Core correlation works. HTML reporting and live scan orchestration are in progress.
Cross-tool correlation for the Entra ID security suite. Reads findings from three independent scanners and surfaces risks that no single tool can see on its own.
Each scanner in the suite sees one dimension of tenant risk:
- entra-workload-identity-scanner knows which apps hold dangerous permissions.
- entra-attack-path-visualizer knows which users can escalate to privileged roles.
- entra-zt-policy-engine knows which Conditional Access controls are missing.
Run separately, each produces its own report. None of them answers the question that actually matters: is a dangerous app controlled by a compromisable identity?
The orchestrator answers it by joining findings across tools.
All three scanners write findings in a shared schema (entra-security-report) to a common store. The orchestrator reads that store and runs two correlations:
Ownership join — for every over-privileged application, resolve its owners and check whether any owner is a user the attack-path scanner flags as having a privilege escalation path. Where they match, the dangerous app is owned by a compromisable identity: a real attack chain that neither tool reports alone.
Over-privileged and unowned — over-privileged applications with no owner at all. No accountable party, harder to govern, and a standing escalation target. The workload scanner flags the privilege and the missing owner separately; the orchestrator surfaces the dangerous combination.
The report renders each correlation as a visual chain — the dangerous app, its risky owner, and the owner's escalation path shown as steps — so the relationship is obvious at a glance.
The orchestrator depends on the shared entra_security_report library, a local sibling repo rather than a PyPI package.
git clone https://github.com/Dfrank77/entra-security-report.git
git clone https://github.com/Dfrank77/entra-orchestrator.git
cd entra-orchestrator
python3 -m venv venv && source venv/bin/activate
pip install -e ../entra-security-report
On Python 3.14, if the editable install is skipped (a known setuptools .pth issue), point the venv at the source directly instead:
export PYTHONPATH="/absolute/path/to/entra-security-report/src:$PYTHONPATH"
-
Point every tool at one shared findings store:
export ENTRA_FINDINGS_DIR="$HOME/.entra-findings" -
Run each of the three scanners (with that variable set) so their findings land in the shared store.
-
Run the correlation and open the report:
python correlate.py open orchestrator_report.html
- Live orchestration: run all three scanners and correlate from a single command.
- Remediation guidance per finding.
- Additional correlation types (expiring-credential + over-privileged, PIM-eligible ownership).