SpecterOpsBHE Deprecated

Deprecated. Use the SpecterOps BloodHound Enterprise integration instead. Use the SpecterOpsBHE integration to retrieve attack path findings from BloodHound Enterprise to streamline incident creation and investigation.

Network Security · SpecterOpsBHE (Deprecated)

Details

IDSpecterOpsBHE
ProviderSpecterOps
CategoryNetwork Security
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.7444307

README

This integration enables automated retrieval of attack path findings from BloodHound into Cortex XSOAR, streamlining incident creation and investigation.
This integration was integrated and tested with version 1.0.0 of SpecterOpsBHE.

Configure SpecterOpsBHE in Cortex

Parameter Description Required
BloodHound Enterprise Domain BloodHound Enterprise Domain URL True
Token ID BloodHound Enterprise API token ID True
Token Key BloodHound Enterprise API token key True
Proxy URL Proxy server url False
Proxy URL Username Proxy server url username False
Proxy URL Password Proxy server url password False
Finding Environment The environment from which to fetch attack paths. Default is all. False
Finding Category The category of attack paths to fetch. Default is all. False
Fetch incidents Enable automatic fetching of attack path findings from BloodHound Enterprise. False
Incidents Fetch Interval The interval for fetching attack paths False
Incident type The incident type to assign to fetched attack path findings. Recommended: SpecterOpsBHE Attack Path. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

bhe-object-id-get

Fetches the object ID using the object name.

Base Command

bhe-object-id-get

Input

Argument Name Description Required
object_names The object name associated with object ID. Required

Context Output

Path Type Description
SpecterOpsBHE.Object.Status string The status of the object ID lookup (success or error).
SpecterOpsBHE.Object.Message string The message describing the result of the lookup.
SpecterOpsBHE.Object.ObjectID string The unique object ID of the found object.
SpecterOpsBHE.Object.ObjectName string The name of the object that was searched.

Command Example

!bhe-object-id-get object_names=”OBJECTNAME@example.com”

Human Readable Output

Object Name Status Message Object ID
OBJECTNAME@example.com success Object ID found. 12345678-1234-1234-1234-123456789abc

bhe-asset-info-get

Fetches asset information using the object ID.

Base Command

bhe-asset-info-get

Input

Argument Name Description Required
object_ids The object ID to fetch asset information. Required

Context Output

Path Type Description
SpecterOpsBHE.Asset.Status string The status of the asset information fetch (success or error).
SpecterOpsBHE.Asset.Message string The message describing the result of the asset information fetch.
SpecterOpsBHE.Asset.ObjectID string The object ID for which asset information was fetched.
SpecterOpsBHE.Asset.Data json The raw asset data containing all asset information fields (name, type, objectid, domain, enabled, email, and other properties).

Command Example

!bhe-asset-info-get object_ids=”12345678-1234-1234-1234-123456789abc,87654321-4321-4321-4321-cba987654321”

Human Readable Output

Object ID Status Message Raw Data
12345678-1234-1234-1234-123456789abc success Asset information retrieved successfully. {
 “name”: “OBJECTNAME@example.com”,
 “type”: “User”,
 “objectid”: “12345678-1234-1234-1234-123456789abc”,
 “domain”: “example.com”,
 “enabled”: true
}

bhe-path-exist

Checks if a path exists between the two nodes.

Base Command

bhe-path-exist

Input

Argument Name Description Required
from_principal The start node. Optional
to_principal The end node. Optional

Context Output

Path Type Description
SpecterOpsBHE.Path.FromPrincipal string The start node (from principal) used in the path check.
SpecterOpsBHE.Path.ToPrincipal string The end node (to principal) used in the path check.
SpecterOpsBHE.Path.Status string The status of the path check (success or error).
SpecterOpsBHE.Path.Message string The message describing the result of the path check.
SpecterOpsBHE.Path.Data Boolean Whether a path exists between the nodes (True or False).

Command Example

!bhe-path-exist from_principal=”12345678-1234-1234-1234-123456789abc” to_principal=”87654321-4321-4321-4321-cba987654321”

Human Readable Output

From Principal To Principal Status Message Path Exists
12345678-1234-1234-1234-123456789abc 87654321-4321-4321-4321-cba987654321 success Path exists between nodes. True

Configuration parameters

  • url — BloodHound Enterprise Domain (required)
  • token_id — Token ID (required)
  • token_key — Token Key (required)
  • proxy_url — Proxy URL
  • proxy_username — Proxy URL Username
  • proxy_password — Proxy URL Password
  • finding_domain — Finding Environment
  • finding_category — Finding Category
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type

Commands (3)

  • bhe-asset-info-get

    Fetches asset information using the object ID.

  • bhe-object-id-get

    Fetches the object ID using the object name.

  • bhe-path-exist

    Checks if a path exists between the two nodes.

