Stormspotter creates an attack graph of resources within an Azure subscription to visualize attack surface and identify pivot opportunities. It is designed to empower red teams and defenders alike by providing an intuitive understanding of tenant relationships. The project leverages Python and Neo4j to parse Azure resource data and construct a graph database.
Stormspotter’s core strength is its ability to generate a visual representation of inter-resource relationships within an Azure environment. The integration with Neo4j allows complex queries and analysis of the attack graph. The use of Docker facilitates easy deployment and consistent environments.
- Resource Enumeration: Enumerates Azure resources, including Azure AD objects and Azure Resource Manager resources.
- Attack Graph Visualization: Displays relationships between Azure resources in a graph format.
- Authentication Support: Supports Azure CLI and Service Principal authentication methods.
- Data Export: Allows users to export data in JSON format for further analysis.
- Extensible: Designed with modular components, enabling potential extensions for new resource types and functionalities.
- User-Friendly: Offers a web-based UI for exploring and analyzing the attack graph.
- Command-Line Interface: Supports a command-line interface for automated resource enumeration.
Stormspotter is currently in beta, with ongoing development and feature enhancements. Active maintenance occurs through regular commits and issue resolution. The project has a growing community and is actively addressing known issues. Documentation is continuously being improved to reflect the project's evolving capabilities.
Stormspotter is beneficial for security professionals needing to understand Azure environments, plan red team exercises, or respond to security incidents. Its visual representation of resource relationships provides a significant advantage over manual methods or static lists, accelerating threat hunting and incident analysis. This project offers a comprehensive overview and dynamic analysis of Azure infrastructure.