BloodHoundEnterprise Deprecated

Deprecated. Use the SpecterOps BloodHound Enterprise integration instead. Use this integration to fetch audit logs from BloodHound Enterprise as events in Cortex XSIAM.

Analytics & SIEM · BloodHound Enterprise (Deprecated)

Details

ID	`BloodHoundEnterprise`
Provider	Specter Ops Inc
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/python3:3.12.11.4819260`
Supported Modules	XSIAM

README

BloodHound Enterprise Integration for Cortex XSIAM

Use this integration to fetch audit logs from BloodHound Enterprise as events in Cortex XSIAM.
This integration was integrated and tested with version 1.0.0 of BloodHound Enterprise.

Configure BloodHound Enterprise on Cortex XSIAM

Navigate to Settings > Configurations > Automation & Feed Integrations.
Search for BloodHoundEnterprise.

Click Add instance to create and configure a new integration instance.

Parameter	Required	Description
Server URL	Yes	The URL of your BloodHound Enterprise server.
API Token ID	Yes	The ID associated with the API Token Key.
API Token Key	Yes	The key used for authentication with the BloodHound Enterprise API.
Fetch events	No	Enable this to fetch events automatically.
Maximum number of events per fetch	No	Limits the number of events fetched in each cycle. Default is 5000.
Trust any certificate (not secure)	No	Allow the integration to trust any SSL certificate, even if it’s not secure.
Use system proxy settings	No	Use the system’s proxy configuration for connecting to the server.

Click Test to validate the connection using the provided details.

Note

This API can be run only with ADMIN privileges.

Commands

The following commands can be executed from the Cortex XSIAM CLI, as part of an automation, or in a playbook.
Each command returns relevant information that you can use for further analysis or alerting.

bloodhound-get-events

Retrieves events from BloodHound Enterprise based on the specified date range.
This command allows you to monitor and analyze recent events directly from the Cortex XSIAM interface.

Base Command

bloodhound-get-events

Input

Argument Name	Description	Required
start	The start date for filtering events. Use ISO 8601 format (e.g., 2024-07-10T08:08:46Z). Default is one minute back	No
end	The end date for filtering events. Use ISO 8601 format (e.g., 2024-07-11T08:09:47Z). Default is current time	No
should_push_events	Set to `true` to create events in Cortex XSIAM; `false` will only display them.	No
limit	The maximum number of events to return. Default is 10.	No

Example Usage

```shell
!bloodhound-get-events start=”2024-07-10T08:00:00Z” end=”2024-07-11T08:00:00Z” limit=100 should_push_events=true

Configuration parameters

server_url — Server URL (e.g., https://example.bloodhoundenterprise.io) (required)
client — API Token ID (required)
max_events_per_fetch — Maximum number of events per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

bloodhound-get-events
Gets events from BloodHound Enterprise.

Source

BloodHoundEnterprise.py BloodHoundEnterprise_test.py BloodHoundEnterprise.yml BloodHoundEnterprise_description.md command_examples.txt

Download History Raw

# BloodHound Enterprise Event Collector

Use this integration to fetch audit logs from **BloodHound** as events in Cortex XSIAM.

_____
## Creating an API Client in BloodHound Enterprise
Before you configure the integration, retrieve the API Token ID and API Token Key from your BloodHound Enterprise environment:

1. You need to generate a personal API Token ID/Key pair in your BloodHound Enterprise account settings. For more information click [here](https://support.bloodhoundenterprise.io/hc/en-us/articles/11311053342619-Working-with-the-BloodHound-API#h_01HQBFQX7EE8SZHPPFF0KMQ6NG:~:text=Create%20a%20personal%20API%20Key/ID%20pair). (navigate to the "Create a personal API Key/ID pair" section).
2. Copy the API Token ID and API Token Key into the integration configuration.

## Note:
    This API can be run only with ADMIN privileges.