git clone https://github.com/h4wkst3r/dop2mop.git
cd dop2mop
pip install -r requirements.txt
pip install -e .

dop2mop demo -o demo.json

// Azure DevOps to Azure ML Lateral Movement
MATCH p=(repo)-[:TriggersPipeline]->(pipeline)-[:UsesServiceConnection]->(svcconn)-[:AuthenticatesAs]->(workspace)-[:CodeExecution]->(compute)
RETURN p

// Container Image Poisoning (Supply Chain Attack)
MATCH p=(workflow)-[:CanPoisonImage]->(image)<-[:PullsImage]-(job)
RETURN p

// OIDC/Federated Identity Abuse (confirmed edges)
MATCH p=(workflow)-[:OIDCTrust]->(oidc)-[:CanAssumeRole]->(role)-[:SubmitsJob]->(job)
RETURN p

// OIDC abuse including inferred paths
MATCH p=(workflow)-[:OIDCTrust]->(oidc)-[:InferredCanAssumeRole]->(role)
RETURN p

// Dataset Poisoning via Pickle Deserialization
MATCH p=(workflow)-[:CanPoisonDataset]->(dataset)<-[:LoadsDataset]-(job)
RETURN p

// Find repos with weak/no branch protection (TB1 exploitable)
MATCH (repo)-[:BypassesProtection]->(repo)
RETURN repo.name, repo.default_branch

// Find overprivileged SageMaker IAM roles
MATCH (role:IAMRole) WHERE role.is_admin = true OR role.has_s3_full_access = true
RETURN role.name, role.attached_policies

// Find SageMaker notebooks with root + internet access
MATCH (nb:SMNotebook) WHERE nb.root_access = 'Enabled' AND nb.direct_internet_access = 'Enabled'
RETURN nb.name, nb.status

// Find self-hosted ADO agent pools
MATCH (agent:ADOAgent) WHERE agent.is_hosted = false
RETURN agent.name, agent.pool_type

cp dop2mop.yaml.example dop2mop.yaml
# Edit dop2mop.yaml with your credentials

# Validate all configured collectors
dop2mop collect --validate -v

# Validate specific collectors
dop2mop collect --validate --collectors github,sagemaker -v

# These are equivalent:
dop2mop collect --collectors GitHubCollector,SageMakerCollector
dop2mop collect --collectors github,sagemaker
dop2mop collect --collectors gh,sm

dop2mop <command> [options]

Commands:
  collect    Collect data from DevOps/MLOps platforms
  demo       Generate demo data with attack scenarios

dop2mop collect [OPTIONS]

dop2mop demo [OPTIONS]

dop2mop icons [OPTIONS]

# Collect from all configured platforms (uses environment variables)
dop2mop collect -o output.json

# Use a config file
dop2mop collect --config dop2mop.yaml -o output.json -v

# Validate credentials first, then collect
dop2mop collect --validate -o output.json -v

# Collect with verbose logging
dop2mop collect -o output.json -v

# Collect with debug logging
dop2mop collect -o output.json --debug

# Collect and compress to ZIP
dop2mop collect -o output.json --zip

# Limit collection size
dop2mop collect --max-items 100 -o output.json

# Skip secret enumeration
dop2mop collect --no-secrets -o output.json

# GitHub only (aliases: github, gh)
dop2mop collect --collectors github -o github.json -v

# Azure DevOps only (aliases: ado, azuredevops)
dop2mop collect --collectors ado -o ado.json -v

# Azure ML only (aliases: azureml, azure-ml)
dop2mop collect --collectors azureml -o azureml.json -v

# SageMaker only (aliases: sagemaker, sm)
dop2mop collect --collectors sm -o sagemaker.json -v

# GitHub + SageMaker
dop2mop collect --collectors github,sagemaker -o output.json -v

# GitHub + Azure DevOps
dop2mop collect --collectors github,ado -o output.json -v

# Azure DevOps + Azure ML (full Azure stack)
dop2mop collect --collectors ado,azureml -o azure.json -v

# All collectors explicitly
dop2mop collect --collectors github,ado,azureml,sagemaker -o full.json -v

# Using environment variables
export GITHUB_TOKEN="ghp_xxxxxxxxxxxx"
export GITHUB_ORG="your-org"
dop2mop collect --collectors GitHubCollector -o github.json -v

