# SpecterOps: BloodHound OpenGraph ## OpenGraph - [OpenGraph Overview](https://bloodhound.specterops.io/opengraph/overview.md): Learn how graph structure affects your OpenGraph experience and how to choose the right approach. - [BloodHound Community Extensions](https://bloodhound.specterops.io/opengraph/library.md): Explore extensions created by the community and SpecterOps that extend the coverage of BloodHound with OpenGraph. - [OpenGraph FAQ](https://bloodhound.specterops.io/opengraph/faq.md): The following are common questions about OpenGraph ### BloodHound Enterprise Extensions - [Manage Extensions](https://bloodhound.specterops.io/opengraph/extensions/manage.md): Learn about extension components and management workflows, including initial setup and ongoing maintenance. #### Github - [Overview](https://bloodhound.specterops.io/opengraph/extensions/github/overview.md): Learn about the GitHub OpenGraph extension for BloodHound. - [Getting Started](https://bloodhound.specterops.io/opengraph/extensions/github/getting-started.md): Learn how to get started with the GitHub OpenGraph extension in BloodHound. - [Schema](https://bloodhound.specterops.io/opengraph/extensions/github/schema.md): GitHub extension schema definition - [Cypher Queries](https://bloodhound.specterops.io/opengraph/extensions/github/queries.md): GitHub extension Cypher queries - [Privilege Zone Rules](https://bloodhound.specterops.io/opengraph/extensions/github/privilege-zone-rules.md): GitHub extension Privilege Zone rules - [Tier Zero Classification](https://bloodhound.specterops.io/opengraph/extensions/github/tier-zero.md): Tier Zero asset classification for GitHub organizations - [Computed Edges](https://bloodhound.specterops.io/opengraph/extensions/github/computed-edges.md): How OpenHound GitHub and GitHound compute effective branch access and secret scanning alert access edges - [Mitigating Controls](https://bloodhound.specterops.io/opengraph/extensions/github/mitigating-controls.md): Branch protection analysis and attack path mitigation for GitHub organizations ##### Nodes - [GH_App](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_app.md): A GitHub App definition representing the registered application. The app owner controls the private key used to generate installation tokens. - [GH_AppInstallation](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_appinstallation.md): A GitHub App installed on the organization with specific permissions and repository access - [GH_Branch](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_branch.md): A named reference in a repository representing a line of development - [GH_BranchProtectionRule](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_branchprotectionrule.md): A branch protection rule that applies to one or more branches via pattern matching - [GH_Enterprise](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_enterprise.md): A GitHub Enterprise account that contains organizations, enterprise teams, roles, and managed users - [GH_EnterpriseManagedUser](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_enterprisemanageduser.md): A GitHub Enterprise managed user account linked to an enterprise identity provider - [GH_EnterpriseRole](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_enterpriserole.md): The role a user or team has at the GitHub Enterprise level - [GH_EnterpriseRunner](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_enterpriserunner.md): An enterprise-scoped GitHub self-hosted runner available to organizations through enterprise runner groups - [GH_EnterpriseRunnerGroup](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_enterpriserunnergroup.md): An enterprise-scoped GitHub self-hosted runner group that controls runner access and visibility - [GH_EnterpriseTeam](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_enterpriseteam.md): A team managed at the GitHub Enterprise level and assignable across organizations - [GH_Environment](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_environment.md): A GitHub Actions deployment environment with protection rules and deployment branch policies - [GH_EnvironmentBranchPolicy](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_environmentbranchpolicy.md): A deployment branch policy attached to a GitHub environment, such as an exact branch name or wildcard pattern like release/* - [GH_EnvironmentSecret](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_environmentsecret.md): An environment-level GitHub Actions secret scoped to a specific deployment environment - [GH_EnvironmentVariable](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_environmentvariable.md): An environment-level GitHub Actions variable scoped to a specific deployment environment. Unlike secrets, variable values are readable. - [GH_ExternalIdentity](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_externalidentity.md): An external identity from a SAML/SCIM provider linked to a GitHub user for SSO authentication - [GH_Organization](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_organization.md): A GitHub Organization—top-level container for repositories, teams, and settings - [GH_OrgRole](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_orgrole.md): The role a user has at the organization level (e.g., admin, member) - [GH_OrgRunner](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_orgrunner.md): An organization-scoped GitHub self-hosted runner available to selected repositories or workflows - [GH_OrgRunnerGroup](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_orgrunnergroup.md): An organization-scoped GitHub self-hosted runner group that controls runner access and visibility - [GH_OrgSecret](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_orgsecret.md): An organization-level GitHub Actions secret that can be scoped to all, private, or selected repositories - [GH_OrgVariable](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_orgvariable.md): An organization-level GitHub Actions variable that can be scoped to all, private, or selected repositories. Unlike secrets, variable values are readable. - [GH_PersonalAccessToken](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_personalaccesstoken.md): A fine-grained personal access token granted access to organization resources - [GH_PersonalAccessTokenRequest](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_personalaccesstokenrequest.md): A pending request from an organization member to access organization resources with a fine-grained personal access token - [GH_RepoRole](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_reporole.md): The permission granted to a user or team on a repository (e.g., admin, write, read) - [GH_RepoRunner](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_reporunner.md): A repository-scoped GitHub self-hosted runner available to jobs in a single repository - [GH_RepoSecret](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_reposecret.md): A repository-level GitHub Actions secret accessible only to workflows in that repository - [GH_Repository](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_repository.md): A code repository in an organization, containing files, issues, and other resources - [GH_RepoVariable](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_repovariable.md): A repository-level GitHub Actions variable accessible only to workflows in that repository. Unlike secrets, variable values are readable. - [GH_Runner](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_runner.md): Generic label applied to GitHub self-hosted runner nodes across enterprise, organization, and repository scope - [GH_RunnerGroup](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_runnergroup.md): Generic