incoming
+
+- **HybridMachine** → `HAS_RUN_COMMAND` → **HybridRunCommand** - Parent hybrid machine
+
+### Outgoing
+
+- **HybridRunCommand** → `HAS_PARAMETER` → **HybridRunCommandParameter** - Parameters bound to the run command
+
+## Examples
+
+```cypher
+// Find hybrid run commands and their parameters
+MATCH (hm:HybridMachine)-[:HAS_RUN_COMMAND]->(cmd:HybridRunCommand)
+OPTIONAL MATCH (cmd)-[:HAS_PARAMETER]->(p:HybridRunCommandParameter)
+RETURN hm.displayName, cmd.id, collect(p.name) AS parameterNames
+```

docs/analysis/additional-nodes/key-vault-certificate-value.md

@@ -0,0 +1,48 @@
+# KeyVaultCertificateValue
+
+Represents versioned Azure Key Vault certificate value objects, including certificate material and issuance policy metadata.
+
+**Labels:** `:KeyVaultCertificateValue`
+
+**Properties:**
+
+- `id` - Certificate value version ID (primary key)
+- `name` - Certificate name
+- `cer` - Encoded certificate content
+- `contentType` - Certificate content type
+- `kid` - Related Key Vault key ID
+- `sid` - Related Key Vault secret ID
+- `x509Thumbprint` - Thumbprint value
+- `x509ThumbprintHex` - Hex-encoded thumbprint
+- `enabled` - Whether the certificate value is enabled
+- `notBefore` - Time before which the certificate value is invalid
+- `expires` - Expiration time
+- `created` - Creation time
+- `updated` - Last update time
+- `recoverableDays` - Number of recoverable days
+- `recoveryLevel` - Recovery level
+- `issuerTransparency` - Certificate transparency setting from the issuer policy
+- `issuerType` - Issuer certificate type
+- `issuerName` - Issuer name
+- `exportable` - Whether the private key is exportable
+- `keyType` - Key algorithm or key type
+- `secretContentType` - Content type used for the backing secret
+- `keyUsage` - X.509 key usage values
+- `x509SubjectName` - X.509 subject name from the policy
+- `x509DnsNames` - DNS subject alternative names
+- `x509Emails` - Email subject alternative names
+- `x509Upns` - UPN subject alternative names
+- `tags` - Certificate tags as `key:value` strings
+
+**Relationships:**
+
+- `HAS_VERSION` ← KeyVaultCertificate - Parent certificate metadata node
+
+## Example Queries
+
+Find versioned Key Vault certificate values and their issuance details:
+
+```cypher
+MATCH (c:KeyVaultCertificate)-[:HAS_VERSION]->(v:KeyVaultCertificateValue)
+RETURN c.name, v.x509SubjectName, v.secretContentType, v.expires
+```

docs/analysis/additional-nodes/key-vault-certificate.md

@@ -0,0 +1,38 @@
+# KeyVaultCertificate
+
+Represents Azure Key Vault certificate metadata.
+
+**Labels:** `:KeyVaultCertificate`
+
+**Properties:**
+
+- `id` - Certificate ID (primary key)
+- `name` - Certificate name
+- `subject` - Certificate subject
+- `x509Thumbprint` - Thumbprint value
+- `x509ThumbprintHex` - Hex-encoded thumbprint
+- `enabled` - Whether the certificate is enabled
+- `notBefore` - Time before which the certificate is invalid
+- `expires` - Expiration time
+- `created` - Creation time
+- `updated` - Last update time
+- `recoverableDays` - Number of recoverable days
+- `recoveryLevel` - Recovery level
+- `tags` - Certificate tags as `key:value` strings
+
+**Relationships:**
+
+- `HAS_CERTIFICATE` ← KeyVault - Parent Key Vault
+- `HAS_VERSION` → KeyVaultCertificateValue - Versioned certificate value objects
+- `MATCHES_CERT` → Certificate - Matched application or service principal certificates by thumbprint
+
+## Example Queries
+
+Find Key Vault certificates, their versions, and any matched Entra certificates:
+
+```cypher
+MATCH (kv:KeyVault)-[:HAS_CERTIFICATE]->(c:KeyVaultCertificate)
+OPTIONAL MATCH (c)-[:HAS_VERSION]->(v:KeyVaultCertificateValue)
+OPTIONAL MATCH (c)-[:MATCHES_CERT]->(cert:Certificate)
+RETURN kv.name, c.name, collect(DISTINCT v.id) AS versions, collect(DISTINCT cert.thumbprint) AS matchedThumbprints
+```

docs/analysis/additional-nodes/key-vault-secret-value.md

@@ -0,0 +1,37 @@
+# KeyVaultSecretValue
+
+Represents versioned Azure Key Vault secret values.
+
+**Labels:** `:KeyVaultSecretValue`
+
+**Properties:**
+
+- `id` - Secret value version ID (primary key)
+- `name` - Secret name
+- `value` - Secret value collected from Key Vault
+- `managed` - Whether Azure manages the secret
+- `contentType` - Secret content type
+- `kid` - Related Key Vault key ID, when present
+- `enabled` - Whether the secret value is enabled
+- `notBefore` - Time before which the secret value is invalid
+- `expires` - Expiration time
+- `created` - Creation time
+- `updated` - Last update time
+- `recoverableDays` - Number of recoverable days
+- `recoveryLevel` - Recovery level
+- `tags` - Secret tags as `key:value` strings
+
+**Relationships:**
+
+- `HAS_VERSION` ← KeyVaultSecret - Parent secret metadata node
+- `MATCHES_SECRET` → ClientSecret - Matched client secrets discovered during post-processing
+
+## Example Queries
+
+Find versioned Key Vault secret values and any matched client secrets:
+
+```cypher
+MATCH (s:KeyVaultSecret)-[:HAS_VERSION]->(v:KeyVaultSecretValue)
+OPTIONAL MATCH (v)-[:MATCHES_SECRET]->(c:ClientSecret)
+RETURN s.name, v.id, c.hint
+```

docs/analysis/additional-nodes/key-vault-secret.md

@@ -0,0 +1,38 @@
+# KeyVaultSecret
+
+Represents Azure Key Vault secret metadata.
+
+**Labels:** `:KeyVaultSecret`
+
+**Properties:**
+
+- `id` - Secret ID (primary key)
+- `name` - Secret name
+- `managed` - Whether Azure manages the secret
+- `contentType` - Secret content type
+- `kid` - Related Key Vault key ID, when present
+- `enabled` - Whether the secret is enabled
+- `notBefore` - Time before which the secret is invalid
+- `expires` - Expiration time
+- `created` - Creation time
+- `updated` - Last update time
+- `recoverableDays` - Number of recoverable days
+- `recoveryLevel` - Recovery level
+- `tags` - Secret tags as `key:value` strings
+
+**Relationships:**
+
+- `HAS_SECRET` ← KeyVault - Parent Key Vault
+- `HAS_VERSION` → KeyVaultSecretValue - Versioned secret values
+- `USED_BY` → WebCertificate - Web certificates backed by this secret
+
+## Example Queries
+
+Find Key Vault secrets, their versions, and any web certificates that consume them:
+
+```cypher
+MATCH (kv:KeyVault)-[:HAS_SECRET]->(s:KeyVaultSecret)
+OPTIONAL MATCH (s)-[:HAS_VERSION]->(v:KeyVaultSecretValue)
+OPTIONAL MATCH (s)-[:USED_BY]->(wc:WebCertificate)
+RETURN kv.name, s.name, collect(DISTINCT v.id) AS versions, collect(DISTINCT wc.name) AS webCertificates
+```

docs/analysis/additional-nodes/load-balancer-backend-address-pool.md

@@ -0,0 +1,22 @@
+# LoadBalancerBackendAddressPool
+
+Represents backend address pool objects attached to a load balancer.
+
+**Labels:** `:LoadBalancerBackendAddressPool`
+
+**Properties:**
+
+- `id` - Backend address pool resource ID (primary key)
+- `name` - Backend pool name
+- `provisioningState` - Current provisioning state
+- `type` - Azure resource type value
+
+## Relationships
+
+### Incoming
+
+- **LoadBalancer** -> `HAS_BACKEND_POOL` -> **LoadBalancerBackendAddressPool** - Parent load balancer
+
+### Outgoing
+
+- **LoadBalancerBackendAddressPool** -> `ASSOCIATED_WITH` -> **NetworkInterface** - Backend NIC configuration reference

docs/analysis/additional-nodes/load-balancer-frontend-ip-configuration.md

@@ -0,0 +1,23 @@
+# LoadBalancerFrontendIPConfiguration
+
+Represents frontend IP configuration objects for a load balancer.
+
+**Labels:** `:LoadBalancerFrontendIPConfiguration`
+
+**Properties:**
+
+- `id` - Frontend configuration resource ID (primary key)
+- `name` - Frontend configuration name
+- `privateIPAllocationMethod` - Private IP allocation method
+- `provisioningState` - Current provisioning state
+- `type` - Azure resource type value
+
+## Relationships
+
+### Incoming
+
+- **LoadBalancer** -> `HAS_LB_FRONTEND` -> **LoadBalancerFrontendIPConfiguration** - Parent load balancer
+
+### Outgoing
+
+- **LoadBalancerFrontendIPConfiguration** -> `HAS_IP` -> **PublicIPAddress** - Associated public IP (if present)

docs/analysis/additional-nodes/load-balancer-rule.md

@@ -0,0 +1,29 @@
+# LoadBalancerRule
+
+Represents load balancing rule definitions attached to a load balancer.
+
+**Labels:** `:LoadBalancerRule`
+
+**Properties:**
+
+- `id` - Rule resource ID (primary key)
+- `name` - Rule name
+- `protocol` - Protocol used by the rule
+- `frontendPort` - Frontend listening port
+- `backendPort` - Backend target port
+- `allowBackendPortConflict` - Whether backend port conflict is allowed
+- `disableConnectionTracking` - Whether connection tracking is disabled
+- `disableOutboundSnat` - Whether outbound SNAT is disabled
+- `enableConnectionTracking` - Whether connection tracking is enabled
+- `enableDestinationServiceEndpoint` - Whether destination service endpoint is enabled
+- `enableFloatingIP` - Whether floating IP is enabled
+- `enableTcpReset` - Whether TCP reset is enabled
+- `idleTimeoutInMinutes` - Idle timeout value
+- `provisioningState` - Current provisioning state
+- `type` - Azure resource type value
+
+## Relationships
+
+### Incoming
+
+- **LoadBalancer** -> `HAS_RULE` -> **LoadBalancerRule** - Load balancer that owns the rule

docs/analysis/additional-nodes/netapp-account-ad-domain.md

@@ -10,8 +10,11 @@ Represents an Active Directory domain configuration for an Azure NetApp Files ac
 - `administrators` - List of administrator accounts
 - `aesEncryption` - Whether AES encryption is enabled
 - `allowLocalNfsUsersWithLdap` - Whether local NFS users are allowed with LDAP
+- `backupOperators` - Backup operator accounts for the AD domain
 - `dns` - DNS server configuration
+- `domain` - Active Directory domain name
 - `encryptDCConnections` - Whether domain controller connections are encrypted
+- `kdcIP` - Kerberos KDC IP address
 - `ldapOverTLS` - Whether LDAP over TLS is enabled
 - `ldapSigning` - LDAP signing configuration
 - `organizationalUnit` - Organizational unit for computer accounts

docs/analysis/additional-nodes/vm-extension.md

@@ -2,7 +2,7 @@
 
 Represents an extension attached to an Azure virtual machine.
 