# Using command-line arguments
dop2mop collect --collectors GitHubCollector \
  --github-token ghp_xxxxxxxxxxxx \
  --github-org your-org \
  -o github.json -v

# GitHub Enterprise Server
dop2mop collect --collectors GitHubCollector \
  --github-token ghp_xxxxxxxxxxxx \
  --github-org your-org \
  --github-enterprise-url https://github.yourcompany.com/api/v3 \
  -o github.json -v

# Skip secret enumeration
dop2mop collect --collectors GitHubCollector \
  --github-token ghp_xxxxxxxxxxxx \
  --github-org your-org \
  --no-secrets \
  -o github.json -v

# Limit to 50 repositories
dop2mop collect --collectors GitHubCollector \
  --github-token ghp_xxxxxxxxxxxx \
  --github-org your-org \
  --max-items 50 \
  -o github.json -v

# Using environment variables
export AZURE_DEVOPS_TOKEN="your-pat"
export AZURE_DEVOPS_ORG="your-org"
dop2mop collect --collectors AzureDevOpsCollector -o ado.json -v

# Using command-line arguments (PAT)
dop2mop collect --collectors AzureDevOpsCollector \
  --azure-devops-token your-pat \
  --azure-devops-org your-org \
  -o ado.json -v

# Using access token (Bearer auth)
dop2mop collect --collectors AzureDevOpsCollector \
  --azure-devops-access-token eyJ0... \
  --azure-devops-org your-org \
  -o ado.json -v

# Using environment variables
export AZURE_SUBSCRIPTION_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
export AZURE_TENANT_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
dop2mop collect --collectors AzureMLCollector -o azureml.json -v

# Using DefaultAzureCredential (az login)
dop2mop collect --collectors AzureMLCollector \
  --azure-subscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  --azure-tenant-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  -o azureml.json -v

# Using Service Principal
dop2mop collect --collectors AzureMLCollector \
  --azure-subscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  --azure-tenant-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  --azure-client-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  --azure-client-secret your-secret \
  -o azureml.json -v

# Using Access Token
dop2mop collect --collectors AzureMLCollector \
  --azure-subscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  --azure-tenant-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  --azure-access-token eyJ0... \
  -o azureml.json -v

# Using AWS profile (environment variable)
export AWS_PROFILE="your-profile"
dop2mop collect --collectors SageMakerCollector -o sagemaker.json -v

# Using AWS profile (command-line)
dop2mop collect --collectors SageMakerCollector \
  --aws-profile your-profile \
  -o sagemaker.json -v

# Using access keys
dop2mop collect --collectors SageMakerCollector \
  --aws-access-key-id AKIAXXXXXXXXXXXXXXXX \
  --aws-secret-access-key xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
  --aws-region us-east-1 \
  -o sagemaker.json -v

# Different AWS region
dop2mop collect --collectors SageMakerCollector \
  --aws-profile your-profile \
  --aws-region us-west-2 \
  -o sagemaker.json -v

# Set all environment variables
export GITHUB_TOKEN="ghp_xxxxxxxxxxxx"
export GITHUB_ORG="your-org"
export AZURE_DEVOPS_TOKEN="your-pat"
export AZURE_DEVOPS_ORG="your-org"
export AZURE_SUBSCRIPTION_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
export AZURE_TENANT_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
export AWS_PROFILE="your-profile"

# Collect from all platforms (auto-detects configured collectors)
dop2mop collect -o full_collection.json -v

# Or with explicit collectors
dop2mop collect \
  --collectors GitHubCollector,AzureDevOpsCollector,AzureMLCollector,SageMakerCollector \
  -o full_collection.json -v

#!/usr/bin/env python3
"""Upload custom icons to BloodHound CE using HMAC authentication."""

import base64
import hashlib
import hmac
import json
from datetime import datetime, timezone
import requests

