Bloodhound

The Bloodhound connector enables automated interactions with Bloodhound's security analysis capabilities, facilitating the identification and management of AD attack paths.

Bloodhound is a powerful security analysis tool that maps out Active Directory and Azure AD environments to uncover complex attack paths and potential security vulnerabilities. The Bloodhound Turbine Connector allows Swimlane Turbine users to integrate Bloodhound's advanced attack path analytics and risk assessment capabilities directly into their security workflows. By leveraging this connector, security teams can automate the extraction of attack path findings, domain risk analysis, and threat identification, enhancing their ability to proactively defend against sophisticated cyber threats.

Limitations

None to date.

Supported Versions

This BloodHound connector uses the Version 2 API.

Additional Docs

BloodHound Authentication Link

BloodHound API Documentation Link

Configuration

Prerequisites

To effectively utilize the Bloodhound connector for Turbine, ensure you have the following prerequisites:

HTTP Bearer Authentication with these parameters:

URL: Endpoint for the Bloodhound API.

Token: Bearer token such as JWT to authenticate API requests.

Custom Authentication with these parameters:

URL: Endpoint for the Bloodhound API.

ID: Unique identifier for custom authentication.

Key: Secret key associated with the custom ID for authentication.

Authentication Methods

HTTP Basic Authentication:

URL: The endpoint URL for the BloodHound API.

Username: Your BloodHound username with sufficient permissions.

Password: The password associated with your BloodHound account.

Custom Authentication with the following parameters:

URL: The endpoint URL for the BloodHound API.

token_id: The ID of the asset.

token_key: The key of the asset.

Capabilities

This BloodHound connector provides the following capabilities:

Export Attack Path Findings

Get Available Domains

List Attack Path Sparkline Values

List Available Attack Paths

List Domain Attack Paths Details

List Saved Queries

List all Attack Path Types

Run a Cypher Query

Search for Objects

Start Analysis

Update Attack Path Risk

Export Attack Path Findings

Export the finding table for a given attack path.

BloodHound's documentation for this action can be found [here]https://bloodhound.specterops.io/reference/attack-paths/export-attack-path-findings).

Get Available Domains

Gets available domains along with their collection status.

BloodHound's documentation for this action can be found here.

List Attack Path Sparkline Values

List the values that represent the sparklines for individual attack paths.

BloodHound's documentation for this action can be found here.

List Available Attack Paths

Lists all possible attack path types.

BloodHound's documentation for this action can be found here.

List Domain Attack Paths Details

Lists detailed data about attack paths for a domain.

BloodHound's documentation for this action can be found here.

List Saved Queries

Get all saved queries for the current user.

BloodHound's documentation for this action can be found here.

List all Attack Path Types

Lists all possible attack path types.

BloodHound's documentation for this action can be found here.

Run a Cypher Query

Runs a manual cypher query directly against the database.

BloodHound's documentation for this action can be found here.

Search for Objects

Search for graph objects by name or object ID, filtered by type.

BloodHound's documentation for this action can be found [here]https://bloodhound.specterops.io/reference/search/search-for-objects).

Start Analysis

Starts generating attack paths.

BloodHound's documentation for this action can be found here.

Update Attack Path Risk

Updates an attack path as an accepted or unaccepted risk until a given time.

BloodHound's documentation for this action can be found here.

Configurations

BloodHound Asset

Authenticates using bearer token_id and token_key.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token_id	The ID of the asset.	string	Required
token_key	The key of the asset.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

BloodHound HTTP Bearer Authentication

Authenticates using bearer token such as a JWT, etc.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token	The JWT Token.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Export Attack Path Findings

Exports a findings table for an attack path in Bloodhound using the specified domain ID and finding parameters.

Endpoint

URL: /api/v2/domains/{{domain_id}}/attack-path-findings

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.domain_id	string	Required	The ID of the domain to export findings for.
headers	object	Optional	HTTP headers for the request
headers.Prefer	number	Optional	HTTP headers for the request
parameters.sort_by	string	Optional	Sort by column. The only sortable column is finding.
parameters.finding	string	Required	Finding Type.
parameters.filterAccepted	string	Optional	Risk acceptance filter.