-**Labels:** `:VMExtension`
+**Labels:** `:ArmResource:VMExtension`
 
 **Properties:**
 

docs/analysis/additional-nodes/vm-run-command-parameter.md

@@ -6,7 +6,8 @@ Represents a parameter for a virtual machine run command.
 
 **Properties:**
 
-- `name` - Parameter name (primary key)
+- `name` - Parameter name (composite key with `commandId`)
+- `commandId` - Parent run command ID (composite key)
 - `value` - Parameter value
 
 ## Relationships

docs/analysis/arm-nodes/analysisservices/analysis-service-server.md

@@ -0,0 +1,41 @@
+# AnalysisServiceServer
+
+Represents Azure Analysis Services server resources.
+
+**Labels:** `:ArmResource:AnalysisServiceServer`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `managedMode` - Indicates whether the server is managed
+- `serverFullName` - Full server name
+- `serverMonitorMode` - Monitoring mode for the server
+- `state` - Current state of the server
+- `administrators` - Raw administrator member entries from the resource
+- `enablePowerBIService` - Whether Power BI service access is enabled
+
+## Relationships
+
+### Incoming
+
+- **GraphServicePrincipal** → `IS_ADMIN` → **AnalysisServiceServer** - Service principal listed as administrator
+- **GraphObject** → `IS_ADMIN` → **AnalysisServiceServer** - Directory object listed as administrator
+- **GraphUser** → `IS_ADMIN` → **AnalysisServiceServer** - User listed as administrator
+
+### Outgoing
+
+- **AnalysisServiceServer** → `HAS_RULE` → **AnalysisServiceFirewallRule** - Firewall rules defined on the server
+
+## Examples
+
+```cypher
+// Find Analysis Services servers and administrator principals
+MATCH (admin)-[:IS_ADMIN]->(s:AnalysisServiceServer)
+RETURN s.serverFullName, labels(admin), admin
+```
+
+```cypher
+// Find Analysis Services servers and their firewall rules
+MATCH (s:AnalysisServiceServer)-[:HAS_RULE]->(r:AnalysisServiceFirewallRule)
+RETURN s.serverFullName, r.name, r.rangeStart, r.rangeEnd
+```

docs/analysis/arm-nodes/azure-core/management-group.md

@@ -11,6 +11,6 @@ Azure Management Groups provide a way to efficiently manage access, policies, an
 
 ## Relationships
 
-- `Tenant` → `HAS_ENTITY` → `ManagementGroup` - Root management groups under tenants
-- `ManagementGroup` → `HAS_ENTITY` → `ManagementGroup` - Parent-child management group hierarchy
-- `ManagementGroup` → `HAS_SUBSCRIPTION` → `Subscription` - Management groups containing subscriptions
+- `Tenant` → `CONTAINS` → `ManagementGroup` - Root management groups under tenants
+- `ManagementGroup` → `CONTAINS` → `ManagementGroup` - Parent-child management group hierarchy
+- `ManagementGroup` → `CONTAINS` → `Subscription` - Management groups containing subscriptions

docs/analysis/arm-nodes/azure-core/resource-group.md

@@ -13,4 +13,4 @@ Represents Azure resource groups - logical containers for Azure resources.
 - `subscriptionId` - Parent subscription ID
 
 **Relationships:**
-- `HAS_RESOURCE` → Various ARM resources
+- `CONTAINS` → Various ARM resources

docs/analysis/arm-nodes/azure-core/tenant.md

@@ -16,5 +16,5 @@ Represents Azure tenants - the top-level organizational units in Azure.
 - `tenantType` - Tenant type
 
 **Relationships:**
-- `CONTAINS` → Subscription
+- `CONTAINS` → ManagementGroup
 - `ASSOCIATED_WITH` → GraphOrg (bidirectional)

docs/analysis/arm-nodes/azurestack/azure-stack-edge-machine.md

@@ -0,0 +1,39 @@
+# AzureStackEdgeMachine
+
+Represents Azure Stack HCI edge machine resources.
+
+**Labels:** `:ArmResource:AzureStackEdgeMachine`
+
+**Properties:**
+
+- `id` - Edge machine resource ID (primary key)
+- `arcMachineResourceGroupId` - Resource group ID of the associated Arc machine
+- `arcMachineResourceId` - Resource ID of the associated Arc machine
+- `cloudId` - Cloud identifier this edge machine is registered with
+- `connectivityStatus` - Connectivity status of the edge machine
+- `devicePoolResourceId` - Device pool resource ID
+- `edgeMachineKind` - Kind/type of edge machine
+- `lastUpdated` - Last update timestamp
+- `lastSyncTimestamp` - Last synchronization timestamp
+- `machineState` - Current machine state
+
+## Relationships
+
+### Outgoing
+
+- **AzureStackEdgeMachine** → `REGISTERED_BY` → **GraphObject** - Identity that registered this edge machine
+- **AzureStackEdgeMachine** → `HAS_NIC` → **AzureStackEdgeMachineNic** - Network interfaces attached to this edge machine
+
+## Examples
+
+```cypher
+// Find all edge machines and their connectivity status
+MATCH (em:AzureStackEdgeMachine)
+RETURN em.id, em.edgeMachineKind, em.connectivityStatus, em.machineState
+```
+
+```cypher
+// Find edge machines and their network interfaces
+MATCH (em:AzureStackEdgeMachine)-[:HAS_NIC]->(nic:AzureStackEdgeMachineNic)
+RETURN em.id, nic.adapterName, nic.ip4Address, nic.macAddress
+```

docs/analysis/arm-nodes/azurestack/azure-stack-registration.md

@@ -0,0 +1,30 @@
+# AzureStackRegistration
+
+Represents Azure Stack registration resources, which link on-premises Azure Stack hardware to an Azure subscription.
+
+**Labels:** `:ArmResource:AzureStackRegistration`
+
+**Properties:**
+
+- `id` - Registration resource ID (primary key)
+- `cloudId` - Cloud identifier for the registered Azure Stack
+
+## Relationships
+
+### Outgoing
+
+- **AzureStackRegistration** → `REGISTERED_BY` → **GraphObject** - Identity that registered this Azure Stack
+
+## Examples
+
+```cypher
+// Find all Azure Stack registrations
+MATCH (r:AzureStackRegistration)
+RETURN r.id, r.cloudId
+```
+
+```cypher
+// Find registrations and who registered them
+MATCH (r:AzureStackRegistration)-[:REGISTERED_BY]->(obj:GraphObject)
+RETURN r.id, r.cloudId, obj.id
+```

docs/analysis/arm-nodes/compute/gallery-image.md

@@ -0,0 +1,35 @@
+# GalleryImage
+
+Represents Azure Compute Gallery Image definitions.
+
+**Labels:** `:ArmResource:GalleryImage`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `architecture` - CPU architecture (e.g. x64, Arm64)
+- `osType` - OS type (Windows or Linux)
+- `hyperVGeneration` - Hyper-V generation (V1 or V2)
+- `offer` - Image offer identifier
+- `publisher` - Image publisher
+- `sku` - Image SKU
+- `osState` - OS state (Generalized or Specialized)
+- `provisioningState` - Provisioning state
+
+## Relationships
+
+### Incoming
+
+- **Gallery** → `HAS_GALLERY_IMAGE` → **GalleryImage** - Parent gallery contains this image definition
+
+### Outgoing
+
+- **GalleryImage** → `HAS_VERSION` → **GalleryImageVersion** - Versions of this image definition
+
+## Examples
+
+```cypher
+// Find gallery images and their parent galleries
+MATCH (g)-[:HAS_GALLERY_IMAGE]->(gi:GalleryImage)
+RETURN g.name, gi.name, gi.osType, gi.publisher, gi.offer, gi.sku
+```

docs/analysis/arm-nodes/compute/restore-point-collection.md

@@ -7,6 +7,8 @@ Represents VM restore point collections.
 **Properties:**
 
 - `id` - Restore point collection resource ID (primary key)
+- `restorePointCollectionId` - Collection identifier used for VM correlation
 
 **Relationships:**
-- `HAS_RESTOREPOINT` ← ArmResource (source VM)
+- `HAS_RESTOREPOINTS` <- VirtualMachine (source VM)
+- `HAS_INSTANCE` -> RestorePoint (instances in the collection)

docs/analysis/arm-nodes/compute/restore-point.md

@@ -0,0 +1,14 @@
+# RestorePoint
+
+Represents individual restore point instances inside a restore point collection.
+
+**Labels:** `:ArmResource:RestorePoint`
+
+**Properties:**
+
+- `id` - Restore point ARM resource ID (primary key)
+- `consistencyMode` - Snapshot consistency mode
+- `timeCreated` - Time the restore point was created
+
+**Relationships:**
+- `HAS_INSTANCE` <- RestorePointCollection (parent collection)

docs/analysis/arm-nodes/hybridcompute/hybrid-extension.md

@@ -1,20 +1,41 @@
 # HybridExtension
 
-Represents extensions installed on hybrid machines (not an ARM resource itself).
+Represents extensions installed on Azure Arc-enabled hybrid machines.
 