# Configuration
BLOODHOUND_URL = "http://localhost:8080"
TOKEN_ID = "your-token-id"
TOKEN_KEY = "your-token-key"
ICONS_FILE = "custom_icons.json"

def hmac_auth(method: str, uri: str, body: bytes = b"") -> dict:
    """Generate HMAC authentication headers."""
    digester = hmac.new(
        base64.b64decode(TOKEN_KEY),
        msg=None,
        digestmod=hashlib.sha256
    )
    
    now = datetime.now(timezone.utc)
    timestamp = now.strftime("%Y-%m-%dT%H:%M:%SZ")
    
    digester.update(f"{method}".encode())
    digester.update(f"{uri}".encode())
    digester.update(timestamp.encode())
    if body:
        digester.update(body)
    
    signature = base64.b64encode(digester.digest()).decode()
    
    return {
        "Authorization": f"bhesignature {TOKEN_ID}",
        "RequestDate": timestamp,
        "Signature": signature,
        "Content-Type": "application/json",
    }

def upload_icons():
    """Upload custom icons to BloodHound."""
    uri = "/api/v2/custom-nodes"
    url = f"{BLOODHOUND_URL}{uri}"
    
    with open(ICONS_FILE, "rb") as f:
        body = f.read()
    
    headers = hmac_auth("POST", uri, body)
    response = requests.post(url, headers=headers, data=body)
    
    print(f"Status: {response.status_code}")
    print(f"Response: {response.text}")
    return response.status_code == 200

if __name__ == "__main__":
    upload_icons()

curl -X POST http://localhost:8080/api/v2/custom-nodes \
  -H "Authorization: Bearer eyJ..." \
  -H "Content-Type: application/json" \
  -d @custom_icons.json

from dop2mop import Dop2MopCollector, CollectorConfig

# Configure collection
config = CollectorConfig(
    github_token="ghp_xxx",
    github_org="myorg",
    aws_profile="default",
)

# Validate credentials first
collector = Dop2MopCollector(config)
results = collector.validate_all()
print(results)  # {'GitHubCollector': True, 'SageMakerCollector': True, ...}

# Run collection (supports aliases)
collector.run(collectors=["github", "sm"])

# Save output
collector.save("output.json")

# Get statistics
print(collector.get_stats())

# Get per-collector failure/skip details
print(collector.get_collection_summary())

from dop2mop import CollectorConfig, GitHubCollector, SageMakerCollector
from dop2mop.graph import OpenGraphBuilder

# Create shared builder
builder = OpenGraphBuilder(source_kind="MLOpsBase")

# Configure
config = CollectorConfig(
    github_token="ghp_xxx",
    github_org="myorg",
    aws_profile="default",
)

# Run individual collectors
github = GitHubCollector(config, builder)
github.collect()

sagemaker = SageMakerCollector(config, builder)
sagemaker.collect()

# Save combined output
builder.save("combined.json")

from dop2mop.graph import OpenGraphBuilder
from dop2mop.models import NodeKind, EdgeType

builder = OpenGraphBuilder(source_kind="CustomSource")

# Add nodes
builder.create_node(
    id="my-pipeline",
    kinds=[NodeKind.AZURE_DEVOPS_PIPELINE.value],
    name="My Pipeline",
    displayname="Production Pipeline",
)

builder.create_node(
    id="my-ml-workspace",
    kinds=[NodeKind.AZURE_ML_WORKSPACE.value],
    name="ML Workspace",
    displayname="Training Workspace",
)

# Add edge
builder.create_edge(
    start_id="my-pipeline",
    end_id="my-ml-workspace",
    kind=EdgeType.SUBMITS_JOB,
    properties={"trust_boundary": "TB4"}
)

# Export
builder.save("custom_graph.json")

dop2mop collect --validate --collectors github,sm -v

============================================================
  Dop2Mop Collection Summary
============================================================
  Total Nodes: 142
    DevOps:   45
    MLOps:    38
    Identity: 12
    Artifact: 47

  Total Edges: 201
    Contains: 62
    TriggersPipeline: 15
    ...

  ────────────────────────────────────────────────────────
  Collection Issues:
    GitHubCollector: 45 collected, 3 failed, 1 skipped
      FAIL: branch_protection:org/repo - 404 Not Found
      SKIP: branch_protection:org/private - Insufficient permissions

  Output: output.json
============================================================