Source

SpecterOpsBHE.py SpecterOpsBHE_test.py SpecterOpsBHE.yml SpecterOpsBHE_description.md command_examples.txt
Download History Raw 
name: SpecterOpsBHE
display: SpecterOpsBHE
sectionorder:
- Connect
- Collect
commonfields:
  id: SpecterOpsBHE
  version: -1
provider: SpecterOps
category: Network Security
deprecated: true
description: Deprecated. Use the SpecterOps BloodHound Enterprise integration instead. Use the SpecterOpsBHE integration to retrieve attack path findings from BloodHound Enterprise to streamline incident creation and investigation.
detaileddescription: BloodHound Enterprise reduces risk in Active Directory and Microsoft Azure environments by continuously identifying and quantifying attack paths that attackers use to escalate privileges. The SpecterOpsBHE integration automatically ingests attack path findings from BloodHound Enterprise into Cortex XSOAR, streamlining incident creation and investigation. Configure the integration by providing your BloodHound Enterprise domain, API token ID and key, and optionally configure proxy settings and finding filters. Enable incident fetching to automatically retrieve attack paths at your specified interval.
configuration:
- display: BloodHound Enterprise Domain
  name: url
  type: 0
  required: true
  additionalinfo: BloodHound Enterprise Domain URL
  section: Connect
- section: Connect
  display: Token ID
  displaypassword: Token Key
  name: token_id
  type: 0
  required: true
  additionalinfo: BloodHound Enterprise API token ID
- display: Token Key
  name: token_key
  type: 4
  required: true
  additionalinfo: BloodHound Enterprise API token key
  section: Connect
- display: Proxy URL
  name: proxy_url
  type: 0
  required: false
  section: Connect
- display: Proxy URL Username
  name: proxy_username
  type: 0
  required: false
  section: Connect
- display: Proxy URL Password
  name: proxy_password
  type: 4
  required: false
  section: Connect
- display: Finding Environment
  name: finding_domain
  defaultvalue: all
  type: 0
  required: false
  additionalinfo: The environment from which to fetch attack paths. Default is all.
  section: Collect
- display: Finding Category
  name: finding_category
  defaultvalue: all
  type: 0
  required: false
  additionalinfo: The category of attack paths to fetch. Default is all.
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "10"
  type: 19
  required: false
  additionalinfo: The interval for fetching attack paths
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
script:
  script: ''
  commands:
  - name: bhe-object-id-get
    arguments:
    - name: object_names
      required: true
      description: The object name associated with object ID.
      isArray: true
    outputs:
    - contextPath: SpecterOpsBHE.Object.Status
      description: The status of the object ID lookup (success or error).
      type: string
    - contextPath: SpecterOpsBHE.Object.Message
      description: The message describing the result of the lookup.
      type: string
    - contextPath: SpecterOpsBHE.Object.ObjectID
      description: The unique object ID of the found object.
      type: string
    - contextPath: 'SpecterOpsBHE.Object.ObjectName'
      description: The name of the object that was searched.
      type: string
    description: Fetches the object ID using the object name.
  - name: bhe-asset-info-get
    arguments:
    - name: object_ids
      required: true
      description: The object ID to fetch asset information.
      isArray: true
    outputs:
    - contextPath: SpecterOpsBHE.Asset.Status
      description: The status of the asset information fetch (success or error).
      type: string
    - contextPath: SpecterOpsBHE.Asset.Message
      description: The message describing the result of the asset information fetch.
      type: string
    - contextPath: SpecterOpsBHE.Asset.ObjectID
      description: The object ID for which asset information was fetched.
      type: string
    - contextPath: SpecterOpsBHE.Asset.Data
      description: The raw asset data containing all asset information fields (name, type, objectid, domain, enabled, email, and other properties).
      type: unknown
    description: Fetches asset information using the object ID.
  - name: bhe-path-exist
    arguments:
    - name: from_principal
      description: The start node.
    - name: to_principal
      description: The end node.
    outputs:
    - contextPath: SpecterOpsBHE.Path.FromPrincipal
      description: The start node (from principal) used in the path check.
      type: String
    - contextPath: SpecterOpsBHE.Path.ToPrincipal
      description: The end node (to principal) used in the path check.
      type: String
    - contextPath: SpecterOpsBHE.Path.Status
      description: The status of the path check (success or error).
      type: String
    - contextPath: SpecterOpsBHE.Path.Message
      description: The message describing the result of the path check.
      type: String
    - contextPath: SpecterOpsBHE.Path.Data
      description: Whether a path exists between the nodes (True or False).
      type: Boolean
    description: Checks if a path exists between the two nodes.
  type: python
  dockerimage: demisto/python3:3.12.13.7444307
  subtype: python3
  isfetch: true
  runonce: false
  isFetchSamples: true
fromversion: 6.10.0
tests:
- No tests (auto formatted)