-**Labels:** `:HybridExtension`
+**Labels:** `:ArmResource:HybridExtension`
 
 **Properties:**
 
-- `id` - Extension ID (primary key)
+- `id` - Extension resource ID (primary key)
 - `name` - Extension name
-- `type` - Extension type
-- `location` - Extension location
+- `type` - Resource type (`microsoft.hybridcompute/machines/extensions`)
+- `location` - Resource location
+- `extType` - Extension type (e.g. `CustomScriptExtension`)
 - `typeHandlerVersion` - Type handler version
 - `autoUpgradeMinorVersion` - Auto upgrade minor version
 - `enableAutomaticUpgrade` - Enable automatic upgrade
-- `statusMessage` - Status message
+- `statusMessage` - Extension status message
 - `provisioningState` - Provisioning state
+- `publisher` - Extension publisher
+- `settings` - Serialized extension settings (JSON)
 
-**Relationships:**
-- `HAS_EXTENSION` ← HybridMachine
+## Relationships
+
+### Incoming
+
+- **HybridMachine** → `HAS_EXTENSION` → **HybridExtension** - Parent hybrid machine
+
+## Examples
+
+```cypher
+// Find all hybrid machine extensions
+MATCH (hm:HybridMachine)-[:HAS_EXTENSION]->(ext:HybridExtension)
+RETURN hm.displayName, ext.name, ext.extType, ext.provisioningState
+```
+
+```cypher
+// Find extensions with auto upgrade enabled
+MATCH (ext:HybridExtension)
+WHERE ext.enableAutomaticUpgrade = true
+RETURN ext.name, ext.extType, ext.typeHandlerVersion
+```

docs/analysis/arm-nodes/hybridcompute/hybrid-gateway.md

@@ -0,0 +1,23 @@
+# HybridGateway
+
+Represents an Azure Arc gateway resource used to connect hybrid machines to Azure through a managed endpoint.
+
+**Labels:** `:ArmResource:HybridGateway`
+
+**Properties:**
+
+- `id` - Gateway resource ID (primary key)
+- `allowedFeatures` - Features allowed through the gateway
+- `gatewayEndpoint` - Gateway endpoint URL
+- `gatewayId` - Unique gateway identifier
+- `gatewayType` - Type of gateway
+- `lastUpdateTime` - Last update timestamp
+- `provisioningState` - Provisioning state
+
+## Examples
+
+```cypher
+// Find all hybrid gateways
+MATCH (gw:HybridGateway)
+RETURN gw.id, gw.gatewayType, gw.gatewayEndpoint, gw.provisioningState
+```

docs/analysis/arm-nodes/hybridcompute/hybrid-private-link-scope.md

@@ -0,0 +1,21 @@
+# HybridPrivateLinkScope
+
+Represents an Azure Arc private link scope resource used to connect hybrid machines over private endpoints.
+
+**Labels:** `:ArmResource:HybridPrivateLinkScope`
+
+**Properties:**
+
+- `id` - Private link scope resource ID (primary key)
+- `privateLinkScopeId` - Unique private link scope identifier
+- `provisioningState` - Provisioning state
+- `publicNetworkAccess` - Public network access setting
+
+## Examples
+
+```cypher
+// Find private link scopes with public access enabled
+MATCH (pls:HybridPrivateLinkScope)
+WHERE pls.publicNetworkAccess = "Enabled"
+RETURN pls.id, pls.privateLinkScopeId
+```

docs/analysis/arm-nodes/insights/activity-log-alert.md

@@ -0,0 +1,27 @@
+# ActivityLogAlert
+
+Represents Azure Monitor Activity Log Alerts.
+
+**Labels:** `:ArmResource:ActivityLogAlert`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `description` - Alert description
+- `enabled` - Whether the alert is enabled
+- `condition` - Alert condition (JSON)
+
+## Relationships
+
+### Incoming
+
+- **ArmResource** → `HAS_ALERT` → **ActivityLogAlert** - Any ARM resource in scope fires this alert
+
+## Examples
+
+```cypher
+// Find all enabled alerts and their scoped resources
+MATCH (r:ArmResource)-[:HAS_ALERT]->(a:ActivityLogAlert)
+WHERE a.enabled = true
+RETURN r.id, labels(r), a.id, a.description
+```

docs/analysis/arm-nodes/keyvault/keyvault.md

@@ -19,3 +19,5 @@ Represents Azure Key Vault instances.
 
 **Relationships:**
 - `HAS_POLICY` → GraphObject (access policies for users/service principals)
+- `HAS_SECRET` → KeyVaultSecret
+- `HAS_CERTIFICATE` → KeyVaultCertificate

docs/analysis/arm-nodes/keyvault/managed-hsm.md

@@ -0,0 +1,31 @@
+# ManagedHSM
+
+Represents Azure Key Vault Managed HSM resources.
+
+**Labels:** `:ManagedHSM`
+
+**Properties:**
+
+- `id` - Managed HSM resource ID (primary key)
+- `enablePurgeProtection` - Whether purge protection is enabled
+- `enableSoftDelete` - Whether soft delete is enabled
+- `hsmUri` - Managed HSM URI
+- `publicNetworkAccess` - Public network access setting
+- `activationStatus` - Security domain activation status
+- `activationStatusMessage` - Security domain activation status message
+- `softDeleteRetentionInDays` - Soft delete retention period
+- `statusMessage` - Service status message
+
+## Relationships
+
+### Incoming
+
+- **GraphObject** → `IS_ADMIN` → **ManagedHSM** - Directory object configured as initial HSM administrator
+
+## Examples
+
+```cypher
+// Find Managed HSM resources and their administrators
+MATCH (go:GraphObject)-[:IS_ADMIN]->(hsm:ManagedHSM)
+RETURN hsm.id, hsm.hsmUri, go.id
+```

docs/analysis/arm-nodes/kusto/kusto-cluster.md

@@ -0,0 +1,41 @@
+# KustoCluster
+
+Represents Azure Data Explorer (Kusto) cluster resources.
+
+**Labels:** `:ArmResource:KustoCluster`
+
+**Properties:**
+
+- `id` - Cluster resource ID (primary key)
+- `acceptedAudiences` - Audiences accepted by the cluster
+- `allowedFqdnList` - List of allowed fully qualified domain names
+- `allowedIpRangeList` - List of allowed IP ranges
+- `dataIngestionUri` - URI for data ingestion
+- `enableAutoStop` - Whether auto-stop is enabled
+- `enableDiskEncryption` - Whether disk encryption is enabled
+- `enableDoubleEncryption` - Whether double encryption is enabled
+- `enablePurge` - Whether purge is enabled
+- `enableStreamingIngest` - Whether streaming ingestion is enabled
+- `engineType` - Type of engine (e.g., V3)
+- `publicIpType` - Type of public IP configuration
+- `publicNetworkAccess` - Public network access setting
+- `restrictOutboundNetworkAccess` - Whether outbound network access is restricted
+- `state` - Cluster state (e.g., Running, Unavailable)
+- `stateReason` - Reason for the cluster state
+- `trustedExternalTenants` - List of trusted external tenant IDs
+- `uri` - Cluster URI/endpoint
+
+## Examples
+
+```cypher
+// Find all Kusto clusters and their states
+MATCH (kc:KustoCluster)
+RETURN kc.id, kc.state, kc.uri, kc.enableAutoStop
+```
+
+```cypher
+// Find Kusto clusters with specific security settings
+MATCH (kc:KustoCluster)
+WHERE kc.enableDoubleEncryption = true AND kc.publicNetworkAccess = 'Disabled'
+RETURN kc.id, kc.uri
+```

docs/analysis/arm-nodes/netapp/netapp-account.md

@@ -15,4 +15,5 @@ Represents an Azure NetApp Files account for managing file storage pools and vol
 
 - **IS_DEPLOYED** → **NetAppAccountADDomain** - Links to Active Directory domain configurations
 - **CONTAINS** → **NetAppCapacityPool** - Contains capacity pools
+- **HAS_BACKUP_VAULT** → **NetAppBackupVault** - Associated backup vaults
 - **HAS_POLICY** → **NetAppSnapshotPolicy** - Associated snapshot policies

docs/analysis/arm-nodes/netapp/netapp-backup-vault.md

@@ -0,0 +1,14 @@
+# NetAppBackupVault
+
+Represents a backup vault for Azure NetApp Files account backups.
+
+**Labels:** `:ArmResource`, `:NetAppBackupVault`
+
+**Properties:**
+
+- `id` - Resource identifier (primary key)
+- `provisioningState` - Current provisioning state
+
+## Relationships
+
+- **NetAppAccount** → **HAS_BACKUP_VAULT** → **NetAppBackupVault** - Associated backup vault for the NetApp account

docs/analysis/arm-nodes/netapp/netapp-volume.md

@@ -10,6 +10,7 @@ Represents a volume within an Azure NetApp Files capacity pool.
 - `baremetalTenantId` - Bare metal tenant identifier
 - `coolAccess` - Cool access configuration
 - `creationToken` - Unique creation token for the volume
+- `enableSubvolumes` - Whether subvolumes are enabled
 - `encryptionKeySource` - Source of encryption keys
 - `fileSystemId` - File system identifier
 - `isDefaultQuotaEnabled` - Whether default quota is enabled

