diff --git a/docs/opengraph/extensions/jamfhound/reference/edges/jamf_azmatchedemail.mdx b/docs/opengraph/extensions/jamfhound/reference/edges/jamf_azmatchedemail.mdx index a77f9eff..0a5fd3a7 100644 --- a/docs/opengraph/extensions/jamfhound/reference/edges/jamf_azmatchedemail.mdx +++ b/docs/opengraph/extensions/jamfhound/reference/edges/jamf_azmatchedemail.mdx @@ -1,37 +1,37 @@ ---- -title: 'jamf_AZMatchedEmail' -description: 'Represents a cross-platform identity correlation where the JAMF principal''s email attribute matches an Azure AD account''s email.' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [jamf_Account](/opengraph/extensions/jamfhound/reference/nodes/jamf_account), [jamf_DisabledAccount](/opengraph/extensions/jamfhound/reference/nodes/jamf_disabledaccount), [jamf_ComputerUser](/opengraph/extensions/jamfhound/reference/nodes/jamf_computeruser) -- Destination: [AZUser](/resources/nodes/az-user) -- Traversable: ❌ - -## General Information - -The non-traversable `jamf_AZMatchedEmail` edge represents a cross-platform identity correlation created during post-processing. When the Jamf principal's email attribute matches an Azure AD account's email, this edge is created to link the identities across environments. This edge is generated by the `checkAzureUsers` utility rather than the main collection flow. - - -```mermaid -graph LR - A("jamf_Account -john.admin") - B("AzureAD_User -john.admin\@contoso.com") - C("jamf_ComputerUser -bob.smith") - D("AzureAD_User -bob.smith\@contoso.com") - E("jamf_DisabledAccount -bob.former") - F("AzureAD_User -bob\@former.localhost") - - A -- jamf_AZMatchedEmail --> B - C -- jamf_AZMatchedEmail --> D - E -- jamf_AZMatchedEmail --> F -``` +--- +title: 'jamf_AZMatchedEmail' +description: 'Represents a cross-platform identity correlation where the JAMF principal''s email attribute matches an Azure AD account''s email.' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +- Source: [jamf_Account](/opengraph/extensions/jamfhound/reference/nodes/jamf_account), [jamf_DisabledAccount](/opengraph/extensions/jamfhound/reference/nodes/jamf_disabledaccount), [jamf_ComputerUser](/opengraph/extensions/jamfhound/reference/nodes/jamf_computeruser) +- Destination: [AZUser](/resources/nodes/az-user) +- Traversable: ❌ + +## General Information + +The non-traversable `jamf_AZMatchedEmail` edge represents a cross-platform identity correlation created during post-processing. When the Jamf principal's email attribute matches an Azure AD account's email, this edge is created to link the identities across environments. This edge is generated by the `checkAzureUsers` utility rather than the main collection flow. + + +```mermaid +graph LR + A("jamf_Account +john.admin") + B("AzureAD_User +john.admin\@contoso.com") + C("jamf_ComputerUser +bob.smith") + D("AzureAD_User +bob.smith\@contoso.com") + E("jamf_DisabledAccount +bob.former") + F("AzureAD_User +bob\@former.localhost") + + A -- jamf_AZMatchedEmail --> B + C -- jamf_AZMatchedEmail --> D + E -- jamf_AZMatchedEmail --> F +``` diff --git a/docs/opengraph/extensions/jamfhound/reference/edges/jamf_matchedemail.mdx b/docs/opengraph/extensions/jamfhound/reference/edges/jamf_matchedemail.mdx index 94ec439a..3f7468af 100644 --- a/docs/opengraph/extensions/jamfhound/reference/edges/jamf_matchedemail.mdx +++ b/docs/opengraph/extensions/jamfhound/reference/edges/jamf_matchedemail.mdx @@ -1,30 +1,30 @@ ---- -title: 'jamf_MatchedEmail' -description: 'Represents an identity correlation where the JAMF computer user''s email attribute matches the JAMF account''s email.' ---- - -Applies to BloodHound Enterprise and CE - -## Edge Schema - -- Source: [jamf_ComputerUser](/opengraph/extensions/jamfhound/reference/nodes/jamf_computeruser) -- Destination: [jamf_Account](/opengraph/extensions/jamfhound/reference/nodes/jamf_account), [jamf_DisabledAccount](/opengraph/extensions/jamfhound/reference/nodes/jamf_disabledaccount) -- Traversable: ✅ - -## General Information - -The traversable `jamf_MatchedEmail` edge represents an identity correlation where the Jamf computer user's email attribute matches the Jamf account's