label applied to GitHub self-hosted runner group nodes across enterprise and organization scope - [GH_SamlIdentityProvider](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_samlidentityprovider.md): A SAML identity provider configured for the organization, enabling SSO - [GH_Secret](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_secret.md): Generic label applied to GitHub secret nodes across organization, repository, and environment scope - [GH_SecretScanningAlert](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_secretscanningalert.md): A GitHub Advanced Security alert indicating a secret was accidentally committed to a repository - [GH_Team](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_team.md): A team within an organization, grouping users for shared access and collaboration - [GH_TeamRole](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_teamrole.md): The role a user has within a team (e.g., maintainer, member) - [GH_User](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_user.md): An individual GitHub user account - [GH_Variable](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_variable.md): Generic label applied to GitHub variable nodes across organization, repository, and environment scope - [GH_Workflow](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_workflow.md): A GitHub Actions workflow defined in a repository - [GH_WorkflowJob](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_workflowjob.md): A job within a GitHub Actions workflow, with a runner, permissions, and an ordered list of steps - [GH_WorkflowStep](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_workflowstep.md): A single step within a GitHub Actions job — either a uses: action reference or a run: shell command ##### Edges - [GH_AddAssignee](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_addassignee.md): [Repository] Repo role can assign users to issues and pull requests - [GH_AddCollaborator](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_addcollaborator.md): [Organization] Org role can add outside collaborators - [GH_AddLabel](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_addlabel.md): [Repository] Repo role can add labels to issues and pull requests - [GH_AddMember](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_addmember.md): Team role can add members to the team (maintainer privilege) - [GH_AdminTo](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_adminto.md): [Repository] Repo role has admin access to the repository. - [GH_ApprovesDeploymentTo](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_approvesdeploymentto.md): User or team is configured as a required reviewer for this environment - [GH_AssignedTo](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_assignedto.md): Enterprise-scoped team is assigned to an organization - [GH_BypassBranchProtection](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_bypassbranchprotection.md): [Repository] Repo role can bypass merge-gate branch protections (PR reviews, lock branch). Suppressed by enforce_admins. - [GH_BypassPullRequestAllowances](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_bypasspullrequestallowances.md): User or team can bypass pull request requirements on a branch protection rule - [GH_CallsWorkflow](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_callsworkflow.md): [Workflow] Job calls a reusable workflow — GH_WorkflowJob → GH_Workflow - [GH_CanAccess](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_canaccess.md): Personal access token or app installation can access this repository or organization - [GH_CanAssumeIdentity](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_canassumeidentity.md): Repository can assume this cloud identity via OIDC federation (Azure workload identity or AWS IAM role) - [GH_CanCreateBranch](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_cancreatebranch.md): [Repository - Computed] Role can create new branches in this repository (unprotected branches that bypass the merge gate) - [GH_CanCreateEnvironment](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_cancreateenvironment.md): Repo role can create new GitHub environments in this repository by editing a workflow that references a nonexistent environment name - [GH_CanCreateInternalRepositories](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_cancreateinternalrepositories.md): Role can create internal repositories in the organization - [GH_CanCreatePrivateRepositories](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_cancreateprivaterepositories.md): Role can create private repositories in the organization - [GH_CanCreatePublicRepositories](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_cancreatepublicrepositories.md): Role can create public repositories in the organization - [GH_CanCreateRepositories](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_cancreaterepositories.md): Role can create repositories in the organization - [GH_CanCreateRepositoryWithRunnerAccess](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_cancreaterepositorywithrunneraccess.md): Org role can create a repository that can dispatch workflows to this runner group - [GH_CanDeployToEnvironment](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_candeploytoenvironment.md): [Computed] Repository, branch, repo role, or reviewer can deploy to this GitHub environment after evaluating deployment branch policy, reviewer gates, and admin bypass behavior; reviewer edges require both self-approval and a deployable code path - [GH_CanEditEnvironment](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_caneditenvironment.md): Repo admin role can edit the configuration of this GitHub environment - [GH_CanEditProtection](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_caneditprotection.md): [Repository - Computed] Repo role can modify or remove branch protection rules for the repository/branch (computed from GH_EditRepoProtections + GH_ProtectedBy) - [GH_CanPwnRequest](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_canpwnrequest.md): [Computed] Repo role can exploit a pwn-requestable workflow to execute arbitrary code with the target's secrets and permissions — GH_RepoRole → GH_Repository / GH_Branch - [GH_CanReadSecret](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_canreadsecret.md): Org role can read an organization secret by creating a repository in scope - [GH_CanReadSecretScanningAlert](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_canreadsecretscanningalert.md): [Computed] Role can read secret scanning alerts (computed from GH_ViewSecretScanningAlerts permission + GH_Contains) - [GH_CanUseRunner](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_canuserunner.md): Repository or branch can dispatch workflows to this self-hosted runner execution surface - [GH_CanWriteBranch](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_canwritebranch.md): [Repository - Computed] Role can push to this branch after evaluating branch protection rules, push restrictions, and bypass allowances - [GH_CloseDiscussion](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_closediscussion.md): [Repository] Repo role can close discussions - [GH_CloseIssue](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_closeissue.md): [Repository] Repo role can close issues - [GH_ClosePullRequest](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_closepullrequest.md): [Repository] Repo role can close pull requests - [GH_Contains](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_contains.md): Container relationship for organizational hierarchy (org contains secrets/variables, repo contains