docs/analysis/arm-nodes/network/github-network-settings.md

@@ -0,0 +1,24 @@
+# GitHub Network Settings
+
+Represents Azure GitHub network settings resources used to associate GitHub connectivity settings with a subnet.
+
+**Labels:** `:ArmResource:GithubNetworkSettings`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `businessId` - GitHub business identifier associated with the network setting
+
+## Relationships
+
+### Incoming
+
+- **ArmResource** → `HAS_GITHUB_SETTING` → **GithubNetworkSettings** - Subnet resource associated with this GitHub network setting
+
+## Examples
+
+```cypher
+// Find GitHub network settings and their linked subnet resources
+MATCH (sub:ArmResource)-[:HAS_GITHUB_SETTING]->(setting:GithubNetworkSettings)
+RETURN sub.id, setting.businessId
+```

docs/analysis/arm-nodes/network/load-balancer.md

@@ -0,0 +1,29 @@
+# LoadBalancer
+
+Represents Azure Load Balancer resources.
+
+**Labels:** `:ArmResource:LoadBalancer`
+
+**Properties:**
+
+- `id` - Load balancer resource ID (primary key)
+- `resourceGuid` - Azure-generated unique resource GUID
+- `provisioningState` - Current provisioning state
+
+## Relationships
+
+### Outgoing
+
+- **LoadBalancer** -> `HAS_RULE` -> **LoadBalancerRule** - Load balancing rules attached to the load balancer
+- **LoadBalancer** -> `HAS_LB_FRONTEND` -> **LoadBalancerFrontendIPConfiguration** - Frontend IP configurations
+- **LoadBalancer** -> `HAS_BACKEND_POOL` -> **LoadBalancerBackendAddressPool** - Backend address pools
+
+## Examples
+
+```cypher
+// Find load balancers with frontend and backend topology
+MATCH (lb:LoadBalancer)
+OPTIONAL MATCH (lb)-[:HAS_LB_FRONTEND]->(fe:LoadBalancerFrontendIPConfiguration)
+OPTIONAL MATCH (lb)-[:HAS_BACKEND_POOL]->(be:LoadBalancerBackendAddressPool)
+RETURN lb.name, count(DISTINCT fe) AS frontendCount, count(DISTINCT be) AS backendPoolCount
+```

docs/analysis/arm-nodes/network/network-watcher.md

@@ -0,0 +1,12 @@
+# NetworkWatcher
+
+Represents Azure Network Watcher resources.
+
+**Labels:** `:ArmResource:NetworkWatcher`
+
+**Properties:**
+
+- `id` - Network Watcher resource ID (primary key)
+- `provisioningState` - Current provisioning state
+
+No additional relationships are created for NetworkWatcher nodes by the current ingestion config.

docs/analysis/arm-nodes/network/virtual-hub.md

@@ -0,0 +1,27 @@
+# VirtualHub
+
+Represents Azure Virtual Hub resources.
+
+**Labels:** `:ArmResource:VirtualHub`
+
+**Properties:**
+
+- `id` - Virtual hub resource ID (primary key)
+- `allowBranchToBranchTraffic` - Whether branch-to-branch traffic is allowed
+- `hubRoutingPreference` - Hub routing preference mode
+- `provisioningState` - Current provisioning state
+- `routingState` - Current routing state
+- `virtualRouterAsn` - ASN used by the virtual router
+- `virtualRouterIps` - Virtual router IP addresses
+
+## Relationships
+
+No direct relationships are created in ingestion for this node type.
+
+## Examples
+
+```cypher
+// Find virtual hubs and routing posture
+MATCH (vh:VirtualHub)
+RETURN vh.name, vh.hubRoutingPreference, vh.routingState, vh.virtualRouterAsn
+```

docs/analysis/arm-nodes/oracle/oracle-autonomous-db.md

@@ -0,0 +1,54 @@
+# OracleAutonomousDB
+
+Represents Oracle Autonomous Database resources discovered from Azure ARM.
+
+**Labels:** `:ArmResource:OracleAutonomousDB`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `actualUsedDataStorageSizeInTbs` - Actual used storage size in TB
+- `allocatedStorageSizeInTbs` - Allocated storage size in TB
+- `backupRententionPeriodInDays` - Backup retention period in days
+- `characterSet` - Database character set
+- `databaseType` - Oracle database type (from ARM `dataBaseType`)
+- `dbVersion` - Database version
+- `displayName` - Display name
+- `isLocalDataGuardEnabled` - Whether local Data Guard is enabled
+- `isMtlsConnectionRequired` - Whether mTLS is required for connections
+- `isRemoteDataGuardEnabled` - Whether remote Data Guard is enabled
+- `localDisasterRecoveryType` - Local disaster recovery type
+- `ociUrl` - Oracle Cloud URL
+- `ocid` - Oracle Cloud identifier
+- `openMode` - Database open mode
+- `permissionLevel` - Permission/access level
+- `privateEndpoint` - Private endpoint resource
+- `privateEndpointIp` - Private endpoint IP address
+- `privateEndpointLabel` - Private endpoint label
+- `timeCreated` - Creation timestamp
+- `timeLocalDataGuardEnabled` - Timestamp when local Data Guard was enabled
+- `highConnectionString` - High workload connection string
+- `mediumConnectionString` - Medium workload connection string
+- `lowConnectionString` - Low workload connection string
+- Dynamic URL properties from `connectionUrls` (e.g. `apexUrl`, `ordsUrl`, `sqlDevWebUrl`, `graphStudioUrl`, `machineLearningNotebookUrl`, `databaseTransformsUrl`)
+
+## Relationships
+
+### Incoming
+
+- **ArmResource** → `HAS_ORACLE_RESOURCE` → **OracleAutonomousDB** - Subnet-linked parent resource contains this database
+
+## Examples
+
+```cypher
+// Find Oracle autonomous databases and connection info
+MATCH (db:OracleAutonomousDB)
+RETURN db.displayName, db.dbVersion, db.openMode, db.permissionLevel
+```
+
+```cypher
+// Find databases with mTLS not required
+MATCH (db:OracleAutonomousDB)
+WHERE db.isMtlsConnectionRequired = false
+RETURN db.displayName, db.privateEndpoint
+```

docs/analysis/arm-nodes/syntex/syntex-document-processor.md

@@ -0,0 +1,19 @@
+# SyntexDocumentProcessor
+
+Represents Microsoft Syntex document processor resources, which provide AI-based document processing capabilities integrated with SharePoint Online.
+
+**Labels:** `:ArmResource:SyntexDocumentProcessor`
+
+**Properties:**
+
+- `id` - Resource ID (primary key)
+- `spoTenantId` - SharePoint Online tenant ID
+- `spoTenantUrl` - SharePoint Online tenant URL
+
+## Examples
+
+```cypher
+// Find all Syntex document processors
+MATCH (sdp:SyntexDocumentProcessor)
+RETURN sdp.id, sdp.spoTenantId, sdp.spoTenantUrl
+```

docs/analysis/arm-nodes/web/web-site.md

@@ -29,4 +29,7 @@ Represents Azure App Service web apps.
 - `inProgressOperationId` - In-progress operation ID
 
 **Relationships:**
-- `HOSTS_SITE` ← ServerFarm
+
+- `HOSTS_SITE` ← ServerFarm - Created only when `properties.serverFarmId` is non-null
+
+Sites without a `serverFarmId` are still ingested, without a hosting ServerFarm relationship.

docs/analysis/edges/approle.md

@@ -1,13 +0,0 @@
-# APPROLE (Legacy)
-
-`APPROLE` is a legacy relationship name kept for historical documentation.
-
-Current ingestion uses:
-
-- `ASSIGNED_APPROLE` for app-role assignments from principals to service principals
-- `HAS_APPROLE` for role definitions on applications/service principals
-
-See:
-
-- [ASSIGNED_APPROLE](assigned-approle.md)
-- [HAS_APPROLE](has-approle.md)

docs/analysis/edges/assigned-to.md

@@ -1,7 +0,0 @@
-# ASSIGNED_TO (Legacy)
-
-`ASSIGNED_TO` is a legacy relationship name.
-
-Current app-role assignment ingestion uses `ASSIGNED_APPROLE`.
-
-See [ASSIGNED_APPROLE](assigned-approle.md) for the active relationship type and query examples.

docs/analysis/edges/contains.md

@@ -8,7 +8,8 @@ Represents hierarchical containment relationships in Azure.
 
 **Common Patterns:**
 
-- Tenants contain subscriptions
+- Tenants contain management groups
+- Management groups contain subscriptions
 - Subscriptions contain resource groups
 - Resource groups contain resources
 - Virtual networks contain subnets

docs/analysis/edges/created.md

@@ -0,0 +1,21 @@
+# CREATED
+
+Links a creator application to an application or service principal using `createdByAppId`. The edge is created only when that property is present.
+
+## Usage
+
+- **GraphObject** → `CREATED` → **GraphApplication** - Creator matched by `appId`, stored in lowercase
+- **GraphApplication** → `CREATED` → **GraphServicePrincipal** - Creator matched by `appId`
+
+A creator can initially be a placeholder with only an `appId`; its full details need not have been collected.
+
+## Properties
+
+No additional properties on the relationship.
+
+## Examples
+
+```cypher
+MATCH (creator)-[:CREATED]->(created)
+RETURN creator.appId, created.displayName, labels(created)
+```

docs/analysis/edges/delegated-to-client.md

@@ -0,0 +1,38 @@
+# DELEGATED_TO_CLIENT
+
+Represents user-specific delegated OAuth2 permission grants.
+
+**Direction:** `(user)-[:DELEGATED_TO_CLIENT]->(servicePrincipal)`
+
+**Description:** Indicates that a user has granted delegated OAuth2 permissions to a client application (service principal). This relationship is created when `principalId` is present on the OAuth2 permission grant, meaning a specific user consented to the application acting on their behalf.
+
+**Common Patterns:**
+- Users consent to applications requesting delegated permissions
+- Created alongside a corresponding `HAS_USER_GRANT` relationship from the client to the resource
+
+**Properties:**
+
+- `id` - OAuth2 permission grant ID
+- `scopes` - List of delegated permission scopes granted
+- `consentType` - Type of consent (e.g., `Principal`)
+- `principalId` - The user who granted consent
+- `startTime` - When the grant was created
+- `expiryTime` - When the grant expires
+
+## Query Examples
+
+```cypher
+// Find all applications a user has delegated permissions to
+MATCH path=(u:GraphUser)-[:DELEGATED_TO_CLIENT]->(sp:GraphServicePrincipal)
+RETURN path
+
+// Find users who have delegated Mail.Read scope
+MATCH (u:GraphUser)-[r:DELEGATED_TO_CLIENT]->(sp:GraphServicePrincipal)
+WHERE "Mail.Read" IN r.scopes
+RETURN u.displayName, sp.displayName, r.scopes
+
+// Find users with the most delegated grants
+MATCH (u:GraphUser)-[r:DELEGATED_TO_CLIENT]->(sp:GraphServicePrincipal)
+RETURN u.displayName, COUNT(sp) AS grantCount
+ORDER BY grantCount DESC
+```

