- Usage Tutorial
- What RDS instances are installed in my AWS accounts?
- Which RDS instances have encryption turned off?
- Which EC2 instances are directly exposed to the internet?
- Which S3 buckets have a policy granting any level of anonymous access to the bucket?
- How many unencrypted RDS instances do I have in all my AWS accounts?
- Given a node label, what other node labels can be connected to it?
- Given a node label, what are the possible property names defined on it?
- Learning more
- Data Enrichment
- Extending Cartography with Analysis Jobs
- Mapping AWS Access Permissions
- Permalinking Bookmarklet
- Cartography Schema
- ℹ️ Quick notes on notation
- Cartography metadata schema
- AWS Schema
- AWSAccount
- AWSCidrBlock
- AWSGroup
- AWSInspectorFinding
- AWSInspectorPackage
- AWSLambda
- AWSLambdaFunctionAlias
- AWSLambdaEventSourceMapping
- AWSLambdaLayer
- AWSPolicy
- AWSPolicyStatement
- AWSPrincipal
- AWSPrincipal::AWSUser
- AWSPrincipal::AWSRole
- AWSTransitGateway
- AWSTransitGatewayAttachment
- AWSVpc
- Tag::AWSTag
- AccountAccessKey
- DBSubnetGroup
- DNSRecord
- DNSRecord::AWSDNSRecord
- DNSZone
- DNSZone::AWSDNSZone
- DynamoDBTable
- EC2Instance
- EC2KeyPair
- EC2PrivateIp
- EC2Reservation
- EC2SecurityGroup
- EC2Subnet
- AWSInternetGateway
- ECRRepository
- EC2NetworkAcl
- EC2NetworkAclRule :: IpPermissionInbound / IpPermissionEgress
- ECRRepositoryImage
- ECRImage
- Package
- ECRScanFinding (:Risk:CVE)
- EKSCluster
- EMRCluster
- ESDomain
- Endpoint
- Endpoint::ELBListener
- Endpoint::ELBV2Listener
- Ip
- IpRule
- IpRule::IpPermissionInbound
- LoadBalancer
- LoadBalancerV2
- Nameserver
- NetworkInterface
- AWSPeeringConnection
- RedshiftCluster
- RDSCluster
- RDSInstance
- RDSSnapshot
- S3Acl
- S3Bucket
- S3PolicyStatement
- KMSKey
- KMSAlias
- KMSGrant
- APIGatewayRestAPI
- APIGatewayStage
- APIGatewayClientCertificate
- APIGatewayResource
- AutoScalingGroup
- EC2Image
- EC2ReservedInstance
- SecretsManagerSecret
- EBSVolume
- EBSSnapshot
- SQSQueue
- SecurityHub
- AWSConfigurationRecorder
- AWSConfigDeliveryChannel
- AWSConfigRule
- LaunchConfiguration
- LaunchTemplate
- LaunchTemplateVersion
- ElasticIPAddress
- ECSCluster
- ECSContainerInstance
- ECSService
- ECSTaskDefinition
- ECSContainerDefinition
- ECSTask
- ECSContainer
- SSMInstanceInformation
- SSMInstancePatch
- AWSIdentityCenter
- AWSSSOUser
- AWSPermissionSet
- Azure Schema
- AzureTenant
- AzurePrincipal
- AzureSubscription
- VirtualMachine
- AzureDataDisk
- AzureDisk
- AzureSnapshot
- AzureSQLServer
- AzureServerDNSAlias
- AzureServerADAdministrator
- AzureRecoverableDatabase
- AzureRestorableDroppedDatabase
- AzureFailoverGroup
- AzureElasticPool
- AzureSQLDatabase
- AzureReplicationLink
- AzureDatabaseThreatDetectionPolicy
- AzureRestorePoint
- AzureTransparentDataEncryption
- AzureStorageAccount
- AzureStorageQueueService
- AzureStorageTableService
- AzureStorageFileService
- AzureStorageBlobService
- AzureStorageQueue
- AzureStorageTable
- AzureStorageFileShare
- AzureStorageBlobContainer
- AzureCosmosDBAccount
- AzureCosmosDBLocation
- AzureCosmosDBCorsPolicy
- AzureCosmosDBAccountFailoverPolicy
- AzureCDBPrivateEndpointConnection
- AzureCosmosDBVirtualNetworkRule
- AzureCosmosDBSqlDatabase
- AzureCosmosDBCassandraKeyspace
- AzureCosmosDBMongoDBDatabase
- AzureCosmosDBTableResource
- AzureCosmosDBSqlContainer
- AzureCosmosDBCassandraTable
- AzureCosmosDBMongoDBCollection
- DigitalOcean Schema
- GCP Schema
- Github Schema
- GSuite Schema
- Jamf Schema
- Kubernetes Schema
- Okta Schema
- Pagerduty Schema
- How to use Drift-Detection
- Sample queries
- Which AWS IAM roles have admin permissions in my accounts?
- Which AWS IAM roles in my environment have the ability to delete policies?
- Which AWS IAM roles in my environment have an action that contains the word “create”?
- What RDS instances are installed in my AWS accounts?
- Which RDS instances have encryption turned off?
- Which EC2 instances are exposed (directly or indirectly) to the internet?
- Which ELB LoadBalancers are internet accessible?
- Which ELBv2 LoadBalancerV2s (Application Load Balancers) are internet accessible?
- Which S3 buckets have a policy granting any level of anonymous access to the bucket?
- How many unencrypted RDS instances do I have in all my AWS accounts?
- What languages are used in a given GitHub repository?
- What are the dependencies used in a given GitHub repository?
- Given a dependency, which GitHub repos depend on it?
- What are all the dependencies used across all GitHub repos?