Applies to BloodHound Enterprise and CE

Introduction

This page collects best practices for creating graph extensions and tooling for OpenGraph.

Creating a new OpenGraph extension

Elements of a Complete Submission

This section lists the elements that are mandatory and nice-to-have in an OpenGraph extension submission.

Mandatory

  1. A Collector/Hound
    • A script that collects all information needed to populate the graph
    • The collector should create JSON that can be uploaded to BloodHound
  2. Documentation on
    • Minimum system requirements to run the tool
      • OS
      • Software
      • Resources
    • How to install the collector
    • How to use the collector
      • Minimum permissions needed to collect the information
        • As a privileged user
        • As an unprivileged user
      • Command line options/switches
        • Examples of running the tool from the command line

Nice to Have

  1. Nodes and Edges Documentation (online)
    • Hosted wiki (e.g., GitHub) or
    • Markdown file in the repository
    • List of relevant information to document
      • General
      • Abuse Info
      • Remediation Info
      • OPSEC
      • References
      • Other fields as applicable
  2. Optional API upload
    • Ability to upload the JSON output to a BloodHound instance via the API without user interaction
  3. Cypher Queries “Starter Pack”
    • Cypher Queries to help new users explore the new elements introduced to the Graph
    • Should be in the Custom Query JSON format for easy ingestion
  4. Icon Definition Pack
    • Including a script to upload them. See example
      • You can use a Bearer Token instead of API key as this script will typically run only once.
      • Do not hardcode credentials; use place holder for users to modify.
  5. Arrows.app diagram illustrating nodes and attack paths between them