secrets/variables, environment contains secrets/variables) - [GH_ConvertIssuesToDiscussions](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_convertissuestodiscussions.md): [Repository] Repo role can convert issues to discussions - [GH_CreateDiscussionCategory](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_creatediscussioncategory.md): [Repository] Repo role can create discussion categories - [GH_CreateEnterpriseOrganizations](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_createenterpriseorganizations.md): [Enterprise] Enterprise role can create organizations - [GH_CreateRepository](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_createrepository.md): [Organization] Org role can create repositories in the organization - [GH_CreateSoloMergeQueueEntry](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_createsolomergequeueentry.md): Repo role can create solo merge queue entries - [GH_CreateTag](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_createtag.md): [Repository] Repo role can create tags and releases - [GH_CreateTeam](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_createteam.md): [Organization] Org role can create teams in the organization - [GH_DeleteAlertsCodeScanning](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_deletealertscodescanning.md): [Repository] Repo role can delete code scanning alerts - [GH_DeleteDiscussion](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_deletediscussion.md): [Repository] Repo role can delete discussions - [GH_DeleteDiscussionComment](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_deletediscussioncomment.md): [Repository] Repo role can delete discussion comments - [GH_DeleteIssue](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_deleteissue.md): [Repository] Repo role can delete issues - [GH_DeleteTag](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_deletetag.md): [Repository] Repo role can delete tags and releases - [GH_DependsOn](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_dependson.md): [Workflow] Job must run after another job (needs: dependency) — ordering only, not an access path - [GH_DeploysTo](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_deploysto.md): [Workflow] Job deploys to a GitHub Environment — GH_WorkflowJob → GH_Environment - [GH_EditCategoryOnDiscussion](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_editcategoryondiscussion.md): [Repository] Repo role can change the category of a discussion - [GH_EditDiscussionCategory](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_editdiscussioncategory.md): [Repository] Repo role can edit discussion categories - [GH_EditDiscussionComment](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_editdiscussioncomment.md): [Repository] Repo role can edit discussion comments - [GH_EditEnterpriseCustomPropertiesForOrganizations](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_editenterprisecustompropertiesfororganizations.md): [Enterprise] Enterprise role can edit custom properties for organizations - [GH_EditRepoAnnouncementBanners](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_editrepoannouncementbanners.md): [Repository] Repo role can edit repository announcement banners - [GH_EditRepoCustomPropertiesValues](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_editrepocustompropertiesvalues.md): [Repository] Repo role can edit custom property values on the repository - [GH_EditRepoMetadata](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_editrepometadata.md): [Repository] Repo role can edit repository metadata - [GH_EditRepoProtections](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_editrepoprotections.md): Repo role can edit branch protection rules - [GH_HasBaseRole](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_hasbaserole.md): Role inherits permissions from another role - [GH_HasExternalIdentity](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_hasexternalidentity.md): SAML identity provider has this external identity - [GH_HasMember](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_hasmember.md): Enterprise or organization has this user as a member - [GH_HasPersonalAccessToken](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_haspersonalaccesstoken.md): User owns this personal access token that has been granted access to the organization - [GH_HasPersonalAccessTokenRequest](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_haspersonalaccesstokenrequest.md): User has a pending personal access token request for the organization - [GH_HasRole](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_hasrole.md): User or team has a role assignment (org role, team role, or repo role) - [GH_HasRunner](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_hasrunner.md): Runner group exposes a directly assigned self-hosted runner to authorized repositories or workflows - [GH_HasSamlIdentityProvider](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_hassamlidentityprovider.md): Organization has this SAML identity provider configured - [GH_HasSecret](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_hassecret.md): Repository or environment has access to this secret - [GH_HasVariable](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_hasvariable.md): Repository or environment has access to this variable - [GH_InheritedFrom](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_inheritedfrom.md): Organization runner group is inherited from an enterprise runner group - [GH_InstalledAs](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_installedas.md): GitHub App is installed as this app installation on an organization - [GH_InviteMember](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_invitemember.md): [Organization] Org role can invite members to the organization - [GH_IsEligibleFor](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_iseligiblefor.md): Repository is within the repository-access scope of this runner group - [GH_JumpMergeQueue](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_jumpmergequeue.md): Repo role can jump the merge queue - [GH_ManageDeployKeys](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_managedeploykeys.md): [Repository] Repo role can manage deploy keys - [GH_ManageDiscussionBadges](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_managediscussionbadges.md): [Repository] Repo role can manage discussion badges - [GH_ManageEnterpriseAdmins](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_manageenterpriseadmins.md): [Enterprise] Enterprise role can manage enterprise administrators - [GH_ManageEnterpriseIdentityProvider](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_manageenterpriseidentityprovider.md): [Enterprise] Enterprise role can manage the enterprise identity provider - [GH_ManageEnterpriseMembers](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_manageenterprisemembers.md): [Enterprise] Enterprise role can manage enterprise members - [GH_ManageEnterpriseOrganizationAdmins](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_manageenterpriseorganizationadmins.md): [Enterprise] Enterprise role can manage organization administrators - [GH_ManageEnterpriseOrganizations](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_manageenterpriseorganizations.md): [Enterprise] Enterprise role can manage organizations - [GH_ManageEnterpriseReferrals](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_manageenterprisereferrals.md): [Enterprise] Enterprise role can manage referrals - [GH_ManageEnterpriseTeams](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_manageenterpriseteams.md): [Enterprise] Enterprise role can manage enterprise teams - [GH_ManageOrganizationWebhooks](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_manageorganizationwebhooks.md): [Organization] Org role can manage organization webhooks - [GH_ManageRepoSecurityProducts](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_managereposecurityproducts.md): Repo role can manage repo-level security products - [GH_ManageSecurityProducts](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_managesecurityproducts.md): Repo role can manage security products - [GH_ManageSettingsMergeTypes](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_managesettingsmergetypes.md): [Repository] Repo role can manage allowed merge types - [GH_ManageSettingsPages](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_managesettingspages.md): [Repository] Repo role can manage GitHub Pages settings - [GH_ManageSettingsProjects](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_managesettingsprojects.md): [Repository] Repo role can manage project settings - [GH_ManageSettingsWiki](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_managesettingswiki.md): [Repository] Repo role can manage wiki settings - [GH_ManageTopics](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_managetopics.md): [Repository] Repo role can manage repository topics - [GH_ManageWebhooks](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_managewebhooks.md): [Repository] Repo role can manage repository webhooks - [GH_MapsToUser](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_mapstouser.md): External identity maps to a GitHub user or identity provider user - [GH_MarkAsDuplicate](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_markasduplicate.md): [Repository] Repo role can mark issues or pull requests as duplicates - [GH_MatchesEnvironmentPolicy](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_matchesenvironmentpolicy.md): Branch matches this environment deployment branch policy - [GH_MemberOf](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_memberof.md): Team role is a member of a team, team is nested under a parent team, or enterprise team maps to its projected organization team - [GH_OrgBypassCodeScanningDismissalRequests](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_orgbypasscodescanningdismissalrequests.md): [Organization] Org role can bypass code scanning dismissal requests - [GH_OrgBypassSecretScanningClosureRequests](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_orgbypasssecretscanningclosurerequests.md): [Organization] Org role can bypass secret scanning closure requests - [GH_OrgReviewAndManageSecretScanningBypassRequests](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningbypassrequests.md): [Organization] Org role can review and manage secret scanning bypass requests - [GH_OrgReviewAndManageSecretScanningClosureRequests](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_orgreviewandmanagesecretscanningclosurerequests.md): [Organization] Org role can review and manage secret scanning closure requests - [GH_Owns](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_owns.md): Organization owns a repository - [GH_ProtectedBy](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_protectedby.md): Branch protection rule protects this branch - [GH_PushProtectedBranch](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_pushprotectedbranch.md): [Repository] Repo role can push to branches with push restrictions. Not affected by enforce_admins. - [GH_ReadCodeScanning](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_readcodescanning.md): [Repository] Repo role can read code scanning results - [GH_ReadEnterpriseAuditLog](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_readenterpriseauditlog.md): [Enterprise] Enterprise role can read the audit log - [GH_ReadEnterpriseDomainVerification](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_readenterprisedomainverification.md): [Enterprise] Enterprise role can read domain verification data - [GH_ReadEnterpriseMembers](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_readenterprisemembers.md): [Enterprise] Enterprise role can read enterprise members - [GH_ReadEnterpriseOrganizationAdmin](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_readenterpriseorganizationadmin.md): [Enterprise] Enterprise role can read organization administration data - [GH_ReadEnterpriseOrgProjects](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_readenterpriseorgprojects.md): [Enterprise] Enterprise role can read organization projects - [GH_ReadOrganizationActionsUsageMetrics](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_readorganizationactionsusagemetrics.md): [Organization] Org role can read Actions usage metrics - [GH_ReadOrganizationCustomOrgRole](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_readorganizationcustomorgrole.md): [Organization] Org role can read custom org role definitions - [GH_ReadOrganizationCustomRepoRole](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_readorganizationcustomreporole.md): [Organization] Org role can read custom repo role definitions - [GH_ReadRepoContents](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_readrepocontents.md): [Repository] Repo role can read repository contents - [GH_RemoveAssignee](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_removeassignee.md): [Repository] Repo role can remove assignees from issues and pull requests - [GH_RemoveLabel](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_removelabel.md): [Repository] Repo role can remove labels from issues and pull requests - [GH_ReopenDiscussion](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_reopendiscussion.md): [Repository] Repo role can reopen discussions - [GH_ReopenIssue](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_reopenissue.md): [Repository] Repo role can reopen closed issues - [GH_ReopenPullRequest](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_reopenpullrequest.md): [Repository] Repo role can reopen closed pull requests - [GH_RequestPrReview](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_requestprreview.md): [Repository] Repo role can request pull request reviews - [GH_ResolveDependabotAlerts](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_resolvedependabotalerts.md): [Repository] Repo role can resolve Dependabot alerts - [GH_ResolveSecretScanningAlerts](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_resolvesecretscanningalerts.md): [Organization] Org role can resolve secret scanning alerts - [GH_RestrictionsCanPush](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_restrictionscanpush.md): User or team is allowed to push to branches protected by this rule - [GH_RunOrgMigration](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_runorgmigration.md): [Repository] Repo role can run organization migrations - [GH_SetEnterpriseInteractionLimits](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_setenterpriseinteractionlimits.md): [Enterprise] Enterprise role can set interaction limits - [GH_SetInteractionLimits](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_setinteractionlimits.md): [Repository] Repo role can set interaction limits on the repository - [GH_SetIssueType](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_setissuetype.md): [Repository] Repo role can set issue types - [GH_SetMilestone](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_setmilestone.md): [Repository] Repo role can set milestones on issues and pull requests - [GH_SetSocialPreview](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_setsocialpreview.md): [Repository] Repo role can set the repository social preview image - [GH_SyncedTo](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_syncedto.md): External