docs/analysis/edges/federated-credential.md

@@ -1,21 +0,0 @@
-# FEDERATED_CREDENTIAL
-
-Represents the relationship between Graph applications and their federated identity credentials.
-
-## Usage
-
-This relationship connects Graph applications to their federated identity credentials:
-
-- **GraphApplication** → `FEDERATED_CREDENTIAL` → **FederatedIdentityCredential** - Applications to their federated credentials
-
-## Properties
-
-No additional properties on the relationship.
-
-## Examples
-
-```cypher
-// Find all applications with federated credentials
-MATCH (app:GraphApplication)-[:FEDERATED_CREDENTIAL]->(cred:FederatedIdentityCredential)
-RETURN app.displayName, cred.name, cred.issuer, cred.subject
-```

docs/analysis/edges/has-alert.md

@@ -0,0 +1,34 @@
+# HAS_ALERT
+
+Represents the relationship between an Azure resource scope and an Activity Log Alert that monitors it.
+
+**Direction:**
+- `(resource:ArmResource)-[:HAS_ALERT]->(alert:ActivityLogAlert)`
+
+**Description:** Any Azure resource listed as a scope for an Activity Log Alert has a `HAS_ALERT` edge pointing to that alert. This relationship allows you to trace which resources are being monitored by alerting rules and identify gaps in alert coverage.
+
+**Common Patterns:**
+- Subscriptions, resource groups, or individual resources can be scopes for activity log alerts
+- A single alert may monitor multiple scopes, resulting in multiple `HAS_ALERT` edges pointing to the same alert node
+- Activity log alerts can be enabled or disabled; the `enabled` property on the `ActivityLogAlert` node reflects current state
+
+**Properties:** None
+
+## Query Examples
+
+```cypher
+// Find all enabled activity log alerts and the resources they monitor
+MATCH (resource:ArmResource)-[:HAS_ALERT]->(alert:ActivityLogAlert)
+WHERE alert.enabled = true
+RETURN resource.id AS monitoredResource, alert.id AS alert, alert.description
+
+// Find resources with no activity log alerts
+MATCH (resource:ArmResource)
+WHERE NOT (resource)-[:HAS_ALERT]->(:ActivityLogAlert)
+RETURN resource.id
+
+// Find all scopes for a specific alert
+MATCH (resource:ArmResource)-[:HAS_ALERT]->(alert:ActivityLogAlert)
+WHERE alert.id = '<alert-id>'
+RETURN resource.id
+```

docs/analysis/edges/has-backend-pool.md

@@ -0,0 +1,18 @@
+# HAS_BACKEND_POOL
+
+Represents the relationship between a load balancer and its backend address pools.
+
+## Usage
+
+- **LoadBalancer** -> `HAS_BACKEND_POOL` -> **LoadBalancerBackendAddressPool** - Backend pool attached to a load balancer
+
+## Properties
+
+No additional properties on the relationship.
+
+## Examples
+
+```cypher
+MATCH (lb:LoadBalancer)-[:HAS_BACKEND_POOL]->(pool:LoadBalancerBackendAddressPool)
+RETURN lb.name, pool.name, pool.provisioningState
+```

docs/analysis/edges/has-backup-vault.md

@@ -0,0 +1,22 @@
+# HAS_BACKUP_VAULT
+
+Links NetApp accounts to their associated NetApp backup vault resources.
+
+**Relationship:** `:HAS_BACKUP_VAULT`
+
+**Direction:** `(:NetAppAccount)-[:HAS_BACKUP_VAULT]->(:NetAppBackupVault)`
+
+## Description
+
+This relationship indicates which backup vault belongs to a specific NetApp account.
+
+## Examples
+
+### NetAppAccount → NetAppBackupVault
+Connects an Azure NetApp Files account to the backup vault used to store and manage backups for that account.
+
+## Use Cases
+
+- Identifying backup coverage for NetApp accounts
+- Mapping backup dependencies for NetApp storage workloads
+- Tracing account-to-vault backup topology

docs/analysis/edges/has-builder.md

@@ -1,15 +0,0 @@
-# HAS_BUILDER
-
-Associates a Container App (or related resource) with its App Builder resource.
-
-## Usage
-
-- **AppBuilder** relationships are not currently emitted, but this edge is reserved for linking builder resources when available.
-
-## Examples
-
-```cypher
-// Placeholder until builder relationships are emitted
-MATCH (:AppBuilder)-[r:HAS_BUILDER]->(n)
-RETURN count(r) AS edges
-```

docs/analysis/edges/has-disk.md

@@ -1,7 +0,0 @@
-# HAS_DISK (Legacy)
-
-`HAS_DISK` is not currently emitted by the active ingestion mappings.
-
-Disk/image linkage is currently represented via `HAS_SOURCE` in compute image/version mappings.
-
-See [HAS_SOURCE](has-source.md) for active relationship semantics.

docs/analysis/edges/has-entity.md

@@ -1,31 +0,0 @@
-# HAS_ENTITY
-
-Represents hierarchical relationships in Azure management structures.
-
-## Usage
-
-This relationship connects Azure management entities in hierarchical structures:
-
-- **Tenant** → `HAS_ENTITY` → **ManagementGroup** - Root management groups under tenants
-- **ManagementGroup** → `HAS_ENTITY` → **ManagementGroup** - Parent-child management group relationships
-
-## Properties
-
-No additional properties on the relationship.
-
-## Examples
-
-```cypher
-// Find root management groups (directly under tenant)
-MATCH (t:Tenant)-[:HAS_ENTITY]->(mg:ManagementGroup)
-RETURN t.displayName, mg.displayName
-
-// Find management group hierarchy
-MATCH path = (root:ManagementGroup)-[:HAS_ENTITY*]->(child:ManagementGroup)
-WHERE NOT (root)<-[:HAS_ENTITY]-(:ManagementGroup)
-RETURN path
-
-// Find all entities under a specific management group
-MATCH (mg:ManagementGroup {displayName: 'Production'})-[:HAS_ENTITY*]->(entity)
-RETURN mg.displayName, entity
-```

docs/analysis/edges/has-gateway.md

@@ -1,21 +0,0 @@
-# HAS_GATEWAY
-
-Represents the relationship between network peering connections and their gateways.
-
-## Usage
-
-This relationship connects network peering to their gateway configurations:
-
-- **NetworkPeering** → `HAS_GATEWAY` → **NetworkGateway** - Network peering to their gateways
-
-## Properties
-
-No additional properties on the relationship.
-
-## Examples
-
-```cypher
-// Find all peering connections with gateways
-MATCH (peering:NetworkPeering)-[:HAS_GATEWAY]->(gateway:NetworkGateway)
-RETURN peering.name, gateway.gatewayType
-```

docs/analysis/edges/has-github-setting.md

@@ -0,0 +1,21 @@
+# HAS_GITHUB_SETTING
+
+Represents an association between a subnet resource and a GitHub network settings resource.
+
+## Usage
+
+This relationship connects subnet resources to their GitHub network settings:
+
+- **ArmResource** → `HAS_GITHUB_SETTING` → **GithubNetworkSettings** - Subnet resource linked to a GitHub network setting
+
+## Properties
+
+No additional properties on the relationship.
+
+## Examples
+
+```cypher
+// Find subnet resources with GitHub network settings
+MATCH (sub:ArmResource)-[:HAS_GITHUB_SETTING]->(setting:GithubNetworkSettings)
+RETURN sub.id, setting.businessId
+```

docs/analysis/edges/has-instance.md

@@ -0,0 +1,21 @@
+# HAS_INSTANCE
+
+Represents the relationship between container resources and their concrete instances.
+
+## Usage
+
+This relationship connects restore point collections to their restore point instances:
+
+- **RestorePointCollection** -> `HAS_INSTANCE` -> **RestorePoint** - Collection to restore point instance
+
+## Properties
+
+No additional properties on the relationship.
+
+## Examples
+
+```cypher
+// Find restore point collections and their instances
+MATCH (rpc:RestorePointCollection)-[:HAS_INSTANCE]->(rp:RestorePoint)
+RETURN rpc.id, rp.id, rp.timeCreated
+```

docs/analysis/edges/has-key.md

@@ -1,25 +0,0 @@
-# HAS_KEY
-
-Represents storage account key relationships (from enrichment).
-
-**Direction:** `(storageAccount)-[:HAS_KEY]->(key)`
-
-**Description:** Indicates that a storage account has access keys (discovered during enrichment).
-
-**Properties:**
-
-- Key name
-- Key permissions
-- Key type
-
-## Query Examples
-
-```cypher
-// Find all storage account keys
-MATCH path=(sa:StorageAccount)-[:HAS_KEY]->(key)
-RETURN path
-
-// Find key properties and permissions
-MATCH (sa:StorageAccount)-[rel:HAS_KEY]->(key)
-RETURN sa, key, rel.keyName, rel.permissions, rel.keyType
-```

docs/analysis/edges/has-lb-frontend.md

@@ -0,0 +1,18 @@
+# HAS_LB_FRONTEND
+
+Represents the relationship between a load balancer and its frontend IP configurations.
+
+## Usage
+
+- **LoadBalancer** -> `HAS_LB_FRONTEND` -> **LoadBalancerFrontendIPConfiguration** - Frontend configuration attached to a load balancer
+
+## Properties
+
+No additional properties on the relationship.
+
+## Examples
+
+```cypher
+MATCH (lb:LoadBalancer)-[:HAS_LB_FRONTEND]->(fe:LoadBalancerFrontendIPConfiguration)
+RETURN lb.name, fe.name, fe.privateIPAllocationMethod
+```

