Skip to content

Commit 1e84c44

Browse files
learn-build-service-prod[bot]learn-build-service-prod[bot]
authored
Merge pull request #2712 from MicrosoftDocs/main638913709373810855sync_temp
For protected branch, push strategy should use PR and merge to target branch method to work around git push error
2 parents 77be862 + d030202 commit 1e84c44

22 files changed

+1075
-0
lines changed

‎data-explorer/kusto/query/graph-sample-data.md‎

Lines changed: 605 additions & 0 deletions
Large diffs are not rendered by default.

‎data-explorer/kusto/query/media/graphs/graph-example-bloodhound-ad-instance.mmd‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
%%{ init: { 'flowchart': {'defaultRenderer': 'elk' } } }%%
2+
graph LR
3+
%% Real Entities from BloodHound_AD dataset
4+
ALICE["ALICE@PHANTOM\.CORP<br/>User<br/>Domain User"]
5+
6+
%% Her Computer
7+
LAPTOP["ALICE-LAPTOP\.PHANTOM\.CORP<br/>Computer<br/>Workstation"]
8+
9+
%% Administrative Groups
10+
DOMAINUSERS["DOMAIN USERS@PHANTOM\.CORP<br/>Group<br/>Default Domain Group"]
11+
12+
%% Domain Infrastructure
13+
USERS["USERS@PHANTOM\.CORP<br/>Container<br/>AD Container"]
14+
PHANTOM["PHANTOM\.CORP<br/>Domain<br/>AD Domain"]
15+
16+
%% Validated Attack Path Relationships
17+
ALICE -->|AdminTo| LAPTOP
18+
ALICE -->|MemberOf| DOMAINUSERS
19+
20+
%% Container Hierarchy
21+
USERS -->|Contains| ALICE
22+
PHANTOM -->|Contains| USERS
23+
24+
%% Styling
25+
classDef user fill:#e3f2fd,stroke:#1976d2,stroke-width:3px
26+
classDef computer fill:#fff3e0,stroke:#f57c00,stroke-width:2px
27+
classDef group fill:#e8f5e8,stroke:#388e3c,stroke-width:2px
28+
classDef admingroup fill:#ffebee,stroke:#d32f2f,stroke-width:3px
29+
classDef infrastructure fill:#f1f8e9,stroke:#689f38,stroke-width:2px
30+
classDef certificate fill:#fce4ec,stroke:#c2185b,stroke-width:3px
31+
32+
class ALICE user
33+
class LAPTOP computer
34+
class DOMAINUSERS,DOMAINADMINS group
35+
class USERS,PHANTOM infrastructure

‎data-explorer/kusto/query/media/graphs/graph-example-bloodhound-ad-instance.png‎

140 KB
Loading

‎data-explorer/kusto/query/media/graphs/graph-example-bloodhound-ad-schema.mmd‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
%%{ init: { 'flowchart': {'defaultRenderer': 'elk' } } }%%
2+
graph TD
3+
%% Core AD Objects
4+
USER[User<br/>Domain Users]
5+
COMPUTER[Computer<br/>Domain Computers]
6+
GROUP[Group<br/>Security Groups]
7+
LOCALGROUP[ADLocalGroup<br/>Local Groups]
8+
9+
%% AD Infrastructure
10+
DOMAIN[Domain<br/>AD Domains]
11+
OU[OU<br/>Organizational Units]
12+
CONTAINER[Container<br/>AD Containers]
13+
GPO[GPO<br/>Group Policy Objects]
14+
15+
%% Certificate Infrastructure
16+
CERT[CertTemplate<br/>Certificate Templates]
17+
ENTCA[EnterpriseCA<br/>Certificate Authorities]
18+
ROOTCA[RootCA<br/>Root CAs]
19+
20+
%% Domain Hierarchy & Containment
21+
DOMAIN -->|Contains| CONTAINER
22+
CONTAINER -->|Contains| USER
23+
CONTAINER -->|Contains| GROUP
24+
DOMAIN -->|Contains| OU
25+
OU -->|Contains| USER
26+
OU -->|Contains| COMPUTER
27+
28+
%% Group Memberships
29+
USER -->|MemberOf| GROUP
30+
USER -->|MemberOf| LOCALGROUP
31+
GROUP -->|MemberOf| GROUP
32+
33+
%% Administrative Access
34+
USER -->|AdminTo| COMPUTER
35+
GROUP -->|AdminTo| COMPUTER
36+
USER -->|GenericAll| USER
37+
GROUP -->|GenericAll| GROUP
38+
39+
%% Dangerous Permissions
40+
USER -->|WriteDacl| GROUP
41+
GROUP -->|WriteOwner| CERT
42+
USER -->|GenericWrite| GPO
43+
44+
%% Certificate Attack Paths
45+
USER -->|GenericAll| ROOTCA
46+
GROUP -->|WriteDacl| ENTCA
47+
48+
%% Object Ownership
49+
GROUP -->|Owns| CONTAINER
50+
USER -->|Owns| CERT
51+
52+
%% Styling
53+
classDef user fill:#e3f2fd,stroke:#1976d2,stroke-width:3px
54+
classDef computer fill:#fff3e0,stroke:#f57c00,stroke-width:2px
55+
classDef group fill:#e8f5e8,stroke:#388e3c,stroke-width:2px
56+
classDef infrastructure fill:#f1f8e9,stroke:#689f38,stroke-width:2px
57+
classDef certificate fill:#fce4ec,stroke:#c2185b,stroke-width:2px
58+
classDef dangerous fill:#ffebee,stroke:#d32f2f,stroke-width:3px
59+
60+
class USER user
61+
class COMPUTER computer
62+
class GROUP,LOCALGROUP group
63+
class DOMAIN,OU,CONTAINER,GPO infrastructure
64+
class CERT,ENTCA,ROOTCA certificate