Input Example

{"parameters":{"sort_by":"CompositeRisk","finding":"CompositeRisk","filterAccepted":"accepted"},"path_parameters":{"domain_id":"123"},"headers":{"Prefer":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK","json_body":"header1,header2,header3\ncell1,cell2,cell3\ncell4,cell5,cell6\n...\n"}

Get Available Domains

Retrieves a list of available domains along with their collection statuses from Bloodhound.

Endpoint

URL: /api/v2/available-domains

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.Prefer	number	Optional	HTTP headers for the request
parameters.sort_by	string	Optional	Sortable columns are objectid, name.
parameters.objectId	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.name	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.collected	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

Input Example

{"parameters":{"sort_by":"CompositeRisk","objectId":"34234","name":"Composite","collected":"Composite"},"headers":{"Prefer":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.type	string	Response data
data.name	string	Response data
data.id	string	Response data
data.collected	boolean	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"data":[{}]}}

List all Attack Path Types

Retrieve all possible attack path types from Bloodhound for comprehensive analysis and strategic planning.

Endpoint

URL: /api/v2/attack-path-types

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.Prefer	number	Optional	Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.
parameters.sort_by	string	Optional	Sort by column. The only sortable column is finding.
parameters.finding	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

Input Example

{"parameters":{"sort_by":"CompositeRisk","finding":"CompositeRisk"},"headers":{"Prefer":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"data":["<string>"]}}

List Attack Path Sparkline Values

Lists sparkline values for attack paths in a specified domain on Bloodhound, requiring domain ID and finding parameters.

Endpoint

URL: /api/v2/domains/{{domain_id}}/sparkline

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.domain_id	string	Required	The ID of the domain to list the sparkline values for.
headers	object	Optional	HTTP headers for the request
headers.Prefer	number	Optional	Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.
parameters.sort_by	string	Optional	Sortable columns are CompositeRisk, FindingCount, ImpactedAssetCount, domain_sid, id, created_at, updated_at, deleted_at.
parameters.finding	string	Required	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.from	string	Optional	Beginning datetime of range (inclusive) in RFC-3339 format; Defaults to current datetime minus 30 days.
parameters.to	string	Optional	Ending datetime of range (exclusive) in RFC-3339 format; Defaults to current datetime.

Input Example

{"parameters":{"sort_by":"CompositeRisk","finding":"eq","from":"2023-09-01T00:00:00Z","to":"2024-10-01T00:00:00Z"},"path_parameters":{"domain_id":":123"},"headers":{"Prefer":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
start	string	Output field: start
end	string	Output field: end
data	array	Response data
data.id	number	Response data
data.created_at	string	Response data
data.updated_at	string	Response data
data.deleted_at	object	Response data
data.deleted_at.time	string	Response data
data.deleted_at.valid	boolean	Response data
data.CompositeRisk	number	Response data
data.FindingCount	number	Response data
data.ImpactedAssetCount	number	Response data
data.DomainSID	string	Response data
data.Finding	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"start":"2023-11-07T05:31:56Z","end":"2023-11-07T05:31:56Z","data":[{}]}}

List Available Attack Paths

Lists all possible attack paths for a given domain in Bloodhound, using the domain_id as a path parameter.

Endpoint

URL: /api/v2/domains/{{domain_id}}/available-types

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.domain_id	string	Required	Parameters for the List Available Attack Paths action
headers	object	Optional	HTTP headers for the request
headers.Prefer	number	Optional	Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.
parameters.sort_by	string	Optional	Sort by column. The only sortable column is finding.
parameters.finding	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

Input Example

{"parameters":{"sort_by":"CompositeRisk","finding":"CompositeRisk"},"path_parameters":{"domain_id":":123"},"headers":{"Prefer":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"data":["<string>"]}}

List Domain Attack Paths Details

Retrieve detailed attack path information for a specified domain in Bloodhound, utilizing the domain ID and finding parameters.

