Skip to main content

Documentation Index

Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt

Use this file to discover all available pages before exploring further.

Applies to BloodHound Enterprise only Get started with your BloodHound Enterprise instance and start identifying and remediating security risks.

​
Prerequisites

To complete this quickstart, you must have a BloodHound Enterprise instance. To connect with the SpecterOps team and receive an instance, request a demo of BloodHound Enterprise.

​
Get data into BloodHound

BloodHound Enterprise supports multiple data collection paths. Use the path that matches the directories and platforms you want to analyze:
  • Active Directory, collected by SharpHound Enterprise
  • Entra ID (formerly Azure AD) and Azure IaaS, collected by AzureHound Enterprise
  • Github, Jamf, and Okta, collected by OpenHound for BloodHound Enterprise
You can run the two services from the same Windows system. AzureHound Enterprise also supports Docker and Kubernetes.
Use OpenHound for built-in collectors and workflows for platforms like GitHub, Jamf, and Okta. For additional community-built collectors, explore the OpenGraph Library.

​
Ingest with SharpHound Enterprise (Active Directory)

SharpHound Enterprise collects multiple data types from Active Directory and its domain-joined systems. We recommend collecting all types for full risk identification and accurate risk assessment calculation.
Install the SharpHound Enterprise collector service on a domain-joined Windows system and run it as an Active Directory account.
  1. Review the SharpHound Enterprise System Requirements and SharpHound Service Hardening Guidelines.
  2. Install and Upgrade SharpHound Enterprise.
  3. To fully secure a domain, collect data from all other domains with a trust relationship to it (in- and outgoing trust). Configure SharpHound Enterprise for Cross-Trust Collection.

​
Ingest with AzureHound Enterprise (Entra ID and Azure)

Install and run the AzureHound Enterprise collector service on Windows, Docker, or Kubernetes.
  1. Review the AzureHound Enterprise System Requirements and Deployment Process.
  2. Configure Azure.
  3. Create your AzureHound configuration.
  4. Deploy and maintain AzureHound.

​
Ingest with OpenHound (Github, Jamf, and Okta)

OpenHound for BloodHound Enterprise runs as a containerized service and is complementary to SharpHound Enterprise and AzureHound Enterprise.
This is a SpecterOps-managed feature. If it is not enabled in your environment, contact your account team for assistance.
  1. Review the OpenHound for BloodHound Enterprise configuration requirements.
  2. Create an OpenHound collector client to get API credentials.
  3. Configure the OpenHound collector you want to run:
  4. Deploy OpenHound in your environment and run an on-demand scan or scheduled collection.

​
Verify data quality

After collecting data, to verify data quality:
  1. Go to settings (⚙️) → Administration and select Data Quality.
  2. Verify that each collector has collected the expected amount of data and that principal types match your expected coverage for each directory and platform.
  3. If using privileged collection, verify that the charts Local Group Completeness Over Time and Session Completeness Over Time report higher than 0%. Obtaining 100% completeness is not possible in most environments due to things like workstations being offline during collection.
  4. If you see lower-than-expected data quality examine the data collection logs and contact your SpecterOps representative if you need assistance.

​
Scope Tier Zero objects

BloodHound Enterprise identifies and prioritizes attack paths. To get the most accurate assessment scope your Tier Zero objects.
  1. Scope Tier Zero for your environment.
  2. Mark your environment’s Tier Zero objects in BloodHound.

​
Grant users access

Your BloodHound Enterprise instance has a few administrative users by default. To bring your team into your instance, grant your team access with dedicated users and roles. To grant users access to your instance, create users and set access control roles. BloodHound Enterprise supports two authentication methods for users: Your default users are configured with built-in authentication. For your team, you can also configure SAML authentication.
Enable multi-factor authentication for all users, no matter the authentication method and user role. If using SAML authentication, your connected identity provider will handle multi-factor authentication.

​
Explore and remediate attack paths

Go to the Attack Paths, Explore, and Posture pages to see identified attack paths, prioritization, and recommended mitigations.

​
Next steps