Skip to main content

Documentation Index

Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt

Use this file to discover all available pages before exploring further.

Applies to BloodHound Enterprise and CE The metadata object defines payload-wide ingest behavior. One of its primary uses is registering a source_kind, which facilitates organizing and managing graph data by source. 
{
  "metadata": {
    "source_kind": "GitHub"
  },
  "graph": {
    "nodes": [],
    "edges": []
  }
}
The metadata object is optional for both and .
​
metadata
object
Optional top-level metadata object that configures payload-wide ingest behavior.The metadata object accepts only source_kind. Any other fields cause validation errors.
​
source_kind
string
Source system label used to register a source kind and apply it to all nodes in a data payload. During ingestion, BloodHound appends this value to each node’s kinds array.You can register a source_kind through the metadata object or through the extension definition schema. Once registered, BloodHound reuses it for subsequent uploads with the same node kinds, even if the payload omits metadata.source_kind.

​
Schema

Use the following JSON schema for validation requirements. 
{
    "title": "Metadata",
    "description": "Optional metadata about the ingest payload",
    "type": "object",
    "properties": {
        "source_kind": {
            "type": ["string","null"]
        }
    },
    "additionalProperties": false
}

​
Troubleshooting

  • source_kind does not appear in expected nodes: Verify that metadata is at the top level of the data payload and not nested under graph.
  • Unexpected kind labels after ingest: Confirm that your source_kind value is intentional because metadata.source_kind appends it to every node in the data payload.