Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"name": "Jamf: Expanded Tier 1 to Tier 0 Paths",
"description": "Expand the graph by one edge showing nodes with edges to Tier 1 nodes with edges to Tier 0 nodes",
"query": "MATCH p=(a) - [] -> (s)-[r]->(t)\nWHERE s.Tier = 1 AND t.Tier = 0\nAND type(r) <> 'jamf_Contains'\nRETURN p\nLIMIT 1000"
"query": "MATCH p=(a) - [] -> (s)-[r]->(t)\nWHERE s.tier = 1 AND t.tier = 0\nAND type(r) <> 'jamf_Contains'\nRETURN p\nLIMIT 1000"
}
2 changes: 1 addition & 1 deletion extension/saved_searches/Jamf_Group_Edges_to_Accounts.json
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"name": "Jamf: Group Edges to Accounts",
"description": "Get immediate edges impacting Jamf Accounts originating from Jamf Groups, swap jamfGroup for jamfTenant to see impact edges to the tenant from groups",
"description": "Get immediate edges impacting Jamf Accounts originating from Jamf Groups, swap jamf_Group for jamf_Tenant to see impact edges to the tenant from groups",
"query": "MATCH p=(s)-[]->(t:jamf_Account)\nWHERE s.primarykind ENDS WITH 'jamf_Group'\nRETURN p\nLIMIT 1000"
}
2 changes: 1 addition & 1 deletion extension/saved_searches/Jamf_Matched_Email_Edges.json
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"name": "Jamf: Matched Email Edges",
"description": "Show nodes with the edge jamfMatchedEdmail",
"description": "Show nodes with the edge jamf_MatchedEmail",
"query": "MATCH p=(s)-[:jamf_MatchedEmail]->(t)\nRETURN p\nLIMIT 1000"
}
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"name": "Jamf: Tier 1 to Tier 0 Attack Paths",
"description": "Retrieve attack paths between Tier 1 nodes and Tier 0 nodes that are fully traversable - excludes tenant and site nodes as starting points",
"query": "MATCH p=(s)-[r*1..5]->(t)\nWHERE s.Tier = 1 AND t.Tier = 0\nAND s.primarykind <> 'jamf_Tenant'\nAND s.primarykind <> 'jamf_Site'\nAND r.traversable = True\nRETURN p\nLIMIT 1000"
"query": "MATCH p=(s)-[r*1..5]->(t)\nWHERE s.tier = 1 AND t.tier = 0\nAND s.primarykind <> 'jamf_Tenant'\nAND s.primarykind <> 'jamf_Site'\nAND r.traversable = True\nRETURN p\nLIMIT 1000"
}
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"name": "Jamf: Tier 1 to Tier 0 Direct Edges",
"description": "Retrieve direct edges between Tier 1 nodes and Tier 0 nodes",
"query": "MATCH p=(s)-[]->(t)\nWHERE s.Tier = 1 AND t.Tier = 0\nRETURN p\nLIMIT 1000"
"query": "MATCH p=(s)-[]->(t)\nWHERE s.tier = 1 AND t.tier = 0\nRETURN p\nLIMIT 1000"
}
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"name": "Jamf: Tier 1 to Tier 0 Without Contains",
"description": "Filter out jamf_Contains edges from Tiered node query",
"query": "MATCH p=(s)-[r]->(t)\nWHERE s.Tier = 1 AND t.Tier = 0\nAND type(r) <> 'jamf_Contains'\nRETURN p\nLIMIT 1000"
"query": "MATCH p=(s)-[r]->(t)\nWHERE s.tier = 1 AND t.tier = 0\nAND type(r) <> 'jamf_Contains'\nRETURN p\nLIMIT 1000"
}