Cartography Developer Guide Testing Running from source Manually testing individual intel modules Automated testing Implementing custom sync commands How to write a new intel module How to extend Cartography with Analysis Jobs Overview The stages How to run Example job: which of my EC2 instances is accessible to any host on the internet? Our goal The logic in plain English Translating the plain-English logic into Neo4j’s Cypher syntax The skeleton of an Analysis Job Clean up first, then update Recap How to write a new intel module Before getting started… Configuration and credential management Supplying credentials and arguments to your module An important note on validating your commandline args Sync = Get, Transform, Load, Cleanup Get Transform Handling required versus optional fields Load Handling cartography’s update_tag: All nodes need these fields All relationships need these fields Run queries only on indexed fields for best performance Create an index for new nodes lastupdated and firstseen Connecting different node types with the _attach pattern Cleanup Error handling principles Schema Making tests Other Testing with docker Using the included docker-compose support Usage Configuration Notes Example