Starbase collects data from over 70 security and infrastructure services and integrates it into a graph database for analysis. It has three main advantages: depth and breadth of data collection, a uniform data model that classifies entities, and extensibility through custom integrations. Starbase allows querying this unified graph to analyze security-related questions like which code repositories are accessible to outside collaborators or which servers allow public access to port 22.

1. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
Starbase: Graph-Based Security
Analysis for Everyone
github.com/JupiterOne/starbase
Adam Pierson,
Senior Software Engineer

2. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
2
Knowledge of what you have
Knowledge of the relationships
between what you have
Knowledge of what questions to ask
about what you have
Security using
Knowledge
Graphs

3. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
3
Knowledge of
what you have
Users
1. Austin
2. Adam
3. Bob
…
Groups
1. Admin
2. Reader
3. Writer
…
Databases
1. DB 1
2. DB 2
3. DB 3
…
Servers
1. S1
2. S2
3. S3
…

4. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
4
Knowledge of
the relationships
between what
you have
Users
1. Austin
2. Adam
3. Bob
…
Groups
1. Admin
2. Reader
3. Writer
…
Databases
1. DB 1
2. DB 2
3. DB 3
…
Servers
1. S1
2. S2
3. S3
…

5. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
5
Who is Adam?
Which users have MFA disabled?
What code repositories are accessible to
outside collaborators?
What servers allow access to port 22
from the public internet?
Knowledge of
what questions
to ask

6. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
6
Modeling graphs
for security
User -ASSIGNED-> AccessPolicy
UserGroup -HAS-> User
aws_iam_user -ASSIGNED-> aws_iam_policy
google_group -HAS-> google_user
Entity = A node in a graph that represents a resource
within digital infrastructure
Class
Type
Relationship = An edge between two Entity nodes in a
graph
Type = Specific type that an entity is as defined by
the source (e.g. github_repo)
Class = An abstract, super-type that defines what the
entity is within a general framework of IT and
security operations (e.g. CodeRepo)

7. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
7
Graph Data
Schemas

8. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
8
Graph data
models in
practice
Who is Adam?
MATCH (u:User {
email: "adam.pierson@jupiterone.com"
}) RETURN u;
MATCH (u:github_user {
email: "adam.pierson@jupiterone.com"
}) RETURN u;
MATCH (u:google_user {
email: "adam.pierson@jupiterone.com"
}) RETURN u;
MATCH (u:User {
email: "adam.pierson@jupiterone.com",
mfaEnabled: false
}) RETURN u;
Does Adam have MFA disabled?

9. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
9
What is
Starbase?
Starbase collects entities and relationships from
services and systems including cloud infrastructure,
SaaS applications, security controls, and more into an
intuitive graph view backed by a Neo4j database
3 Key Advantages
1. Depth and breadth - Deep visibility from a breadth
of external services and systems. Thousands of
entities (vertices) and relationships (edges) are
available out-of-the-box.
2. Uniform data model - The data that Starbase
collects is automatically classified, making it easy to
develop generic queries.
3. Easily extensible - Starbase graph integrations can
be easily developed!

10. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
10
Depth + breadth
70+ Integrations

11. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
11
Uniform Graph
Data Model

12. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
12
Starbase
Architecture

13. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
13
Configuration
Simple usage…
yarn
yarn neo4j:start
yarn starbase setup
yarn starbase run

14. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
14
Querying
Results
GitHub Outside
Collaborators

15. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
15
Querying
Results
GitHub Outside
Collaborators with Admin
credentials

16. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
16
Querying
Results
Google compute
instances that allow
access to port 22 from the
internet

17. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
17
Querying
Results
Google compute
instances that allow
access to port 22 from the
internet

18. © 2022 Neo4j, Inc. All rights reserved.
© 2022 Neo4j, Inc. All rights reserved.
18
Thank you!
github.com/JupiterOne/starbase
adam.pierson@jupiterone.com