docs/analysis/edges/has-oauth-grant.md

@@ -0,0 +1,39 @@
+# HAS_OAUTH_GRANT
+
+Represents tenant-level (admin consent) OAuth2 permission grants between service principals.
+
+**Direction:** `(servicePrincipal)-[:HAS_OAUTH_GRANT]->(servicePrincipal)`
+
+**Description:** Indicates that a client service principal has been granted OAuth2 permissions to a resource service principal at the tenant level. This typically represents admin consent where no specific user principal is involved — the grant applies across the entire tenant.
+
+**Common Patterns:**
+- Admin-consented API permissions between applications
+- Tenant-wide delegated permission grants (no specific user)
+
+**Properties:**
+
+- `id` - OAuth2 permission grant ID
+- `scopes` - List of delegated permission scopes granted
+- `consentType` - Type of consent (e.g., `AllPrincipals`)
+- `principalId` - Always null for tenant-level grants
+- `startTime` - When the grant was created
+- `expiryTime` - When the grant expires
+
+## Query Examples
+
+```cypher
+// Find all tenant-level OAuth2 grants
+MATCH path=(client:GraphServicePrincipal)-[:HAS_OAUTH_GRANT]->(resource:GraphServicePrincipal)
+RETURN path
+
+// Find applications with broad admin-consented scopes
+MATCH (client:GraphServicePrincipal)-[r:HAS_OAUTH_GRANT]->(resource:GraphServicePrincipal)
+WHERE size(r.scopes) > 5
+RETURN client.displayName, resource.displayName, r.scopes
+
+// Find all admin-consented grants to Microsoft Graph
+MATCH (client:GraphServicePrincipal)-[r:HAS_OAUTH_GRANT]->(resource:GraphServicePrincipal)
+WHERE resource.displayName = "Microsoft Graph"
+RETURN client.displayName, r.scopes
+ORDER BY size(r.scopes) DESC
+```

docs/analysis/edges/has-oracle-resource.md

@@ -0,0 +1,26 @@
+# HAS_ORACLE_RESOURCE
+
+Represents the relationship between an ARM resource and Oracle database resources hosted within it.
+
+**Direction:** `(subnet)-[:HAS_ORACLE_RESOURCE]->(oracleDb)`
+
+**Description:** Indicates that an ARM resource (typically a subnet) contains or is associated with an Oracle Autonomous Database resource.
+
+**Properties:** None
+
+## Usage
+
+- **ArmResource** → `HAS_ORACLE_RESOURCE` → **OracleAutonomousDB** - Subnet or parent resource associated with an Oracle Autonomous Database
+
+## Query Examples
+
+```cypher
+// Find all Oracle databases and their parent resources
+MATCH (src:ArmResource)-[:HAS_ORACLE_RESOURCE]->(db:OracleAutonomousDB)
+RETURN src.id, db.displayName, db.dbVersion
+
+// Find Oracle databases accessible via private endpoint
+MATCH (src:ArmResource)-[:HAS_ORACLE_RESOURCE]->(db:OracleAutonomousDB)
+WHERE db.privateEndpointIp IS NOT NULL
+RETURN src.id, db.displayName, db.privateEndpointIp
+```

docs/analysis/edges/has-published-scope.md

@@ -0,0 +1,20 @@
+# HAS_PUBLISHED_SCOPE
+
+Links a service principal to a permission scope in its `publishedPermissionScopes` collection.
+
+## Usage
+
+- **GraphServicePrincipal** → `HAS_PUBLISHED_SCOPE` → **GraphApplicationScope** - Published permission scope
+
+This relationship describes a published scope, not a consent grant or role assignment.
+
+## Properties
+
+No additional properties on the relationship.
+
+## Examples
+
+```cypher
+MATCH (sp:GraphServicePrincipal)-[:HAS_PUBLISHED_SCOPE]->(scope:GraphApplicationScope)
+RETURN sp.displayName, scope.value, scope.isEnabled
+```

docs/analysis/edges/has-resource.md

@@ -1,21 +0,0 @@
-# HAS_RESOURCE
-
-Represents the relationship between resource groups and their contained resources.
-
-## Usage
-
-This relationship connects resource groups to the Azure resources they contain:
-
-- **ResourceGroup** → `HAS_RESOURCE` → **ArmResource** - Resource groups to their contained resources
-
-## Properties
-
-No additional properties on the relationship.
-
-## Examples
-
-```cypher
-// Find all resource groups and their resources
-MATCH (rg:ResourceGroup)-[:HAS_RESOURCE]->(resource:ArmResource)
-RETURN rg.name, resource.name, resource.type
-```

docs/analysis/edges/has-restorepoint.md

@@ -1,21 +0,0 @@
-# HAS_RESTOREPOINT
-
-Represents the relationship between virtual machines and their restore points.
-
-## Usage
-
-This relationship connects virtual machines to their restore point collections:
-
-- **VirtualMachine** → `HAS_RESTOREPOINT` → **RestorePointCollection** - Virtual machines to their restore points
-
-## Properties
-
-No additional properties on the relationship.
-
-## Examples
-
-```cypher
-// Find all virtual machines with restore points
-MATCH (vm:VirtualMachine)-[:HAS_RESTOREPOINT]->(rp:RestorePointCollection)
-RETURN vm.name, rp.name, rp.restorePointCollectionSourceId
-```

docs/analysis/edges/has-restorepoints.md

@@ -0,0 +1,21 @@
+# HAS_RESTOREPOINTS
+
+Represents the relationship between virtual machines and restore point collections.
+
+## Usage
+
+This relationship connects virtual machines to their restore point collections:
+
+- **VirtualMachine** -> `HAS_RESTOREPOINTS` -> **RestorePointCollection** - VM to collection ownership
+
+## Properties
+
+No additional properties on the relationship.
+
+## Examples
+
+```cypher
+// Find all virtual machines with restore point collections
+MATCH (vm:VirtualMachine)-[:HAS_RESTOREPOINTS]->(rpc:RestorePointCollection)
+RETURN vm.name, rpc.id, rpc.restorePointCollectionId
+```

docs/analysis/edges/has-subnet.md

@@ -1,21 +0,0 @@
-# HAS_SUBNET
-
-Represents the relationship between virtual networks and their subnets.
-
-## Usage
-
-This relationship connects virtual networks to their contained subnets:
-
-- **VirtualNetwork** → `HAS_SUBNET` → **Subnet** - Virtual networks to their subnets
-
-## Properties
-
-No additional properties on the relationship.
-
-## Examples
-
-```cypher
-// Find all virtual networks and their subnets
-MATCH (vnet:VirtualNetwork)-[:HAS_SUBNET]->(subnet:Subnet)
-RETURN vnet.name, subnet.name, subnet.addressPrefix
-```

docs/analysis/edges/has-subscription.md

@@ -1,33 +0,0 @@
-# HAS_SUBSCRIPTION
-
-Represents the relationship between management groups and their contained subscriptions.
-
-## Usage
-
-This relationship connects management groups to the Azure subscriptions they contain:
-
-- **ManagementGroup** → `HAS_SUBSCRIPTION` → **Subscription** - Management groups containing subscriptions
-
-## Properties
-
-No additional properties on the relationship.
-
-## Examples
-
-```cypher
-// Find all subscriptions in a management group
-MATCH (mg:ManagementGroup)-[:HAS_SUBSCRIPTION]->(sub:Subscription)
-RETURN mg.displayName, sub.displayName
-
-// Find management groups with many subscriptions
-MATCH (mg:ManagementGroup)-[:HAS_SUBSCRIPTION]->(sub:Subscription)
-WITH mg, COUNT(sub) as subCount
-WHERE subCount > 5
-RETURN mg.displayName, subCount
-ORDER BY subCount DESC
-
-// Find subscription hierarchy through management groups
-MATCH path = (root:ManagementGroup)-[:HAS_ENTITY*]->(mg:ManagementGroup)-[:HAS_SUBSCRIPTION]->(sub:Subscription)
-WHERE NOT (root)<-[:HAS_ENTITY]-(:ManagementGroup)
-RETURN path
-```

docs/analysis/edges/has-user-grant.md

@@ -0,0 +1,30 @@
+# HAS_USER_GRANT
+
+Represents a client application's user-delegated permission grant to a resource.
+
+**Direction:** `(servicePrincipal)-[:HAS_USER_GRANT]->(servicePrincipal)`
+
+**Description:** Indicates that a client service principal has a user-delegated permission grant to access a resource service principal. Created alongside a `DELEGATED_TO_CLIENT` relationship when a specific user consents to delegated permissions — the user delegates to the client, and the client has a user grant to the resource.
+
+**Common Patterns:**
+- Always paired with a `DELEGATED_TO_CLIENT` from the consenting user to the client
+- Represents the client-to-resource leg of a user-consented delegated permission
+
+**Properties:** None
+
+## Query Examples
+
+```cypher
+// Find all user-delegated grants from clients to resources
+MATCH path=(client:GraphServicePrincipal)-[:HAS_USER_GRANT]->(resource:GraphServicePrincipal)
+RETURN path
+
+// Trace the full delegation chain: user -> client -> resource
+MATCH (u:GraphUser)-[:DELEGATED_TO_CLIENT]->(client:GraphServicePrincipal)-[:HAS_USER_GRANT]->(resource:GraphServicePrincipal)
+RETURN u.displayName, client.displayName, resource.displayName
+
+// Find resources with the most user-delegated grants
+MATCH (client:GraphServicePrincipal)-[:HAS_USER_GRANT]->(resource:GraphServicePrincipal)
+RETURN resource.displayName, COUNT(client) AS grantCount
+ORDER BY grantCount DESC
+```