Endpoint

URL: /api/v2/domains/{{domain_id}}/details

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.domain_id	string	Required	Domain ID
headers	object	Optional	HTTP headers for the request
headers.Prefer	number	Optional	Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.
parameters.finding	string	Required	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.sort_by	string	Optional	Sortable columns are domain_sid, index, AcceptedUntil, id, created_at, updated_at, deleted_at, exposure_percentage, impact_percentage. Relationship risks can be sorted on FromPrincipal and ToPrincipal in addition to the sortable columns for List Risks.
parameters.from_principal	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.to_principal	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.principals_hash	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.accepted_until	string	Optional	Filter results by column timestamp value formatted as an RFC-3339 string. Valid filter predicates are eq, neq, gt, gte, lt, lte.
parameters.Principal	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.domain_sid	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.id	integer	Optional	Filter results by column integer value. Valid filter predicates are eq, neq, gt, gte, lt, lte.
parameters.created_at	string	Optional	Filter results by created_at value. See filter schema details for valid predicates.
parameters.updated_at	string	Optional	Filter results by updated_at value. See filter schema details for valid predicates.
parameters.deleted_at	string	Optional	Filter results by deleted_at value. See filter schema details for valid predicates.
parameters.limit	integer	Optional	This query parameter is used for setting an upper limit of objects returned in paginated responses. Required range x >= 0
parameters.skip	integer	Optional	This query parameter is used for determining the number of objects to skip in pagination. Required range x >= 0

Input Example

{"parameters":{"sort_by":"CompositeRisk","finding":"eq","from_principal":"eq","to_principal":"eq","principals_hash":"eq","accepted_until":"2024-10-01T00:00:00Z","Principal":"eq","id":"eq","created_at":"2024-10-01T00:00:00Z","updated_at":"2024-10-01T00:00:00Z","deleted_at":"2024-10-01T00:00:00Z","limit":100,"skip":0},"path_parameters":{"domain_id":"123"},"headers":{"Prefer":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
count	number	Count value
skip	number	Output field: skip
limit	number	Output field: limit
data	array	Response data
data.id	number	Response data
data.created_at	string	Response data
data.updated_at	string	Response data
data.deleted_at	object	Response data
data.deleted_at.time	string	Response data
data.deleted_at.valid	boolean	Response data
data.FromPrincipal	string	Response data
data.ToPrincipal	string	Response data
data.FromPrincipalProps	object	Response data
data.FromPrincipalProps.additionalProp1	object	Response data
data.FromPrincipalProps.additionalProp2	object	Response data
data.FromPrincipalProps.additionalProp3	object	Response data
data.FromPrincipalKind	string	Response data
data.ToPrincipalProps	object	Response data
data.ToPrincipalProps.additionalProp1	object	Response data
data.ToPrincipalProps.additionalProp2	object	Response data
data.ToPrincipalProps.additionalProp3	object	Response data
data.ToPrincipalKind	string	Response data
data.RelProps	object	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":0,"skip":0,"limit":0,"data":[{}]}}

List Saved Queries

Retrieve all saved queries associated with the current user in Bloodhound.

Endpoint

URL: /api/v2/saved-queries

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.Prefer	number	Optional	Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.
parameters.skip	number	Optional	This query parameter is used for determining the number of objects to skip in pagination. Required range x >= 0
parameters.limit	number	Optional	This query parameter is used for setting an upper limit of objects returned in paginated responses. Required range x >= 0
parameters.sort_by	string	Optional	Sortable columns are user_id, name, query, id, created_at, updated_at, deleted_at.
parameters.name	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.query	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.user_id	string	Optional	Filter results by column string value. Valid filter predicates are eq, ~eq, neq.
parameters.scope	string	Optional	The contains predicate checks a property against the values in a given comma-separated list. in - checks if the property matches an element in the given comma-separated list. Example: in:Contains,GetChangesAll,MemberOf nin - checks if the property does not match an element in the given comma-separated list. Example: nin:LocalToComputer,MemberOfLocalGroup

Input Example

{"parameters":{"skip":0,"limit":10,"sort_by":"user_id","name":"eq:example_name","query":"eq:example_query","user_id":"eq:example_user_id","scope":"in:Contains,GetChangesAll,MemberOf"},"headers":{"Prefer":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
count	number	Count value
skip	number	Output field: skip
limit	number	Output field: limit
data	array	Response data
data.id	number	Response data
data.created_at	string	Response data
data.updated_at	string	Response data
data.deleted_at	object	Response data
data.deleted_at.time	string	Response data
data.deleted_at.valid	boolean	Response data
data.user_id	string	Response data
data.name	string	Response data
data.query	string	Response data
data.description	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":1,"skip":1,"limit":1,"data":[{}]}}

Run a Cypher Query

Execute a manual Cypher query against the Bloodhound database to retrieve specific graph data.