identity (Azure, Okta, PingOne) is synced to this GitHub user via SSO/SCIM - [GH_ToggleDiscussionAnswer](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_togglediscussionanswer.md): [Repository] Repo role can toggle discussion answers - [GH_ToggleDiscussionCommentMinimize](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_togglediscussioncommentminimize.md): [Repository] Repo role can minimize discussion comments - [GH_TransferRepository](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_transferrepository.md): [Organization] Org role can transfer repositories - [GH_UsesSecret](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_usessecret.md): [Workflow] Job or step references a secret by name — GH_WorkflowJob / GH_WorkflowStep → GH_RepoSecret / GH_OrgSecret / GH_EnvironmentSecret (scope match) - [GH_UsesVariable](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_usesvariable.md): [Workflow] Job or step references a variable by name — GH_WorkflowJob / GH_WorkflowStep → GH_RepoVariable / GH_OrgVariable / GH_EnvironmentVariable (scope match) - [GH_ValidToken](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_validtoken.md): Secret scanning alert contains a valid, active token belonging to this user - [GH_ViewDependabotAlerts](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_viewdependabotalerts.md): [Repository] Repo role can view Dependabot alerts - [GH_ViewEnterpriseActionsUsageMetrics](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_viewenterpriseactionsusagemetrics.md): [Enterprise] Enterprise role can view Actions usage metrics - [GH_ViewEnterpriseBilling](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_viewenterprisebilling.md): [Enterprise] Enterprise role can view billing data - [GH_ViewEnterpriseSecretScanningAlerts](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_viewenterprisesecretscanningalerts.md): [Enterprise] Enterprise role can view secret-scanning alerts - [GH_ViewSecretScanningAlerts](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_viewsecretscanningalerts.md): [Repository] Role can view secret scanning alerts - [GH_WriteCodeScanning](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writecodescanning.md): [Repository] Repo role can upload code scanning results - [GH_WriteEnterpriseActionsPolicies](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writeenterpriseactionspolicies.md): [Enterprise] Enterprise role can write Actions policies - [GH_WriteEnterpriseBilling](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writeenterprisebilling.md): [Enterprise] Enterprise role can write billing settings - [GH_WriteEnterprisePersonalAccessTokenPolicies](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writeenterprisepersonalaccesstokenpolicies.md): [Enterprise] Enterprise role can write personal access token policies - [GH_WriteEnterpriseSso](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writeenterprisesso.md): [Enterprise] Enterprise role can write SSO settings - [GH_WriteEnterpriseTeamMembers](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writeenterpriseteammembers.md): [Enterprise] Enterprise role can write enterprise team membership - [GH_WriteOrganizationActionsSecrets](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writeorganizationactionssecrets.md): [Organization] Org role can write Actions secrets - [GH_WriteOrganizationActionsSettings](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writeorganizationactionssettings.md): [Organization] Org role can write Actions settings - [GH_WriteOrganizationActionsVariables](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writeorganizationactionsvariables.md): [Organization] Org role can write Actions variables - [GH_WriteOrganizationCustomOrgRole](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writeorganizationcustomorgrole.md): [Organization] Org role can write custom org role definitions - [GH_WriteOrganizationCustomRepoRole](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writeorganizationcustomreporole.md): [Organization] Org role can write custom repo role definitions - [GH_WriteOrganizationNetworkConfigurations](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writeorganizationnetworkconfigurations.md): [Organization] Org role can write network configurations - [GH_WriteRepoContents](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writerepocontents.md): [Repository] Repo role can write repository contents - [GH_WriteRepoPullRequests](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_writerepopullrequests.md): [Repository] Repo role can create and merge pull requests #### Jamf - [Overview](https://bloodhound.specterops.io/opengraph/extensions/jamf/overview.md): Learn about the Jamf OpenGraph extension for BloodHound. - [Getting Started](https://bloodhound.specterops.io/opengraph/extensions/jamf/getting-started.md): Learn how to get started with the Jamf OpenGraph extension in BloodHound. - [Schema](https://bloodhound.specterops.io/opengraph/extensions/jamf/schema.md): Jamf extension schema definition - [Cypher Queries](https://bloodhound.specterops.io/opengraph/extensions/jamf/queries.md): Jamf extension Cypher queries - [Privilege Zone Rules](https://bloodhound.specterops.io/opengraph/extensions/jamf/privilege-zone-rules.md): Jamf extension Privilege Zone rules ##### Nodes - [jamf_Account](https://bloodhound.specterops.io/opengraph/extensions/jamf/nodes/jamf_account.md): Represents an enabled Jamf Pro local or directory account. Accounts are identity principals that hold permissions and can perform actions within the Jamf Pro environment. - [jamf_ApiClient](https://bloodhound.specterops.io/opengraph/extensions/jamf/nodes/jamf_apiclient.md): Represents an enabled Jamf Pro API client integration. API clients authenticate via OAuth client credentials and hold permissions through assigned API roles. They can perform programmatic actions holding the same permissions as accounts and groups and cannot be scoped to sites. - [jamf_Computer](https://bloodhound.specterops.io/opengraph/extensions/jamf/nodes/jamf_computer.md): Represents a computer managed by Jamf Pro, commonly macOS. Computers are the primary target resources for policy execution, script deployment, and MDM management commands. - [jamf_ComputerUser](https://bloodhound.specterops.io/opengraph/extensions/jamf/nodes/jamf_computeruser.md): Represents a user assigned to a jamf-managed computer. Computer users are derived from the location/user assignment on the computer record. - [jamf_DisabledAccount](https://bloodhound.specterops.io/opengraph/extensions/jamf/nodes/jamf_disabledaccount.md): Represents a disabled Jamf Pro account. Disabled accounts retain their permission configuration but cannot actively authenticate. If re-enabled, they regain all assigned privileges. - [jamf_DisabledApiClient](https://bloodhound.specterops.io/opengraph/extensions/jamf/nodes/jamf_disabledapiclient.md): Represents a disabled Jamf Pro API client integration. Disabled API clients retain their role assignments but cannot authenticate. If re-enabled, they regain all assigned permissions. - [jamf_Group](https://bloodhound.specterops.io/opengraph/extensions/jamf/nodes/jamf_group.md): Represents a Jamf Pro account group. Groups aggregate accounts and hold shared permissions that are inherited by their members. Groups can have Full Access or Site Access privilege levels. - [jamf_Site](https://bloodhound.specterops.io/opengraph/extensions/jamf/nodes/jamf_site.md): Represents a Jamf Pro site. Sites are organizational containers that segment resources within a Jamf tenant. Accounts and resources can be scoped to specific sites, limiting their access and management