docs/analysis/edges/hosts-site.md

@@ -1,21 +0,0 @@
-# HOSTS_SITE
-
-Represents the relationship between server farms and the web sites they host.
-
-## Usage
-
-This relationship connects App Service plans (server farms) to the web applications they host:
-
-- **ServerFarm** → `HOSTS_SITE` → **WebSite** - Server farms to their hosted web sites
-
-## Properties
-
-No additional properties on the relationship.
-
-## Examples
-
-```cypher
-// Find all server farms and the sites they host
-MATCH (sf:ServerFarm)-[:HOSTS_SITE]->(site:WebSite)
-RETURN sf.name, site.name, site.kind
-```

docs/analysis/edges/is-admin.md

@@ -0,0 +1,28 @@
+# IS_ADMIN
+
+Represents an administrative relationship where a principal administers a target resource.
+
+## Usage
+
+This relationship is used to connect principals to resources they administer:
+
+- **GraphServicePrincipal** → `IS_ADMIN` → **AnalysisServiceServer** - Service principal administrator
+- **GraphObject** → `IS_ADMIN` → **AnalysisServiceServer** - Object-based administrator reference
+- **GraphUser** → `IS_ADMIN` → **AnalysisServiceServer** - User administrator
+- **GraphObject** → `IS_ADMIN` → **ManagedHSM** - Initial Managed HSM administrator
+
+## Properties
+
+No additional properties on the relationship.
+
+## Examples
+
+```cypher
+// Find principals that administer Analysis Services servers
+MATCH (p)-[:IS_ADMIN]->(s:AnalysisServiceServer)
+RETURN labels(p), p, s.serverFullName
+
+// Find GraphObjects that administer Managed HSM resources
+MATCH (go:GraphObject)-[:IS_ADMIN]->(hsm:ManagedHSM)
+RETURN go.id, hsm.id, hsm.hsmUri
+```

docs/analysis/edges/manages.md

@@ -9,6 +9,7 @@ Represents management relationships between resources.
 **Common Patterns:**
 - Automation accounts manage runbooks
 - SQL servers manage databases
+- Entra ID managers manage enabled member users
 
 **Properties:** None
 
@@ -26,4 +27,8 @@ RETURN path
 // Find management relationships
 MATCH path=(manager)-[:MANAGES]->(managed)
 RETURN path
+
+// Find Entra ID users and their managers
+MATCH path=(manager:GraphUser)-[:MANAGES]->(user:GraphUser)
+RETURN path
 ```

docs/analysis/edges/rbac-roles.md

@@ -1,47 +0,0 @@
-# Dynamic Role Relationships
-
-RBAC relationships are created dynamically based on Azure role assignments. The relationship type matches the role name.
-
-**Direction:** `(principal)-[:ROLE_NAME]->(scope)`
-
-**Description:** Indicates that a security principal (user, group, service principal) has been assigned a specific role at a particular scope.
-
-**Common Role Types:**
-
-- `Owner` - Full access to all resources
-- `Contributor` - Can create and manage all types of Azure resources
-- `Reader` - Can view existing Azure resources
-- `User Access Administrator` - Can manage user access to Azure resources
-- Various service-specific roles (e.g., `Storage Account Contributor`, `Virtual Machine Contributor`)
-
-**Properties:**
-
-- `id` - Role assignment ID
-- `description` - Role assignment description
-- `roleName` - Name of the assigned role
-- `roleType` - Type of role (BuiltInRole, CustomRole)
-- `actions` - Array of allowed actions
-- `notActions` - Array of denied actions
-- `dataActions` - Array of allowed data actions
-- `notDataActions` - Array of denied data actions
-
-## Query Examples
-
-```cypher
-// Find all users with Owner roles
-MATCH path=(u:GraphUser)-[:Owner]->(r)
-RETURN path
-
-// Find all Contributors at subscription level
-MATCH path=(principal)-[:Contributor]->(sub:Subscription)
-RETURN path
-
-// Find service principals with elevated permissions
-MATCH path=(sp:GraphServicePrincipal)-[role:Owner|Contributor]->(scope)
-RETURN path
-
-// Find all role assignments for a specific user
-MATCH path=(u:GraphUser {userPrincipalName: '[email protected]'})-[role]->(scope)
-WHERE type(role) IN ['Owner', 'Contributor', 'Reader', 'User Access Administrator']
-RETURN path
-```

docs/analysis/edges/registered-by.md

@@ -0,0 +1,23 @@
+# REGISTERED_BY
+
+Represents the relationship between an Azure Stack resource and the identity that registered it.
+
+**Direction:** `(resource)-[:REGISTERED_BY]->(graphObject)`
+
+**Description:** Indicates that an Azure Stack resource (registration or edge machine) was registered by a specific identity (Graph object).
+
+**Properties:** None
+
+## Usage
+
+- **AzureStackRegistration** → `REGISTERED_BY` → **GraphObject** - Azure Stack registration associated with its registering identity
+- **AzureStackEdgeMachine** → `REGISTERED_BY` → **GraphObject** - Edge machine associated with its registering identity
+
+## Query Examples
+
+```cypher
+// Find all Azure Stack resources and their registering identities
+MATCH (r:ArmResource)-[:REGISTERED_BY]->(obj:GraphObject)
+WHERE r:AzureStackRegistration OR r:AzureStackEdgeMachine
+RETURN r.id, labels(r), obj.id
+```

docs/analysis/edges/represented-by.md

@@ -4,7 +4,7 @@ Represents the relationship between applications and service principals.
 
 **Direction:** `(application)-[:REPRESENTED_BY]->(servicePrincipal)`
 
-**Description:** Indicates that an application is represented by a service principal in the directory.
+**Description:** Indicates that an identity is represented by a service principal or other identity object in the directory.
 
 **Properties:** None
 
@@ -15,10 +15,9 @@ Represents the relationship between applications and service principals.
 MATCH path=(app:GraphApplication)-[:REPRESENTED_BY]->(sp:GraphServicePrincipal)
 RETURN path
 
-// Find applications without service principals
-MATCH (app:GraphApplication)
-WHERE NOT (app)-[:REPRESENTED_BY]->()
-RETURN app
+// Find the service principal for a user-assigned identity
+MATCH path=(identity:UserAssignedIdentity)-[:REPRESENTED_BY]->(sp:GraphServicePrincipal)
+RETURN path
 
 // Find service principals without applications
 MATCH (sp:GraphServicePrincipal)

docs/analysis/edges/uses-certificate.md

@@ -1,17 +0,0 @@
-# USES_CERTIFICATE
-
-Represents Web App usage of a certificate resource.
-
-**Direction:** `(webSite)-[:USES_CERTIFICATE]->(webCertificate)`
-
-**Description:** Created from `hostNameSslStates` on `WebSite` resources for SNI-enabled bindings with certificate references.
-
-**Properties:** None
-
-## Query Examples
-
-```cypher
-// Find sites and certificates they use
-MATCH (site:WebSite)-[:USES_CERTIFICATE]->(cert:WebCertificate)
-RETURN site.name, cert.name, cert.expirationDate
-```

docs/analysis/edges/uses.md

@@ -1,11 +0,0 @@
-# USES (Legacy)
-
-`USES` is a legacy generic relationship and is not currently emitted by active mappings.
-
-Current usage relationships are represented by specific edge types such as:
-
-- `USES_STORAGE`
-- `USES_STORAGE_DFS`
-- `USES_CERTIFICATE`
-
-See the corresponding edge docs for current behavior.

docs/analysis/graph-nodes.md

@@ -1,9 +1,10 @@
-# Graph Nodes
+# GraphObject
 
 <h2>GraphObject (Base Label)</h2>
 
-All Microsoft Graph entities inherit from the base `GraphObject` label and include the `id` property.
+Microsoft Graph directory entities use the base `GraphObject` label. Fully collected entities include an `id`; creator placeholders introduced by [`CREATED`](edges/created.md) can initially have only an `appId`.
 
 **Common Properties:**
 
-- `id` - Unique identifier (primary key)
+- `id` - Unique object identifier (primary key)
+- `odataType` - Lowercase `@odata.type`, when present, on users, groups, applications, service principals, devices, and administrative units

docs/analysis/graph-nodes/graph-administrative-unit.md

@@ -6,6 +6,8 @@ Represents Entra ID administrative units collected from Microsoft Graph.
 
 **Properties:**
 
+- `odataType` - Lowercase `@odata.type`, when returned by Microsoft Graph
+
 - `description` - Administrative unit description
 - `displayName` - Administrative unit display name
 - `isMemberManagementRestricted` - Whether member management is restricted

docs/analysis/graph-nodes/graph-application-scope.md

@@ -0,0 +1,29 @@
+# GraphApplicationScope
+
+Represents a permission scope from a service principal's `publishedPermissionScopes` collection.
+
+**Labels:** `:GraphApplicationScope`
+
+**Properties:**
+
+- `id` - Permission scope ID (merge key)
+- `adminConsentDescription` - Description shown for administrator consent
+- `adminConsentDisplayName` - Display name shown for administrator consent
+- `isEnabled` - Whether the scope is enabled
+- `type` - Consent type returned by Microsoft Graph
+- `userConsentDescription` - Description shown for user consent
+- `userConsentDisplayName` - Display name shown for user consent
+- `value` - Permission scope value
+
+## Relationships
+
+### Incoming
+
+- **GraphServicePrincipal** → [`HAS_PUBLISHED_SCOPE`](../edges/has-published-scope.md) → **GraphApplicationScope** - Service principal publishing the scope
+
+## Examples
+
+```cypher
+MATCH (sp:GraphServicePrincipal)-[:HAS_PUBLISHED_SCOPE]->(scope:GraphApplicationScope)
+RETURN sp.displayName, scope.value, scope.type
+```

docs/analysis/graph-nodes/graph-application.md

@@ -6,6 +6,21 @@ Represents Entra ID applications collected from Microsoft Graph.
 
 **Properties:**
 
+- `description` - Application description
+- `notes` - Application notes
+- `createdDateTime` - Creation timestamp
+- `createdByAppId` - Application ID of the creator
+- `applicationTemplateId` - Application template ID
+- `isAuthorizationServiceEnabled` - Authorization service flag
+- `isDeviceOnlyAuthSupported` - Device-only authentication support flag
+- `isDisabled` - Whether the application is disabled
+- `isFallbackPublicClient` - Fallback public client flag
+- `isManagementRestricted` - Management restriction flag
+- `nativeAuthenticationApisEnabled` - Native authentication API configuration
+- `defaultRedirectUri` - First URI in `web.redirectUris`
+
+- `odataType` - Lowercase `@odata.type`, when returned by Microsoft Graph
+
 - `id` - Application object ID (primary key)
 - `displayName` - Application's display name
 - `appId` - Application ID (client ID)
@@ -16,20 +31,25 @@ Represents Entra ID applications collected from Microsoft Graph.
 - `publicClientRedirectUris` - Array of public client redirect URIs
 - `spaRedirectUris` - Array of single-page application redirect URIs
 - `webRedirectUris` - Array of web application redirect URIs
+- `implicitAccessToken` - Whether implicit grant flow access token issuance is enabled
+- `implicitIdToken` - Whether implicit grant flow ID token issuance is enabled
 
 ## Relationships
 
 ### Incoming
 
+- **GraphObject** → [`CREATED`](../edges/created.md) → **GraphApplication** - Creator identified by `createdByAppId`
+
 - **GraphObject** → `OWNS` → **GraphApplication** - Owners of the application
-- **GraphObject** → `APPROLE` → **GraphApplication** - Objects with app role assignments
+- **FederatedIdentityCredential** → `AUTHENTICATES` → **GraphApplication** - Federated identity credentials
 - **ClientSecret** → `AUTHENTICATES` → **GraphApplication** - Client secrets for authentication
 - **Certificate** → `AUTHENTICATES` → **GraphApplication** - Certificates for authentication
 
 ### Outgoing
 
+- **GraphApplication** → [`CREATED`](../edges/created.md) → **GraphServicePrincipal** - Service principals created by the application
+
 - **GraphApplication** → `HAS_APPROLE` → **GraphAppRole** - App roles defined by the application
-- **GraphApplication** → `FEDERATED_CREDENTIAL` → **FederatedIdentityCredential** - Federated identity credentials
 
 ## Examples
 
@@ -48,6 +68,12 @@ RETURN app.displayName, collect(owner.displayName) AS owners
 
