Custom Analysis Jobs

Purpose

Lets you define custom Cypher queries that create relationships between nodes in the graph — useful when you need to connect data across integrations in ways that aren't built in.

Typical use cases:

• Link AWS IAM users to ontology users via a custom AWS tag
• Relate GitHub repositories to the teams that own them based on naming conventions
• Connect devices to users based on custom metadata fields

How It Works

1. SubImage takes each configured Cypher query.
2. Wraps it as a Cartography analysis job.
3. Executes all jobs against the graph during sync.

Each query runs with a $UPDATE_TAG parameter (unix timestamp) that you can use to track when relationships were last updated.

The analysis module does not require credentials — it operates on existing graph data.

Configuration

Setup Steps

1. In SubImage → Modules → Analysis, click Configure.

2. Click Add entry to add one or more Cypher queries. Each query should create or merge relationships between existing nodes.

3. Save the configuration and trigger a sync.

4. Verify your custom relationships in the Neo4j Browser:

   MATCH ()-[r]->()
   WHERE r.lastupdated IS NOT NULL
   RETURN type(r), count(r)
   ORDER BY count(r) DESC
   LIMIT 20

Writing Queries

Basic relationship creation

MATCH (human:Human), (awsUser:AWSUser)
WHERE human.email = awsUser.arn
MERGE (human)-[r:IDENTITY_AWS]->(awsUser)
ON CREATE SET r.firstseen = $UPDATE_TAG
SET r.lastupdated = $UPDATE_TAG

Matching via tags

MATCH (user:OktaUser), (instance:EC2Instance)
WHERE instance.owner_tag = user.email
MERGE (user)-[r:OWNS_INSTANCE]->(instance)
ON CREATE SET r.firstseen = $UPDATE_TAG
SET r.lastupdated = $UPDATE_TAG

Troubleshooting

• Cypher query error — check the error message in sync history. Verify the syntax in Neo4j Browser. Confirm that all node labels and property names are correct.
• No relationships created — the MATCH clause returned no rows. Verify the source modules have synced; test the MATCH pattern in Neo4j Browser; check for typos in labels and property names.