Post-Processing Steps
Post-processing steps run after all resources and graph objects have been ingested. They deduplicate nodes, normalize data, and enrich relationships.
Steps
| Step | Priority | Description |
|---|---|---|
| Deduplicate Nodes | 0 | Merge duplicate nodes by ID |
| Deduplicate Relationships | 2 | Merge duplicate relationships |
| Normalize IDs | 0 | Lowercase all node IDs |
| Remove MemberOf GraphRole Relations | 0 | Remove redundant MEMBER_OF → GraphRole |
| Set AppRole Properties | 0 | Enrich ASSIGNED_APPROLE relationships |
| Set ARM Eligible Properties | 0 | Enrich IS_RBAC_ELIGIBLE relationships |
| Set HasScopedRole Properties | 0 | Enrich HAS_SCOPED_ROLE relationships |
| Deduplicate Container Registry | 1000 | Merge container registries by login server |
| Deduplicate Graph Applications | 1000 | Merge graph applications by app ID |
| Deduplicate Graph Roles | 1000 | Merge graph roles by role template ID |
| Deduplicate Service Principals | 1000 | Merge service principals by app ID |
| Deduplicate Storage | 1000 | Merge storage accounts by name |
| Fix DFS Without ID | 1001 | Fix DFS filesystem nodes missing IDs |
| Link TSUser to GraphUser | 1000 | Link Threat Stack users to Graph users |