email, indicating they are likely the same person. This links physical device access to Jamf administrative privileges. - -```mermaid -graph LR - A("jamf_ComputerUser -jsmith\@corp.com") - B("jamf_Account -jsmith\@corp.com") - C("jamf_ComputerUser -jdoe\@corp.com") - D("jamf_DisabledAccount -jdoe\@corp.com") - A -- jamf_MatchedEmail --> B - C -- jamf_MatchedEmail --> D -``` +--- +title: 'jamf_MatchedEmail' +description: 'Represents an identity correlation where the JAMF computer user''s email attribute matches the JAMF account''s email.' +--- + +Applies to BloodHound Enterprise and CE + +## Edge Schema + +- Source: [jamf_ComputerUser](/opengraph/extensions/jamfhound/reference/nodes/jamf_computeruser) +- Destination: [jamf_Account](/opengraph/extensions/jamfhound/reference/nodes/jamf_account), [jamf_DisabledAccount](/opengraph/extensions/jamfhound/reference/nodes/jamf_disabledaccount) +- Traversable: ✅ + +## General Information + +The traversable `jamf_MatchedEmail` edge represents an identity correlation where the Jamf computer user's email attribute matches the Jamf account's email, indicating they are likely the same person. This links physical device access to Jamf administrative privileges. + +```mermaid +graph LR + A("jamf_ComputerUser +jsmith\@corp.com") + B("jamf_Account +jsmith\@corp.com") + C("jamf_ComputerUser +jdoe\@corp.com") + D("jamf_DisabledAccount +jdoe\@corp.com") + A -- jamf_MatchedEmail --> B + C -- jamf_MatchedEmail --> D +``` diff --git a/docs/opengraph/extensions/jamfhound/reference/privilege-zone-rules.mdx b/docs/opengraph/extensions/jamfhound/reference/privilege-zone-rules.mdx index 5891d4dc..ea39f35f 100644 --- a/docs/opengraph/extensions/jamfhound/reference/privilege-zone-rules.mdx +++ b/docs/opengraph/extensions/jamfhound/reference/privilege-zone-rules.mdx @@ -6,7 +6,7 @@ icon: "gem" Applies to BloodHound Enterprise and CE The following Cypher rules define the default Privilege Zone for the JamfHound extension. -Each rule is defined in a JSON file located in the [PrivilegeZoneRules](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/PrivilegeZoneRules) directory of the JamfHound repository. +Each rule is defined in a JSON file located in the [PrivilegeZoneRules](https://github.com/SpecterOps/JamfHound/tree/main/Src/PrivilegeZoneRules) directory of the JamfHound repository. ## Tenant @@ -17,7 +17,7 @@ MATCH (n:jamf_Tenant) RETURN n ``` -This rule is defined in the [tenant.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/PrivilegeZoneRules/tenant.json) file. +This rule is defined in the [tenant.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/PrivilegeZoneRules/tenant.json) file. ## Tier Zero Principals @@ -29,7 +29,7 @@ WHERE n.Tier = 0 RETURN n ``` -This rule is defined in the [tier0-principals.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/PrivilegeZoneRules/tier0-principals.json) file. +This rule is defined in the [tier0-principals.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/PrivilegeZoneRules/tier0-principals.json) file. ## Tier One Principals @@ -41,5 +41,5 @@ WHERE n.Tier = 1 RETURN n ``` -This rule is defined in the [tier1-principals.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/PrivilegeZoneRules/tier1-principals.json) file. +This rule is defined in the [tier1-principals.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/PrivilegeZoneRules/tier1-principals.json) file. diff --git a/docs/opengraph/extensions/jamfhound/reference/queries.mdx b/docs/opengraph/extensions/jamfhound/reference/queries.mdx index eab0c05b..ac374aa9 100644 --- a/docs/opengraph/extensions/jamfhound/reference/queries.mdx +++ b/docs/opengraph/extensions/jamfhound/reference/queries.mdx @@ -6,9 +6,9 @@ icon: code Applies to BloodHound Enterprise and CE The following custom Cypher queries can be imported into BloodHound to enhance visibility. -Each query is defined in a JSON file located in the [Queries](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries) directory of the JamfHound repository. +Each query is defined in a JSON file located in the [Queries](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries) directory of the JamfHound repository. -This file is automatically generated from the [JSON query files](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries) +This file is automatically generated from the [JSON query files](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries) that are bundled with the `JamfHound` collector. @@ -23,7 +23,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Account_Access_by_Name.