‎data-explorer/kusto/query/media/graphs/graph-example-bloodhound-ad-schema.png‎

322 KB
Loading

‎data-explorer/kusto/query/media/graphs/graph-example-bloodhound-entra-instance.mmd‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
%%{ init: { 'flowchart': {'defaultRenderer': 'elk' } } }%%
2+
graph TD
3+
%% Real Entities from BloodHound_Entra dataset
4+
JACOB[John Jacob<br/>AZUser<br/>admin_tier_0<br/>[email protected]]
5+
6+
%% Groups he owns
7+
ALLUSERS[All Users<br/>AZGroup<br/>ID: 2f061293]
8+
GAROLE[ThisGroupHasGARoleAlwaysActive<br/>AZGroup<br/>ID: 4c8435bf]
9+
10+
%% App he owns
11+
AZUREHOUND[AzureHoundEnterprise<br/>AZApp<br/>ID: 5595629b]
12+
13+
%% Device he owns
14+
WIN10[AADJoinedWin10<br/>AZDevice<br/>ID: 2a2dc5ab]
15+
16+
%% Administrative Role
17+
GLOBALADMIN[Global Administrator<br/>AZRole<br/>Privileged Role]
18+
19+
%% Tenant
20+
PHANTOM[Phantom Corp<br/>AZTenant<br/>phantomcorp.onmicrosoft.com]
21+
22+
%% Validated Relationships
23+
JACOB -->|AZOwns<br/>Application Owner| AZUREHOUND
24+
JACOB -->|AZOwns<br/>Group Owner| ALLUSERS
25+
JACOB -->|AZOwns<br/>Group Owner| GAROLE
26+
JACOB -->|AZOwns<br/>Device Owner| WIN10
27+
28+
%% Administrative Privileges
29+
GLOBALADMIN -->|AZResetPassword<br/>Can Reset| JACOB
30+
31+
%% Tenant Containment
32+
PHANTOM -->|AZContains<br/>Tenant Member| JACOB
33+
34+
%% Styling
35+
classDef user fill:#e3f2fd,stroke:#1976d2,stroke-width:3px
36+
classDef app fill:#f3e5f5,stroke:#7b1fa2,stroke-width:3px
37+
classDef group fill:#e8f5e8,stroke:#388e3c,stroke-width:2px
38+
classDef device fill:#fff3e0,stroke:#f57c00,stroke-width:2px
39+
classDef role fill:#ffebee,stroke:#d32f2f,stroke-width:3px
40+
classDef tenant fill:#e1f5fe,stroke:#0277bd,stroke-width:2px
41+
42+
class JACOB user
43+
class AZUREHOUND app
44+
class ALLUSERS,GAROLE group
45+
class WIN10 device
46+
class GLOBALADMIN role
47+
class PHANTOM tenant

‎data-explorer/kusto/query/media/graphs/graph-example-bloodhound-entra-instance.png‎