Endpoint

URL: /api/v2/graphs/cypher

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.Prefer	number	Optional	Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.
query	string	Optional	The Cypher query to be executed. This is a string value that represents the Cypher query to be run against the database.
include_properties	boolean	Optional	Include properties in the response. This is a boolean value that determines whether to include properties in the response.

Input Example

{"json_body":{"query":"","include_properties":true},"headers":{"Prefer":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.nodes	object	Response data
data.edges	array	Response data
data.edges.source	string	Response data
data.edges.target	string	Response data
data.edges.label	string	Response data
data.edges.kind	string	Response data
data.edges.lastSeen	string	Response data
data.edges.properties	object	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"data":{"nodes":{},"edges":[]}}}

Search for Objects

Performs a search for graph objects in Bloodhound using name or object ID, with optional type filtering and requires 'q' parameter.

Endpoint

URL: /api/v2/search

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.Prefer	number	Optional	Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.
parameters.q	string	Required	Search parameter for the name or object ID of a node.
parameters.type	string	Optional	Node type. Some AD examples: Base, User, Computer, Group, Container. Some Azure examples: AZBase, AZApp, AZDevice.
parameters.skip	number	Optional	This query parameter is used for determining the number of objects to skip in pagination. Required range: x >= 0.
parameters.limit	number	Optional	This query parameter is used for setting an upper limit of objects returned in paginated responses. Required range: x >= 0.

Input Example

{"parameters":{"q":"683767","type":"Base","skip":0,"limit":10},"headers":{"Prefer":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.objectid	string	Response data
data.type	string	Response data
data.name	string	Response data
data.distinguishedname	string	Response data
data.system_tags	string	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"data":[{}]}}

Start Analysis

Initiates the generation of attack paths within the Bloodhound application to identify potential security threats.

Endpoint

URL: /api/v2/attack-paths

Method: PUT

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.Prefer	number	Optional	Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.

Input Example

{"headers":{"Prefer":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK"}

Update Attack Path Risk

Updates the risk status of a specified attack path in Bloodhound using the provided attack_path_id, with an optional expiration time.

Endpoint

URL: /api/v2/attack-paths/{{attack_path_id}}/acceptance

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.attack_path_id	number	Required	The ID of the attack path to update.
headers	object	Optional	HTTP headers for the request
headers.Prefer	number	Optional	Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Required range x >= 0.
risk_type	string	Optional	The type of risk to be accepted or unaccepted.
accept_until	string	Optional	The date and time until the risk is accepted.
accepted	boolean	Optional	Indicates whether the risk is accepted or unaccepted.

Input Example

{"json_body":{"risk_type":"high","accept_until":"2024-08-28T21:42:18.844Z","accepted":true},"path_parameters":{"attack_path_id":123},"headers":{"Prefer":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	number	Response data
data.created_at	string	Response data
data.updated_at	string	Response data
data.deleted_at	object	Response data
data.deleted_at.time	string	Response data
data.deleted_at.valid	boolean	Response data
data.Principal	string	Response data
data.PrincipalKind	string	Response data
data.Finding	string	Response data
data.DomainSID	string	Response data
data.Props	object	Response data
data.accepted_until	string	Response data
data.ImpactPercentage	number	Response data
data.ImpactCount	number	Response data
data.Severity	string	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"data":{"id":123,"created_at":"2023-11-07T05:31:56Z","updated_at":"2023-11-07T05:31:56Z","deleted_at":{},"Principal":"<string>","PrincipalKind":"<string>","Finding":"<string>","DomainSID":"<string>","Props":{},"accepted_until":"2023-11-07T05:31:56Z","ImpactPercentage":123,"ImpactCount":123,"Severity":"critical"}}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT

Docs powered by Archbee