Cartography

Cartography is a Python tool that pulls infrastructure assets and their relationships into a Neo4j graph database.

What it connects: AWS, GCP, Azure, Kubernetes, GitHub, Okta, Entra ID, CrowdStrike, and 30+ more platforms.

Questions it answers:

Which identities have access to which datastores? How about across multiple tenants, or providers?
Am I affected by any critical vulnerabilities or compromised software packages?
What are the network paths in and out of my environment?
Which compute instances are exposed to the internet?
What AI agents are running in production, and what permissions do they have?

Quick Start

Install Cartography

pip install cartography

Install cartography[neo4j-rust] instead to swap in Neo4j's Rust Bolt codec, which cuts sync time by roughly 20-30%. See Faster Neo4j driver.

Start Neo4j database

docker run -d --publish=7474:7474 --publish=7687:7687 -v data:/data --env=NEO4J_AUTH=none neo4j:5-community

Confirm that http://localhost:7474 is up.

Sync your first data source (AWS example)

Ensure your AWS credentials and default region are configured (e.g. via AWS_PROFILE, AWS_DEFAULT_REGION, or ~/.aws/config). See AWS credentials docs for reference.

Run Cartography:

cartography --neo4j-uri bolt://localhost:7687 --selected-modules aws

See the full install guide for other platforms.

Query the graph

Open http://localhost:7474 and try:

// Find unencrypted RDS instances by account
MATCH (a:AWSAccount)-[:RESOURCE]->(rds:AWSRDSInstance{storage_encrypted:false})
RETURN a.name, rds.id

// Find EC2 instances exposed to the internet
MATCH (instance:AWSEC2Instance{exposed_internet: true})
RETURN instance.instanceid, instance.publicdnsname

See the querying tutorial and data schema for more use-cases.

Run security rules

Once Cartography has populated the reachable Neo4j graph, list, inspect, and run security rules. This quickstart uses the no-auth Neo4j container started above, so no password is required:

cartography-rules list
cartography-rules list object_storage_public
cartography-rules run object_storage_public

For authenticated Neo4j, set NEO4J_PASSWORD or use one of the other secure password options in the rules docs.

Supported platforms

Click to expand full list of 30+ supported platforms

Airbyte - Organization, Workspace, User, Source, Destination, Connection, Tag, Stream
Amazon Web Services - ACM, API Gateway, Bedrock, CloudWatch, CodeBuild, Config, Cognito, EC2, ECS, ECR (including multi-arch images, image layers, and attestations), EFS, Elasticsearch, Elastic Kubernetes Service (EKS), DynamoDB, Glue, GuardDuty, IAM, Inspector, KMS, Lambda, RDS, Redshift, Route53, S3, SageMaker, Secrets Manager(Secret Versions), Security Hub, SNS, SQS, SSM, STS, Tags
AIBOM - AI component detections linked to ECR images
Anthropic - Organization, ApiKey, User, Workspace
BigFix - Computers
Cloudflare - Account, Role, Member, Zone, DNSRecord
Crowdstrike Falcon - Hosts, Spotlight vulnerabilities, CVEs
DigitalOcean
Duo - Users, Groups, Endpoints
GitHub - repos, branches, users, teams, dependency graph manifests, dependencies
Google Cloud Platform - Artifact Registry, Bigtable, Cloud Functions, Cloud Resource Manager, Cloud Run, Cloud SQL, Compute including SSL policies and target proxies, DNS, IAM, KMS, Secret Manager, Storage, Google Kubernetes Engine, Vertex AI
Google Workspace - users, groups, devices, OAuth apps
Huntress - accounts, organizations, agents, incident reports, console users and roles
Jumpcloud
Kandji - Devices
Keycloak - Realms, Users, Groups, Roles, Scopes, Clients, IdentityProviders, Authentication Flows, Authentication Executions, Organizations, Organization Domains
Kubernetes - Cluster, Namespace, Service, Pod, Container, ServiceAccount, Role, RoleBinding, ClusterRole, ClusterRoleBinding, OIDCProvider
Lastpass - users
Microsoft Azure - App Service, Container Instance, CosmosDB, Data Factory, Event Grid, Firewall, Firewall Policy, Functions, Key Vault, Azure Kubernetes Service (AKS), Load Balancer, Logic Apps, Management Groups, Resource Group, SQL, Storage, Virtual Machine, Virtual Networks
Microsoft Entra ID - Users, Groups, Applications, OUs, App Roles, federation to AWS Identity Center, Intune Managed Devices, Intune Detected Apps, Intune Compliance Policies
CVE Metadata - CVE enrichment with CVSS, EPSS scores, and CISA KEV data from NVD and FIRST.org
NIST CVE - Common Vulnerabilities and Exposures (CVE) data from NIST database (deprecated - use CVE Metadata instead)
Netlify - Accounts, Users, Invites, Sites, Deploys, Functions, Dev Servers, Agent Runners, Database Branches, Database Snapshots, Environment Variables, Build Hooks, Notification Hooks, Deploy Keys, Snippets, Service Instances, DNS Zones, DNS Records, Certificates, Forms
Okta - users, groups, organizations, roles, applications, factors, trusted origins, reply URIs, federation to AWS roles, federation to AWS Identity Center
OpenAI - Organization, AdminApiKey, User, Project, ServiceAccount, ApiKey
Oracle Cloud Infrastructure - IAM
PagerDuty - Users, teams, services, schedules, escalation policies, integrations, vendors
Railway - Workspaces, Projects, Environments, Services, Service Instances, Deployments, Domains, TCP Proxies, Volumes, Variables, Tokens
Scaleway - Projects, IAM, Local Storage, Instances
SentinelOne - Accounts, Agents, Applications, Application Versions, CVEs
Slack - Teams, Users, UserGroups, Channels
SnipeIT - Users, Assets
Snowflake - Accounts, Users, Service Users, Roles, Database Roles, Grants, Role Hierarchy, Ownership, Programmatic Access Tokens, Credentials, Warehouses, Compute Pools, Resource Monitors, Databases, Schemas, Tables, Views, Iceberg Tables, Dynamic Tables, Streams, Tasks, Pipes, Stages, External Volumes, Secrets, Network Policies, Network Rules, Policies, Integrations (Security, Storage, API, Catalog, Notification, External Access), Services, Image Repositories, Notebooks, Streamlits, Shares, Listings, Replication Groups
Socket.dev - Organizations, Repositories, Dependencies, Security Alerts (CVE, malware, supply chain risks), Fixes
Spacelift - Accounts, Spaces,Users, Stacks, WorkerPools, Workers, Runs, GitCommits
SubImage - Tenant, TeamMember, APIKey, Neo4jUser, Module, Framework
Tailscale - Tailnet, Users, Devices, Groups, Tags, PostureIntegrations, DevicePostures, DevicePostureConditions, device posture compliance relationships
Trivy Scanner - AWS ECR Images

Community

Join us on Slack: CNCF Slack in the #cartography channel.
Monthly community meeting — minutes · past recordings

Contributing

Thank you for considering contributing to Cartography!

All contributors and participants must follow the CNCF Code of Conduct.

Submit a GitHub issue to report a bug or request a new feature. Larger discussions happen in GitHub Discussions.

Read CONTRIBUTING.md for the issue workflow, development setup, tests, DCO sign-off requirement, and pull request expectations. You do not need an issue assignment or maintainer permission before starting work.