Details

ID	`BloodHoundEnterprise`
Provider	Specter Ops Inc
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/python3:3.12.11.4819260`
Supported Modules	XSIAM

README

BloodHound Enterprise Integration for Cortex XSIAM

Use this integration to fetch audit logs from BloodHound Enterprise as events in Cortex XSIAM.
This integration was integrated and tested with version 1.0.0 of BloodHound Enterprise.

Configure BloodHound Enterprise on Cortex XSIAM

Navigate to Settings > Configurations > Automation & Feed Integrations.
Search for BloodHoundEnterprise.

Click Add instance to create and configure a new integration instance.

Parameter	Required	Description
Server URL	Yes	The URL of your BloodHound Enterprise server.
API Token ID	Yes	The ID associated with the API Token Key.
API Token Key	Yes	The key used for authentication with the BloodHound Enterprise API.
Fetch events	No	Enable this to fetch events automatically.
Maximum number of events per fetch	No	Limits the number of events fetched in each cycle. Default is 5000.
Trust any certificate (not secure)	No	Allow the integration to trust any SSL certificate, even if it’s not secure.
Use system proxy settings	No	Use the system’s proxy configuration for connecting to the server.

Click Test to validate the connection using the provided details.

Note

This API can be run only with ADMIN privileges.

Commands

The following commands can be executed from the Cortex XSIAM CLI, as part of an automation, or in a playbook.
Each command returns relevant information that you can use for further analysis or alerting.

bloodhound-get-events

Retrieves events from BloodHound Enterprise based on the specified date range.
This command allows you to monitor and analyze recent events directly from the Cortex XSIAM interface.

Base Command

bloodhound-get-events

Input

Argument Name	Description	Required
start	The start date for filtering events. Use ISO 8601 format (e.g., 2024-07-10T08:08:46Z). Default is one minute back	No
end	The end date for filtering events. Use ISO 8601 format (e.g., 2024-07-11T08:09:47Z). Default is current time	No
should_push_events	Set to `true` to create events in Cortex XSIAM; `false` will only display them.	No
limit	The maximum number of events to return. Default is 10.	No

Example Usage

```shell
!bloodhound-get-events start=”2024-07-10T08:00:00Z” end=”2024-07-11T08:00:00Z” limit=100 should_push_events=true

Configuration parameters

server_url — Server URL (e.g., https://example.bloodhoundenterprise.io) (required)
client — API Token ID (required)
max_events_per_fetch — Maximum number of events per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

bloodhound-get-events
Gets events from BloodHound Enterprise.

Source

BloodHoundEnterprise.py BloodHoundEnterprise_test.py BloodHoundEnterprise.yml BloodHoundEnterprise_description.md command_examples.txt

Download History Raw

name: BloodHoundEnterprise
display: BloodHoundEnterprise
category: Analytics & SIEM
provider: Specter Ops Inc
sectionorder:
- Connect
- Collect
commonfields:
  id: BloodHoundEnterprise
  version: -1
configuration:
- display: Server URL (e.g., https://example.bloodhoundenterprise.io)
  additionalinfo: The hostname of the server from which to fetch events. With the "https://" part.
  name: server_url
  required: true
  type: 0
  section: Connect
- display: API Token ID
  additionalinfo: The password for the client application. This is used to authenticate the client with the BloodHound Enterprise server.
  displaypassword: API Token Key
  name: client
  required: true
  type: 9
  section: Connect
- defaultvalue: 5000
  section: Collect
  advanced: true
  display: Maximum number of events per fetch
  name: max_events_per_fetch
  required: false
  type: 0
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
description: Deprecated. Use the SpecterOps BloodHound Enterprise integration instead. Use this integration to fetch audit logs from BloodHound Enterprise as events in Cortex XSIAM.
deprecated: true
script:
  commands:
  - arguments:
    - description: The start date from which to filter events (e.g., 2024-07-10T08:08:46.76).
      name: start_date
      required: false
    - description: The end date from which to filter events (e.g., 2024-07-11T08:09:47.08).
      name: end_date
      required: false
    - description: Set this argument to True in order to create events, otherwise the command will only display them.  
      name: should_push_events  
      predefined:  
      - 'true'  
      - 'false'  
      required: false  
      auto: PREDEFINED  
    - description: The number of events to return. Default is 10.
      name: limit
      required: false
    description: Gets events from BloodHound Enterprise.
    name: bloodhound-get-events
  dockerimage: demisto/python3:3.12.11.4819260
  isfetchevents: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 8.4.0
supportlevelheader: xsoar
tests:
- No tests (auto formatted)
supportedModules:
- xsiam

BloodHoundEnterprise Deprecated