boundaries. - [jamf_SSOIntegration](https://bloodhound.specterops.io/opengraph/extensions/jamf/nodes/jamf_ssointegration.md): Represents the Single Sign-On (SSO) integration configured in the Jamf Pro tenant. When enabled, the SSO provider can map attributes to authenticate as any Jamf account or group, making it a Tier 0 node with significant security implications. - [jamf_Tenant](https://bloodhound.specterops.io/opengraph/extensions/jamf/nodes/jamf_tenant.md): Represents the top-level Jamf Pro tenant environment. This is the root container node for all Jamf resources. ##### Edges - [jamf_AdminTo](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_adminto.md): Represents full administrative control over the target and all resources controlled by the target. - [jamf_AdminToSite](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_admintosite.md): The source has administrative control over the site and all resources controlled by the site. This includes creating policies that impact resources of the site, send or clear MDM commands, remotely administer site devices and computers, create computer objects for the site. - [jamf_AssignedUser](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_assigneduser.md): Represents the user assignment relationship on a jamf-managed computer. - [jamf_AZMatchedEmail](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_azmatchedemail.md): Represents a cross-platform identity correlation where the Jamf principal's email attribute matches an Azure AD account's email. - [jamf_Contains](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_contains.md): Represents a structural containment relationship where the source node contains the target resource. - [jamf_Create_API_Client_and_Assign_Role](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_create_api_client_and_assign_role.md): Represents a privilege escalation path where the source possesses 'Create API Integrations' permission and at least one role exists allowing the creation of new API clients to assume existing role permissions. - [jamf_Create_API_Client_and_Create_Role](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_create_api_client_and_create_role.md): Represents a combined privilege escalation path, where the source possesses the 'Create API Integrations' and 'Create API Roles' permissions, that allow the creation of new API clients with any permissions in newly assigned roles and retrieving API client credentials to authenticate. - [jamf_Create_API_Client_and_Update_Role](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_create_api_client_and_update_role.md): Represents a combined privilege escalation path where the source possesses 'Create API Integrations' and 'Update API Roles' permissions and at least one API role exists allowing the creation of new API clients to assume roles, modifying the permissions of existing roles, and retrieving API client cr… - [jamf_CreateAccounts](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_createaccounts.md): Represents possession of the 'Create Accounts' JSS Object permission which allows creating new accounts, including administrators, as well as creating new groups with any permissions. - [jamf_CreateAPIRoles](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_createapiroles.md): Represents the ability to create API roles in the Jamf tenant. Non-traversable because creating roles without the ability to create or update API integrations does not provide a credential retrieval mechanism. - [jamf_CreateComputerExtensions](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_createcomputerextensions.md): Represents the ability to create computer extension attributes which can execute code on all computers in the Jamf tenant. - [jamf_CreatePolicies](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_createpolicies.md): Represents possession of the 'Create Policies' JSSObject privilege allowing code execution on target computers. - [jamf_MatchedEmail](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_matchedemail.md): Represents an identity correlation where the Jamf computer user's email attribute matches the Jamf account's email. - [jamf_MatchedName](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_matchedname.md): Represents an identity correlation where the Jamf computer user's displayname matches the Jamf account's name or displayname. - [jamf_MemberOf](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_memberof.md): Represents group membership where the source inherits the group's permissions and assignments. - [jamf_Okta_Same_Device](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_okta_same_device.md): Represents a hybrid cross-platform device correlation where the Jamf Pro registered computer's UDID matches the registered device UDID in Okta. - [jamf_ScriptsNonTraversable](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_scriptsnontraversable.md): Represents the ability to create or update scripts on the target. This edge is non-traversable because script creation/modification alone does not enable code execution. - [jamf_SSO_Login](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_sso_login.md): Represents the ability of an SSO identity provider to authenticate as and inherit the privileges of Jamf accounts and groups. - [jamf_Update_API_Client_and_Assign_Role](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_update_api_client_and_assign_role.md): Represents posession of the 'Update API Integrations' permission and at least one role has been created in the tenant. Combined these allow updating existing API clients to assume the permissions of existing roles. Non-traversable because these permissions alone cannot retrieve API client credential… - [jamf_Update_API_Client_and_Create_Roles](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_update_api_client_and_create_roles.md): Represents combined possession of 'Update API Integrations' and 'Create API Roles' permissions and at least one API client exists in the tenant allowing updates of existing API clients and assigning new roles created with any included permissions. Non-traversable because these permissions alone cann… - [jamf_Update_API_Client_and_Update_Roles](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_update_api_client_and_update_roles.md): Represents combined possession of 'Update API Integrations' and 'Update API Roles' permissions and at least one Api Client and Role exist in the tenant allowing updates of existing API clients with any permissions by updating existing roles. Non-traversable because these permissions alone cannot ret… - [jamf_Update_Recurring_Scripts](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_update_recurring_scripts.md): Represents a code execution path where the source has 'Update Scripts' JSSObject permission and there are scripts configured to run repeatedly on target computers via enabled policies allowing code execution. - [jamf_Update_Roles_Assigned_To_Self](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_update_roles_assigned_to_self.md): Represents an API client possessing the 'Update API Roles' permission which allows updating existing API roles with any permissions, including roles assigned to itself. - [jamf_Update_Self_and_Assign_Roles](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_update_self_and_assign_roles.md): Represents an API client that possesses 'Update API Integrations' permission and at least one role exists, allowing the client to assume the permissions of existing roles. - [jamf_Update_Self_and_Create_Roles](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_update_self_and_create_roles.md): Represents an API client that possesses 