Extension bundles
An extension bundle packages an OpenGraph extension’s schema with supported components, such as saved queries and Privilege Zone rules.Administrators can install an extension with a single file and have all the necessary components put in the correct place for a streamlined installation experience.- Administrators: Upload a bundle to install an extension and its supported components together.
- Users: Explore extension data using its saved queries and apply its Privilege Zone rules.
- Extension developers: Learn how to package an extension’s schema and supported components for administrators to install together.
Collect Azure VM IDs from Windows computers
Correlate domain-joined Windows computers with their Azure VM identity using the Azure guest VM ID (VmId).When AzureRegistry collection is enabled, SharpHound reads the ID from domain-joined Windows computers and stores it in the Active Directory computer’s azvmid property.Faster object searches
The/api/v2/search endpoint now matches objectid values exactly, including uppercase and lowercase variants, while name searches remain fuzzy.It passes the requested result limit to the graph database for domain lookups and honors the limit when results are filtered by Environment Targeted Access Control (ETAC).These changes improve search performance, especially on the Explore page, and reduce unnecessary work on large result sets.Accurate audit log counts for date ranges
The/api/v2/audit endpoint now applies the requested date range (including its documented 365-day default) to both the returned events and the count, so pagination totals match the results.It also returns HTTP 400 when the
after value is later than the before value.Distinguish non-traversable graph edges
Easily distinguish between traversable and non-traversable edges in the graph.The graph on the Explore page now uses dashed lines for non-traversable edges, making it easier to distinguish them from edges that can be traversed.Additional PostgreSQL storage optimization
The Optimize stage of the data pipeline now includes additional PostgreSQL storage optimization steps.These steps help reclaim index bloat and keep graph query performance consistent over time.Analysis performance improvements
All post-processed edges now use optimized processing logic, significantly reducing time in analysis and improving overall performance.Post-processed edges no longer display the Last Seen by BloodHound field in Entity panels.
Control graph direction and spacing
Choose whether the graph on the Explore page flows left, right, up, or down, and adjust horizontal and vertical spacing.These new controls help you arrange complex graphs so their relationships are easier to inspect.Findings Prioritization improvements
Findings Prioritization now considers proximity to Tier Zero alongside exposure, impact, and starting objects. Findings targeting objects in or near Tier Zero receive a stronger priority signal, helping you identify larger remediation opportunities.During analysis, BloodHound Enterprise uses a synthetic Zone node to calculate the shortest traversable path from each finding’s target to Tier Zero. Findings without a path to Tier Zero (or with a path beyond the maximum traversal depth) use a maximum-hop fallback and are de-prioritized.Export Findings Table results
Export findings to a CSV file, including all findings that match the current filters and sort order (up to 200,000 findings).When Findings Prioritization is enabled, the export also includes the prioritization score and rank.
Identify new findings
The Findings Table marks findings added in the past 24 hours with a New badge, helping you spot recently surfaced results during triage.Faster ingest reconciliation
Updated the node-table trigger that cascade-deletes edges connected to a deleted node to use index scans instead of table scans.This reduces database work during ingest reconciliation and helps maintain ingest throughput.Fixed issues
Fixed Issues
Search and performance
-
Resolved an issue where a second
OPTIONAL MATCHclause could be treated as required, causing Cypher queries to omit expected results. - Resolved an issue where parallel graph path processing could corrupt path segment sizes.
Findings Table
- Resolved an issue where finding types with only remediated findings were missing from the filter options.
- Resolved an issue where findings filter dropdown text and hover styling appeared incorrectly in light mode and the cell hover effect was missing in dark mode.