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Account_Access_by_Name.json) file. +This query can be imported into BloodHound from the [Jamf_Account_Access_by_Name.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Account_Access_by_Name.json) file. ## Account to Account Attack Paths @@ -35,7 +35,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Account_to_Account_Attack_Paths.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Account_to_Account_Attack_Paths.json) file. +This query can be imported into BloodHound from the [Jamf_Account_to_Account_Attack_Paths.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Account_to_Account_Attack_Paths.json) file. ## Account to Tenant Edges @@ -47,7 +47,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Account_to_Tenant_Edges.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Account_to_Tenant_Edges.json) file. +This query can be imported into BloodHound from the [Jamf_Account_to_Tenant_Edges.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Account_to_Tenant_Edges.json) file. ## All Account Paths @@ -59,7 +59,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_All_Account_Paths.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_All_Account_Paths.json) file. +This query can be imported into BloodHound from the [Jamf_All_Account_Paths.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_All_Account_Paths.json) file. ## All Computers @@ -70,7 +70,7 @@ MATCH p=(s:jamf_Computer) RETURN p ``` -This query can be imported into BloodHound from the [Jamf_All_Computers.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_All_Computers.json) file. +This query can be imported into BloodHound from the [Jamf_All_Computers.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_All_Computers.json) file. ## All Groups @@ -81,7 +81,7 @@ MATCH p=(s:jamf_Group) RETURN p ``` -This query can be imported into BloodHound from the [Jamf_All_Groups.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_All_Groups.json) file. +This query can be imported into BloodHound from the [Jamf_All_Groups.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_All_Groups.json) file. ## All Nodes and Edges @@ -94,7 +94,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_All_Nodes_and_Edges.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_All_Nodes_and_Edges.json) file. +This query can be imported into BloodHound from the [Jamf_All_Nodes_and_Edges.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_All_Nodes_and_Edges.json) file. ## API Client Attack Paths to Tenant @@ -107,7 +107,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_API_Client_Attack_Paths_to_Tenant.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_API_Client_Attack_Paths_to_Tenant.json) file. +This query can be imported into BloodHound from the [Jamf_API_Client_Attack_Paths_to_Tenant.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_API_Client_Attack_Paths_to_Tenant.json) file. ## API Client Immediate Edges @@ -119,7 +119,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_API_Client_Immediate_Edges.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_API_Client_Immediate_Edges.json) file. +This query can be imported into BloodHound from the [Jamf_API_Client_Immediate_Edges.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_API_Client_Immediate_Edges.json) file. ## Chained Targeted Filtering @@ -146,7 +146,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Chained_Targeted_Filtering.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Chained_Targeted_Filtering.json) file. +This query can be imported into BloodHound from the [Jamf_Chained_Targeted_Filtering.