Introduction
This page collects best practices for creating graph extensions and tooling for OpenGraph.Creating a new OpenGraph extension
Elements of a Complete Submission
This section lists the elements that are mandatory and nice-to-have in an OpenGraph extension submission.Mandatory
-
A Collector/Hound
- A script that collects all information needed to populate the graph
- The collector should create JSON that can be uploaded to BloodHound
-
Documentation on
- Minimum system requirements to run the tool
- OS
- Software
- Resources
- How to install the collector
- How to use the collector
- Minimum permissions needed to collect the information
- As a privileged user
- As an unprivileged user
- Command line options/switches
- Examples of running the tool from the command line
- Minimum permissions needed to collect the information
- Minimum system requirements to run the tool
Nice to Have
-
Nodes and Edges Documentation (online)
- Hosted wiki (e.g., GitHub) or
- Markdown file in the repository
- List of relevant information to document
- General
- Abuse Info
- Remediation Info
- OPSEC
- References
- Other fields as applicable
- Optional API upload
-
Cypher Queries “Starter Pack”
- Cypher Queries to help new users explore the new elements introduced to the Graph
- Should be in the Custom Query JSON format for easy ingestion
-
Icon Definition Pack
- Including a script to upload them. See example
- You can use a Bearer Token instead of API key as this script will typically run only once.
- Do not hardcode credentials; use place holder for users to modify.
- Including a script to upload them. See example
- Arrows.app diagram illustrating nodes and attack paths between them