352 KB
Loading

‎data-explorer/kusto/query/media/graphs/graph-example-bloodhound-entra-schema.mmd‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
%%{ init: { 'flowchart': {'defaultRenderer': 'elk' } } }%%
2+
graph TD
3+
%% Core Azure AD Entities
4+
USER[AZUser<br/>Azure AD Users]
5+
SP[AZServicePrincipal<br/>Service Principals]
6+
APP[AZApp<br/>Applications]
7+
GROUP[AZGroup<br/>Security Groups]
8+
DEVICE[AZDevice<br/>Managed Devices]
9+
ROLE[AZRole<br/>Azure Roles]
10+
11+
%% Azure Resource Hierarchy
12+
TENANT[AZTenant<br/>Azure Tenant]
13+
SUB[AZSubscription<br/>Subscriptions]
14+
RG[AZResourceGroup<br/>Resource Groups]
15+
VM[AZVM<br/>Virtual Machines]
16+
17+
%% Azure Resource Containment Hierarchy
18+
TENANT -->|AZContains| SUB
19+
TENANT -->|AZContains| USER
20+
SUB -->|AZContains| RG
21+
RG -->|AZContains| VM
22+
23+
%% Identity and Access Relationships
24+
USER -->|AZMemberOf| GROUP
25+
USER -->|AZOwns| APP
26+
USER -->|AZOwns| DEVICE
27+
USER -->|AZOwns| GROUP
28+
USER -->|AZOwner| SUB
29+
USER -->|AZOwner| RG
30+
31+
%% Service Principal Relationships
32+
SP -->|AZRunsAs| APP
33+
VM -->|AZManagedIdentity| SP
34+
35+
%% Administrative Permissions
36+
ROLE -->|AZResetPassword| USER
37+
GROUP -->|AZAddMembers| GROUP
38+
39+
%% High-Volume Permissions (simplified for readability)
40+
ROLE -.->|AZMGAddOwner<br/>403k edges| RG
41+
ROLE -.->|AZMGAddSecret<br/>345k edges| APP
42+
43+
%% Styling
44+
classDef user fill:#e3f2fd,stroke:#1976d2,stroke-width:3px
45+
classDef app fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
46+
classDef group fill:#e8f5e8,stroke:#388e3c,stroke-width:2px
47+
classDef device fill:#fff3e0,stroke:#f57c00,stroke-width:2px
48+
classDef resource fill:#fce4ec,stroke:#c2185b,stroke-width:2px
49+
classDef role fill:#e1f5fe,stroke:#0277bd,stroke-width:2px
50+
classDef hierarchy fill:#f1f8e9,stroke:#689f38,stroke-width:2px
51+
52+
class USER user
53+
class SP,APP app
54+
class GROUP group
55+
class DEVICE device
56+
class VM,RG resource
57+
class ROLE role
58+
class TENANT,SUB hierarchy

‎data-explorer/kusto/query/media/graphs/graph-example-bloodhound-entra-schema.png‎

359 KB
Loading

‎data-explorer/kusto/query/media/graphs/graph-example-ldbc-financial-instance.mmd‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
%%{ init: { 'flowchart': {'defaultRenderer': 'elk' } } }%%
2+
graph TD
3+
%% Connected Financial Network - Real People and Entities
4+
HOUSE[House<br/>Person ID: 467<br/>Female, Born 1995]
5+
BARKER[Barker<br/>Person ID: 6597069767083<br/>Transfer Recipient]
6+
7+
%% Real Accounts (fully connected)
8+
ACC1[Renato Holness<br/>Account: 4619004367821865972<br/>House's Main Account]
9+
ACC2[Luis Thies<br/>Account: 4687121312185844640<br/>Barker's Account]
10+
ACC3[Daniel Joye<br/>Account: 4786200503987995554<br/>Barker's Second Account]
11+
12+
%% Real Loan and Mediums
13+
LOAN1[Debt Consolidation Loan<br/>ID: 4843058449283547765<br/>Amount: $63.5M]
14+
MEDIUM1[IPv6 Medium<br/>ID: 4398046511850<br/>Risk: Very High]
15+
MEDIUM2[Phone Medium<br/>ID: 30786325577800<br/>Risk: Severe]
16+
17+
%% Validated Connected Relationships
18+
HOUSE -->|OWN| ACC1
19+
BARKER -->|OWN| ACC2
20+
BARKER -->|OWN| ACC3
21+
HOUSE -->|APPLY| LOAN1
22+
23+
%% Financial Transaction Flow
24+
ACC1 -->|TRANSFER<br/>$4.3M| ACC2
25+
ACC1 -->|TRANSFER<br/>$9.7M| ACC3
26+
LOAN1 -->|DEPOSIT<br/>$7.2M| ACC1
27+
ACC1 -->|REPAY<br/>$7.4M| LOAN1
28+
29+
%% Authentication Access
30+
MEDIUM1 -->|SIGN_IN| ACC2
31+
MEDIUM2 -->|SIGN_IN| ACC3
32+
33+
%% Styling
34+
classDef person fill:#e1f5fe,stroke:#0277bd,stroke-width:3px
35+
classDef account fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
36+
classDef loan fill:#fff3e0,stroke:#f57c00,stroke-width:2px
37+
classDef medium fill:#fce4ec,stroke:#c2185b,stroke-width:2px
38+
39+
class HOUSE,BARKER person
40+
class ACC1,ACC2,ACC3 account
41+
class LOAN1 loan
42+
class MEDIUM1,MEDIUM2 medium

0 commit comments

Comments
 (0)