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Chained_Targeted_Filtering.json) file. ## Expanded Tier 1 to Tier 0 Paths @@ -160,7 +160,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Expanded_Tier_1_to_Tier_0_Paths.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Expanded_Tier_1_to_Tier_0_Paths.json) file. +This query can be imported into BloodHound from the [Jamf_Expanded_Tier_1_to_Tier_0_Paths.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Expanded_Tier_1_to_Tier_0_Paths.json) file. ## Group Administrators Filtered Relationships @@ -176,7 +176,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Group_Administrators_Filtered_Relationships.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Group_Administrators_Filtered_Relationships.json) file. +This query can be imported into BloodHound from the [Jamf_Group_Administrators_Filtered_Relationships.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Group_Administrators_Filtered_Relationships.json) file. ## Group Administrators Targeted Edges @@ -189,7 +189,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Group_Administrators_Targeted_Edges.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Group_Administrators_Targeted_Edges.json) file. +This query can be imported into BloodHound from the [Jamf_Group_Administrators_Targeted_Edges.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Group_Administrators_Targeted_Edges.json) file. ## Group Edges to Accounts @@ -202,7 +202,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Group_Edges_to_Accounts.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Group_Edges_to_Accounts.json) file. +This query can be imported into BloodHound from the [Jamf_Group_Edges_to_Accounts.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Group_Edges_to_Accounts.json) file. ## Matched Email Edges @@ -214,7 +214,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Matched_Email_Edges.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Matched_Email_Edges.json) file. +This query can be imported into BloodHound from the [Jamf_Matched_Email_Edges.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Matched_Email_Edges.json) file. ## Tier 1 to Tier 0 Attack Paths @@ -230,7 +230,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Tier_1_to_Tier_0_Attack_Paths.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Tier_1_to_Tier_0_Attack_Paths.json) file. +This query can be imported into BloodHound from the [Jamf_Tier_1_to_Tier_0_Attack_Paths.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Tier_1_to_Tier_0_Attack_Paths.json) file. ## Tier 1 to Tier 0 Direct Edges @@ -243,7 +243,7 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Tier_1_to_Tier_0_Direct_Edges.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Tier_1_to_Tier_0_Direct_Edges.json) file. +This query can be imported into BloodHound from the [Jamf_Tier_1_to_Tier_0_Direct_Edges.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Tier_1_to_Tier_0_Direct_Edges.json) file. ## Tier 1 to Tier 0 Without Contains @@ -257,5 +257,5 @@ RETURN p LIMIT 1000 ``` -This query can be imported into BloodHound from the [Jamf_Tier_1_to_Tier_0_Without_Contains.json](https://github.com/SpecterOps/JAMFHound_Internal/tree/main/Src/Queries/Jamf_Tier_1_to_Tier_0_Without_Contains.json) file. +This query can be imported into BloodHound from the [Jamf_Tier_1_to_Tier_0_Without_Contains.json](https://github.com/SpecterOps/JamfHound/tree/main/Src/Queries/Jamf_Tier_1_to_Tier_0_Without_Contains.json) file. diff --git a/docs/opengraph/extensions/jamfhound/reference/schema.mdx b/docs/opengraph/extensions/jamfhound/reference/schema.mdx index 5b82fb76..22e91d91 100644 --- a/docs/opengraph/extensions/jamfhound/reference/schema.mdx +++ b/docs/opengraph/extensions/jamfhound/reference/schema.mdx @@ -15,7 +15,7 @@ icon: circle-nodes **Source Kind:** jamf_Base -This file is automatically generated from the [schema_enterprise.json](https://github.com/SpecterOps/JAMFHound_Internal/blob/main/schema/schema_enterprise.json) file +This file is automatically generated from the [schema_enterprise.json](https://github.com/SpecterOps/JamfHound/blob/main/schema/schema_enterprise.json) file that is bundled with JAMF (JamfHound).