 ```cypher
 // Find applications with federated credentials
-MATCH (app:GraphApplication)-[:FEDERATED_CREDENTIAL]->(cred:FederatedIdentityCredential)
+MATCH (cred:FederatedIdentityCredential)-[:AUTHENTICATES]->(app:GraphApplication)
 RETURN app.displayName, cred.issuer, cred.subject
 ```
+
+```cypher
+// Find applications created by another application
+MATCH (creator:GraphObject)-[:CREATED]->(app:GraphApplication)
+RETURN creator.appId, app.displayName, app.createdDateTime, app.applicationTemplateId
+```

docs/analysis/graph-nodes/graph-device.md

@@ -6,6 +6,8 @@ Represents Entra ID devices collected from Microsoft Graph.
 
 **Properties:**
 
+- `odataType` - Lowercase `@odata.type`, when returned by Microsoft Graph
+
 - `displayName` - Device display name
 - `accountEnabled` - Whether the device account is enabled
 - `deviceId` - Device identifier

docs/analysis/graph-nodes/graph-eligible-role-assignment.md

@@ -1,30 +0,0 @@
-# Eligible Role Assignments
-
-Represents eligible role assignments from Microsoft Graph PIM (Privileged Identity Management).
-
-**Labels:** `:GraphObject`, `:GraphRole`
-
-This configuration creates `IS_ROLE_ELIGIBLE` relationships between principals and their eligible Graph roles.
-
-**Relationship Properties (on IS_ROLE_ELIGIBLE):**
-
-- `createdDateTime` - Creation date/time
-- `directoryScopeId` - Directory scope ID
-- `memberType` - Member type
-- `modifiedDateTime` - Modified date/time
-- `expirationType` - Expiration type
-- `startDateTime` - Start date/time
-- `endDateTime` - End date/time
-- `recurrence` - Recurrence schedule
-
-## Relationships
-
-- **GraphObject** → `IS_ROLE_ELIGIBLE` → **GraphRole** - Principal is eligible for the role
-
-## Examples
-
-```cypher
-// Find users eligible for directory roles
-MATCH (u:GraphUser)-[r:IS_ROLE_ELIGIBLE]->(role:GraphRole)
-RETURN u.displayName, role.displayName, r.expirationType, r.endDateTime
-```

docs/analysis/graph-nodes/graph-group.md

@@ -6,6 +6,8 @@ Represents Entra ID groups collected from Microsoft Graph.
 
 **Properties:**
 
+- `odataType` - Lowercase `@odata.type`, when returned by Microsoft Graph
+
 - `id` - Group object ID (primary key)
 - `displayName` - Group display name
 - `groupTypes` - Array of group types (e.g., ["DynamicMembership", "Unified"])

docs/analysis/graph-nodes/graph-service-principal.md

@@ -6,6 +6,13 @@ Represents Entra ID service principals collected from Microsoft Graph.
 
 **Properties:**
 
+- `id` - Service principal object ID (primary key)
+- `createdByAppId` - Application ID of the creator
+- `agentAppId` - Agent application ID, when present
+- `agentIdentityBlueprintId` - Agent identity blueprint ID, when present
+
+- `odataType` - Lowercase `@odata.type`, when returned by Microsoft Graph
+
 - `displayName` - Service principal's display name
 - `accountEnabled` - Whether the service principal is enabled
 - `alternativeNames` - Alternative names for the service principal
@@ -17,3 +24,38 @@ Represents Entra ID service principals collected from Microsoft Graph.
 - `logoutUrl` - Logout URL for the service principal
 - `replyUrls` - Array of reply URLs
 - `servicePrincipalNames` - Array of service principal names
+
+## Relationships
+
+### Incoming
+
+- **GraphApplication** → [`CREATED`](../edges/created.md) → **GraphServicePrincipal** - Creator identified by `createdByAppId`
+- **GraphApplication** → [`REPRESENTED_BY`](../edges/represented-by.md) → **GraphServicePrincipal** - Application represented by the service principal, matched by `appId`
+- **GraphObject** → [`ASSIGNED_APPROLE`](../edges/assigned-approle.md) → **GraphServicePrincipal** - Principal assigned an app role on this resource
+- **GraphObject** → [`OWNS`](../edges/owns.md) → **GraphServicePrincipal** - Owner of the service principal
+
+### Outgoing
+
+- **GraphServicePrincipal** → [`HAS_PUBLISHED_SCOPE`](../edges/has-published-scope.md) → **GraphApplicationScope** - Scopes from `publishedPermissionScopes`
+- **GraphServicePrincipal** → [`HAS_APPROLE`](../edges/has-approle.md) → **GraphAppRole** - Roles defined by the service principal
+
+## Examples
+
+```cypher
+MATCH (sp:GraphServicePrincipal)-[:HAS_PUBLISHED_SCOPE]->(scope:GraphApplicationScope)
+RETURN sp.displayName, scope.value, scope.adminConsentDisplayName, scope.isEnabled
+```
+
+```cypher
+// Review assignments, including principals with only an object ID
+MATCH (principal:GraphObject)-[assignment:ASSIGNED_APPROLE]->(resource:GraphServicePrincipal)
+RETURN coalesce(principal.displayName, principal.id) AS principal,
+       resource.displayName, assignment.appRoleId
+```
+
+```cypher
+// Find service principals with agent identity metadata
+MATCH (sp:GraphServicePrincipal)
+WHERE sp.agentAppId IS NOT NULL OR sp.agentIdentityBlueprintId IS NOT NULL
+RETURN sp.displayName, sp.odataType, sp.agentAppId, sp.agentIdentityBlueprintId
+```

docs/analysis/graph-nodes/graph-user.md

@@ -6,6 +6,12 @@ Represents Entra ID users collected from Microsoft Graph.
 
 **Properties:**
 
+- `agentIdentityBlueprintId` - Agent identity blueprint ID, when present
+- `identityParentId` - Parent identity ID, when present
+- `identityParentType` - Parent identity type, when present
+
+- `odataType` - Lowercase `@odata.type`, when returned by Microsoft Graph
+
 - `id` - User object ID (primary key)
 - `accountEnabled` - Whether the user account is enabled
 - `city` - User's city
@@ -16,6 +22,7 @@ Represents Entra ID users collected from Microsoft Graph.
 - `displayName` - User's display name
 - `givenName` - User's first name
 - `jobTitle` - User's job title
+- `lastPasswordChangeDateTime` - When the user's password was last changed or created
 - `mail` - User's email address
 - `mailNickname` - User's mail nickname
 - `mobilePhone` - User's mobile phone number
@@ -37,6 +44,10 @@ Represents Entra ID users collected from Microsoft Graph.
 
 ## Relationships
 
+### Incoming
+
+- **GraphUser** ← `MANAGES` ← **GraphObject** - The user's manager
+
 ### Outgoing
 
 - **GraphUser** → `MEMBER_OF` → **GraphObject** - Groups the user is a member of
@@ -62,3 +73,26 @@ RETURN u.displayName, u.mail, u.companyName
 MATCH (u:GraphUser)-[:MEMBER_OF]->(g:GraphGroup)
 RETURN u.displayName, collect(g.displayName) AS groups
 ```
+
+```cypher
+// Find enabled member users and their managers
+MATCH (manager:GraphObject)-[:MANAGES]->(user:GraphUser)
+WHERE user.accountEnabled = true AND user.userType = "Member"
+RETURN user.displayName, coalesce(manager.displayName, manager.id) AS manager
+```
+
+```cypher
+// Review collected password-change timestamps
+MATCH (user:GraphUser)
+WHERE user.lastPasswordChangeDateTime IS NOT NULL
+RETURN user.userPrincipalName, user.lastPasswordChangeDateTime
+ORDER BY user.lastPasswordChangeDateTime
+```
+
+```cypher
+// Find users with agent identity metadata
+MATCH (user:GraphUser)
+WHERE user.agentIdentityBlueprintId IS NOT NULL OR user.identityParentId IS NOT NULL
+RETURN user.displayName, user.odataType, user.agentIdentityBlueprintId,
+       user.identityParentId, user.identityParentType
+```