'Update API Integrations' and 'Create API Roles' permissions, allowing the client to assign new roles with any included permissions. - [jamf_Update_Self_and_Update_Roles](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_update_self_and_update_roles.md): Represents an API client that possesses 'Update API Integrations' and 'Update API Roles' permissions and at least one role exists, allowing the client to assign any permissions by modifying existing roles. - [jamf_Update_SSO_Settings](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_update_sso_settings.md): Represents the ability to update or enable SSO settings in the tenant to change authentication to inherit the privileges of Jamf accounts and groups. - [jamf_UpdateAccounts](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_updateaccounts.md): Represents possession of the 'Update Accounts' JSS Object permission which allows altering the passwords, enabled status, permissions, and memberships of existing accounts or groups. - [jamf_UpdateAPIRoles](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_updateapiroles.md): Represents the ability to update existing API roles in the Jamf tenant. Non-traversable because modifying roles without the ability to create or update API clients does not provide a credential retrieval mechanism. - [jamf_UpdateComputerExtensions](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_updatecomputerextensions.md): Represents the ability to update existing computer extension attributes and at least one extension attribute exists, allowing execution of code on all computers in the Jamf tenant during inventory collection. - [jamf_UpdatePolicies](https://bloodhound.specterops.io/opengraph/extensions/jamf/edges/jamf_updatepolicies.md): Represents possession of the 'Update Policies' JSSObject privilege and at least one policy already exists in the tenant, allowing modification of existing policies for code execution on target computers. #### Okta - [Overview](https://bloodhound.specterops.io/opengraph/extensions/okta/overview.md): Learn about the Okta OpenGraph extension for BloodHound. - [Getting Started](https://bloodhound.specterops.io/opengraph/extensions/okta/getting-started.md): Learn how to get started with the Okta OpenGraph extension in BloodHound. - [Schema](https://bloodhound.specterops.io/opengraph/extensions/okta/schema.md): Okta extension schema definition - [Cypher Queries](https://bloodhound.specterops.io/opengraph/extensions/okta/queries.md): Okta extension Cypher queries - [Privilege Zone Rules](https://bloodhound.specterops.io/opengraph/extensions/okta/privilege-zone-rules.md): Okta extension Privilege Zone rules ##### Nodes - [Okta_Agent](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_agent.md): A synchronization or authentication agent in Okta - [Okta_AgentPool](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_agentpool.md): A pool of synchronization or authentication agents in Okta - [Okta_ApiServiceIntegration](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_apiserviceintegration.md): An API service integration - [Okta_ApiToken](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_apitoken.md): A secret used by users to authenticate to the Okta API - [Okta_Application](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_application.md): An application registered in Okta, such as a SAML app or an OIDC app - [Okta_AuthorizationServer](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_authorizationserver.md): An authorization server in Okta - [Okta_ClientSecret](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_clientsecret.md): A secret used by applications to authenticate to the Okta API - [Okta_CustomRole](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_customrole.md): A custom role in Okta created by an administrator - [Okta_Device](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_device.md): A device registered in Okta, such as a mobile phone or a computer - [Okta_Group](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_group.md): An Okta user group - [Okta_IdentityProvider](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_identityprovider.md): An identity provider trusted by Okta for authentication - [Okta_JWK](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_jwk.md): An Okta JSON Web Key - [Okta_Organization](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_organization.md): An Okta organization - [Okta_Policy](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_policy.md): A policy defining rules for authentication, password, or other features in Okta - [Okta_Realm](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_realm.md): An Okta realm - [Okta_ResourceSet](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_resourceset.md): A resource set containing users, groups, applications, and other Okta objects - [Okta_Role](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_role.md): A built-in role in Okta, such as Super Admin or Group Admin - [Okta_RoleAssignment](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_roleassignment.md): A set of permissions assigned to a user, group, or an application in Okta - [Okta_User](https://bloodhound.specterops.io/opengraph/extensions/okta/nodes/okta_user.md): An Okta user account ##### Edges - [Okta_AddMember](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_addmember.md): Ability to add or remove members in scoped Okta groups - [Okta_AgentMemberOf](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_agentmemberof.md): Membership of an Okta agent in an agent pool - [Okta_AgentPoolFor](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_agentpoolfor.md): Relationship between an AD agent pool and its backing AD application - [Okta_ApiTokenFor](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_apitokenfor.md): User ownership of an Okta API token - [Okta_AppAdmin](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_appadmin.md): Application administrator role assignment - [Okta_AppAssignment](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_appassignment.md): Assignment of users or groups to an Okta application - [Okta_Contains](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_contains.md): Contains relationship between the Okta organization and its objects - [Okta_CreatorOf](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_creatorof.md): Creator relationship for API service integrations - [Okta_DeviceOf](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_deviceof.md): Ownership relationship between a device and its assigned user - [Okta_GroupAdmin](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_groupadmin.md): Group administrator role assignment - [Okta_GroupMembershipAdmin](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_groupmembershipadmin.md): Group membership administrator role assignment - [Okta_GroupPull](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_grouppull.md): Import of group memberships from an external application - [Okta_GroupPush](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_grouppush.md): Provisioning of group memberships to an external application - [Okta_HasRole](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_hasrole.md): Assignment of a built-in or custom role to a principal - [Okta_HasRoleAssignment](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_hasroleassignment.md): Relationship between a principal and a role assignment - [Okta_HelpDeskAdmin](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_helpdeskadmin.md): Help desk administrator role assignment - [Okta_HostsAgent](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_hostsagent.md): Relationship between an