Skip to main content
Applies to BloodHound Enterprise and CE Privilege Zones help you define the boundaries that matter most in your environment so you can understand who can reach them, how they can be reached, and where that access violates your security model. For many teams, Tier Zero is the starting point because it contains the identities, systems, and permissions that can control the broader environment. BloodHound includes a default Tier Zero zone so you can begin reducing attack paths to those assets. Most organizations do not stop at Tier Zero. Some teams extend a traditional tiering model. Others protect a critical application, regulated environment, business unit boundary, source code system, or endpoint management platform. Privilege Zones give teams a flexible way to model those priorities inside BloodHound and analyze attack paths into them.

​
Use cases

Use Privilege Zones to turn security priorities into visible attack path boundaries. Some zones become a durable part of your operating model. Others support a specific remediation campaign, audit response, or focused investigation. Start with the use case that matches your goal:

Plan Attack Path Management

Expand beyond Tier Zero by choosing the next protected boundary.

Extend a Traditional Tiering Model

Test whether administrative tier boundaries hold up against real attack paths.

Protect Critical Applications and Environments

Model critical applications and regulated environments as protected boundaries.

Run Remediation Campaigns

Create bounded remediation work with clear scope, ownership, and progress tracking.

Protect GitHub Repositories

Treat high-impact repositories, workflows, and deployment paths as protected boundaries.

Protect Jamf Administration

Analyze endpoint administration paths into sensitive managed Mac environments.
BloodHound Community Edition includes the default Tier Zero zone. Custom zones for these use cases are available in BloodHound Enterprise.

​
Key concepts

The Zone Builder page provides tools for configuring and managing your Privilege Zones. Review the following key concepts to understand how Privilege Zones work and how to use them effectively: Zones organize objects into a strict hierarchy. BloodHound analyzes how object privileges are assigned and where they can be escalated across your environment. By default, BloodHound includes a Tier Zero zone that represents a set of objects with full control over an environment and any objects with control over those objects. See Tier Zero: Members and Modification to learn more.
BloodHound Enterprise customers can create additional zones to match their organization’s security model. However, analyzing them requires the Privilege Zone Analysis feature (available for purchase). For more information, contact your sales representative.
If BloodHound Enterprise detects an object in a lower-privileged zone controlling an object in a higher-privileged zone, it identifies it as a finding in the Attack Paths and Posture pages. For example, if a Tier One user can control a Tier Zero server, BloodHound flags it as a violation of the privilege model. This analysis helps you identify and remediate privilege escalation paths and misconfigurations that violate your security model.

​
Object membership

Before working with Privilege Zones, it’s important to understand how BloodHound assigns objects to zones and labels through the analysis process.
  • Object membership requires rule matching: Objects are only assigned to a zone or label if they match at least one of the zone’s or label’s rules
  • Zone membership is exclusive to the highest-priority zone: If multiple zone rules match an object, BloodHound assigns it to the highest-priority zone only
  • Objects can have multiple labels: Unlike zones, an object can match multiple label rules simultaneously
Most changes to Privilege Zones affect object membership and require analysis to run before you can validate the results. Understanding when you can expect to see results helps you maintain your configuration and validate remediation efforts. For Cypher-based rules, validation happens in two stages. First, rerun the query in the rule editor after you change it so BloodHound can validate the updated rule definition. After you save the rule, BloodHound runs analysis before updated zone or label membership appears elsewhere in the product.
Applies to BloodHound Enterprise onlyBloodHound Enterprise can complete analysis for Privilege Zone changes faster with Variable Analysis Mode because it starts at the Tagging stage instead of running the full analysis pipeline.Scheduled analysis (a SpecterOps-managed feature) always runs a full analysis.

​
Workflow

The following steps represent the general workflow for making changes and validating the results:
1

Configure settings

Make any necessary changes to your zones, labels, and rules on the Zone Builder page.
2

Save changes

Save your configuration changes to automatically trigger analysis for any settings that affect object membership.All changes that affect object membership require analysis to run before you can validate the results. Actions that require analysis include:
  • Creating a new zone or label with a rule definition
  • Creating, editing, or deleting a rule definition for an existing zone or label
  • Editing the details of a zone or label that has a rule definition
  • Deleting a zone or label that has a rule definition
3

Wait for analysis to complete

Check your tenant status to monitor analysis progress. During analysis, BloodHound re-evaluates object membership against the updated configuration.
Analysis may take several minutes to complete depending on the size of your environment. BloodHound Enterprise customers can enable Variable Analysis Mode to potentially speed up analysis for Privilege Zone changes.Until analysis finishes, the Zone Builder Details View and related metrics will not reflect your latest changes.
4

Validate the results

Validate that your configuration changes have the expected results:
  1. Navigate to the Zone Builder page and verify that the expected objects are now included in (or excluded from) the relevant zones and labels.
  2. Review the Attack Paths and Posture pages for new findings or changes in existing findings related to the updated zones and labels.

​
Common issues

I created a new zone rule but don’t see any objects in the zone.
  • Analysis may still be running. Wait for it to complete before checking zone membership.
  • The rule may not match any objects. Review the rule definition and test with known objects.
  • Multiple zone rules may match the same objects. Check if another zone with higher priority is taking precedence for those objects.
I updated a zone rule but don’t see any changes. Analysis is required for rule updates to take effect. Check the analysis status and wait for completion. I deleted a zone rule and objects are still showing in the zone.
  • Other rules in the same zone may still match those objects. To see which rules are tagging a specific object, use the object-based search method.
  • Analysis may still be running. Wait for completion to see the final result.