Ontology

Purpose

Unifies data from all connected integrations into a coherent semantic model. The ontology creates abstract nodes (User, Device) that consolidate identities and devices from multiple sources, so you can ask cross-system questions like:

• Which users own devices that have access to sensitive AWS resources?
• Show all accounts belonging to a specific person across every connected system.
• Which devices are used but not enrolled in MDM?

The ontology module powers the Inventory feature.

How It Works

1. Maps entities from source modules (AWS, Okta, Jamf, …) to standardized ontology nodes.
2. Creates relationships between entities across systems based on common identifiers.
3. Consolidates multiple source records into unified abstract representations.

Example: a person with an OktaUser account, a TailscaleUser account, and a JamfDevice becomes a single User node linked to each of those accounts and devices.

Configuration

The ontology module has no credentials. Two optional fields let you scope which modules contribute to the ontology:

When a source field is set, the ontology only creates User / Device nodes from the listed modules. When left blank, every compatible module contributes.

Setup Steps

1. Enable your source modules first. The ontology needs data to unify (AWS, Okta, Jamf, …).

2. (Optional) In SubImage → Modules → Ontology, set:

   • ontology_users_source — your primary identity provider(s)
   • ontology_devices_source — your device management system(s)

3. Run an ontology sync.

4. Verify in Neo4j Browser:

   MATCH (u:User)-[:HAS_ACCOUNT]->(account)
   RETURN u.email, labels(account), account.username
   LIMIT 10

Common Use Cases

Identity correlation

MATCH (u:User {email: "john.doe@company.com"})-[:HAS_ACCOUNT]->(account)
RETURN labels(account), account.username

Unowned devices

MATCH (d:Device)
WHERE NOT (d)<-[:OWNS]-(:User)
RETURN d.hostname, d.platform

Cross-system access review

MATCH (u:User)-[:HAS_ACCOUNT]->(vpn:TailscaleUser)
MATCH (u)-[:HAS_ACCOUNT]->(aws:AWSUser)
RETURN u.email, vpn.username, aws.username