Skip to content

Cirro: Extending Your Azure Graph Beyond Identities

DEF CON 34 Cloud Village Labs
Instructor: Leron Gray

Workshop overview

Most Azure graph-analysis tools focus primarily on identity relationships such as users, groups, service principals, and role assignments. Those relationships are valuable, but modern Azure environments contain additional exploitable context in infrastructure, platform services, application configurations, network relationships, managed identities, and data-plane resources.

Cirro (the spiritual successor to Stormspotter) is an attack-graphing tool that models Azure environments by combining Microsoft Graph identity data with Azure Resource Manager infrastructure data. Rather than limiting analysis to Entra ID objects and role assignments, Cirro maps Azure resources into Neo4j for deeper attack-path and misconfiguration analysis.

This hands-on lab introduces Cirro's collection, ingestion, and analysis workflow. You will enumerate and assess an Azure tenant, investigate attack paths that extend beyond identities, write Cypher queries, and use custom dashboards to visualize and interpret graph data.

  • Cirro — collect cloud and identity data, then ingest it into a graph.
  • CirroDash — explore Neo4j data with browser-based dashboards and analysis views.
  • Cirro documentation — installation, collection, ingestion, and usage guidance.

What you will do

  • Collect identity and infrastructure data from Azure.
  • Ingest the collected data into Neo4j with Cirro.
  • Analyze paths across identities, permissions, infrastructure, and data-plane resources.
  • Write Cypher queries to investigate relationships in the graph.
  • Build custom dashboards that communicate the results.

Prerequisites

Bring a system with:

  • Docker Compose or Podman Compose;
  • Azure CLI;
  • a modern web browser; and
  • a SQLite3 browser.
  • Rust toolchain
  • Sqlite3 browser

Fundamental knowledge of the Cypher query language is recommended, but not required.