Inside Cirro: Schemas and Extensible Identity Graphs
Need a way to model identity risk across evolving cloud environments? This workshop breaks down how Cirro’s extensible design supports consistent analysis as new systems and data sources are added.
Cirro is designed as a framework for modeling cloud environments through relationships rather than isolated objects. While its current focus is Azure and Entra ID, the underlying architecture is built to be extensible so that additional platforms, identity systems, and data sources can be incorporated over time.
This session explores the design philosophy behind Cirro and how its architecture supports extensible identity graph modeling. Led by Cirro creator Leron Gray, we discuss how separating data ingestion from graph modeling and analysis enables new environments to be integrated while maintaining a consistent approach to understanding identity relationships, configuration risk, and privilege propagation.
Session Summary:
This workshop explores how Cirro’s schema engine operates, focusing on how Azure resources and identities are modeled into a graph using flexible, YAML-based schemas. It explains how data is ingested from structured sources like SQLite, transformed through templated specifications, and loaded into Neo4j to represent relationships across both management and data planes. The session includes live demonstrations showing how new resource types such as network watchers and Key Vault certificates can be added dynamically. It also demonstrates how these resources are linked to identities to expand attack path visibility. The workshop highlights Cirro’s extensibility and its ability to evolve attack path modeling without requiring changes to core code.
Key Takeaways:
- Cirro uses YAML-based schemas and templating to define how data becomes graph nodes and relationships
- New resource types can be added without modifying core application code
- Data ingestion relies on consistent sources and reusable schema logic
- Both management plane and data plane data can be modeled and connected
- Post-processing supports normalization, deduplication, and relationship enrichment
- Linking resources to identities enables deeper attack path visibility
- A flexible schema model supports continuous expansion as environments evolve
Learn more about Cirro: https://bishopfox.com/tools/cirro