AD server and the Okta agent running on that host - [Okta_IdentityProviderFor](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_identityproviderfor.md): Trust relationship between an identity provider and Okta users - [Okta_IdpGroupAssignment](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_idpgroupassignment.md): Identity provider group assignment to an Okta group - [Okta_InboundOrgSSO](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_inboundorgsso.md): Single sign-on from an external organization into Okta - [Okta_InboundSSO](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_inboundsso.md): Single sign-on from an external identity provider into Okta - [Okta_KerberosSSO](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_kerberossso.md): Agentless desktop SSO relationship from on-prem AD user account to Okta AD application - [Okta_KeyOf](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_keyof.md): JSON Web Key associated with an Okta application - [Okta_ManageApp](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_manageapp.md): Ability to manage scoped Okta applications - [Okta_ManagerOf](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_managerof.md): Manager relationship between Okta users - [Okta_MemberOf](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_memberof.md): Membership of a user in an Okta group - [Okta_MembershipSync](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_membershipsync.md): Bidirectional synchronization between Okta groups and external groups - [Okta_MobileAdmin](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_mobileadmin.md): Mobile administrator role assignment - [Okta_OrgAdmin](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_orgadmin.md): Organization administrator role assignment - [Okta_OrgSWA](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_orgswa.md): Secure Web Authentication from an Okta application to an external organization - [Okta_OutboundOrgSSO](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_outboundorgsso.md): Single sign-on from an Okta application to an external organization - [Okta_OutboundSSO](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_outboundsso.md): Single sign-on from Okta to an external identity provider - [Okta_PasswordSync](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_passwordsync.md): Password synchronization between user accounts via AD integration, Org2Org, or SCIM - [Okta_PolicyMapping](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_policymapping.md): Association of a policy with an Okta application - [Okta_ReadClientSecret](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_readclientsecret.md): Ability to read client secrets for scoped Okta applications - [Okta_ReadPasswordUpdates](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_readpasswordupdates.md): Application can read password updates over the SCIM protocol - [Okta_RealmContains](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_realmcontains.md): Contains relationship between an Okta realm and its users - [Okta_ResetFactors](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_resetfactors.md): Ability to reset MFA factors for scoped Okta users - [Okta_ResetPassword](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_resetpassword.md): Ability to reset passwords or temporary credentials for scoped Okta users - [Okta_ResourceSetContains](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_resourcesetcontains.md): Membership of objects within an Okta resource set - [Okta_ScopedTo](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_scopedto.md): Scope relationship between a role assignment and its target - [Okta_SecretOf](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_secretof.md): Client secret associated with an application or service integration - [Okta_SuperAdmin](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_superadmin.md): Super administrator role assignment - [Okta_SWA](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_swa.md): Secure Web Authentication from Okta to an external application - [Okta_UserPull](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_userpull.md): Import of users from an external application - [Okta_UserPush](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_userpush.md): Provisioning of users to an external application - [Okta_UserSync](https://bloodhound.specterops.io/opengraph/extensions/okta/edges/okta_usersync.md): Bidirectional synchronization between Okta users and external identities #### SCIM - [Overview](https://bloodhound.specterops.io/opengraph/extensions/scim/overview.md): Learn about the SCIM extension schema for BloodHound, representing SCIM-provisioned users, groups, and roles in the graph. - [Schema](https://bloodhound.specterops.io/opengraph/extensions/scim/schema.md): SCIM extension definition schema ##### Nodes - [SCIM_Group](https://bloodhound.specterops.io/opengraph/extensions/scim/nodes/scim_group.md): A group provisioned via SCIM - [SCIM_Organization](https://bloodhound.specterops.io/opengraph/extensions/scim/nodes/scim_organization.md): An organization or tenant in the IdP - [SCIM_Role](https://bloodhound.specterops.io/opengraph/extensions/scim/nodes/scim_role.md): A role assigned to users - [SCIM_User](https://bloodhound.specterops.io/opengraph/extensions/scim/nodes/scim_user.md): A user account provisioned via SCIM ##### Edges - [SCIM_Contains](https://bloodhound.specterops.io/opengraph/extensions/scim/edges/scim_contains.md): Organization contains a SCIM resource - [SCIM_HasRole](https://bloodhound.specterops.io/opengraph/extensions/scim/edges/scim_hasrole.md): User is assigned to a role - [SCIM_ManagerOf](https://bloodhound.specterops.io/opengraph/extensions/scim/edges/scim_managerof.md): User is a manager of another user - [SCIM_MemberOf](https://bloodhound.specterops.io/opengraph/extensions/scim/edges/scim_memberof.md): User or group is a member of a group - [SCIM_Provisioned](https://bloodhound.specterops.io/opengraph/extensions/scim/edges/scim_provisioned.md): SCIM resource is provisioned to a target system ### Build an Extension - [OpenGraph Graph Theory](https://bloodhound.specterops.io/opengraph/developer/graph-theory.md): Attack Graph Model Design Requirements and Examples - [Graph Definition](https://bloodhound.specterops.io/opengraph/developer/graph-definition.md): Define structured graph behavior for OpenGraph extensions with an extension definition schema. - [Custom Icons](https://bloodhound.specterops.io/opengraph/developer/custom-icons.md): Define custom icons and colors for OpenGraph node kinds. - [OpenGraph API](https://bloodhound.specterops.io/opengraph/developer/api.md): Information on how to use the OpenGraph API - [OpenGraph Best Practices](https://bloodhound.specterops.io/opengraph/developer/best-practices.md): Dos and don'ts for OpenGraph - [OpenGraph Community Incentive Program](https://bloodhound.specterops.io/opengraph/developer/ocip.md): Description of the OpenGraph Community Incentive Program (OCIP) and how to participate #### Graph Data - [Graph Data Overview](https://bloodhound.specterops.io/opengraph/developer/graph-data.md): Learn about the JSON structure and schema requirements for OpenGraph data payloads. - [OpenGraph Metadata](https://bloodhound.specterops.io/opengraph/developer/metadata.md): Learn how metadata influences ingestion and metrics behavior. - [OpenGraph Nodes](https://bloodhound.specterops.io/opengraph/developer/nodes.md): Define graph objects in your OpenGraph data payloads. - [OpenGraph Edges](https://bloodhound.specterops.io/opengraph/developer/edges.md): Define relationships between nodes in your OpenGraph data payloads.