SpecterOpsBloodHoundEnterprise

Use the SpecterOpsBloodHoundEnterprise integration to retrieve attack path findings from BloodHound Enterprise to streamline incident creation and investigation.

Vulnerability Management · SpecterOps BloodHound Enterprise

Details

IDSpecterOpsBloodHoundEnterprise
ProviderSpecterOps
CategoryVulnerability Management
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658

README

This integration enables automated retrieval of attack path findings from BloodHound into Cortex XSOAR, streamlining incident creation and investigation.
This integration was integrated and tested with version 1.0.0 of SpecterOps BloodHound Enterprise.

Configure SpecterOps BloodHound Enterprise in Cortex

Parameter Description Required
BloodHound Enterprise Domain BloodHound Enterprise Domain URL True
Token ID / Token Key BloodHound Enterprise API token ID and key True
Proxy URL Proxy server url False
Proxy URL Username Proxy server url username False
Proxy URL Password Proxy server url password False
Finding Environment The environment from which to fetch attack paths. Default is all. False
Finding Category The category of attack paths to fetch. Default is all. False
Fetch incidents Enable automatic fetching of attack path findings from BloodHound Enterprise. False
Incidents Fetch Interval The interval for fetching attack paths False
Incident type The incident type to assign to fetched attack path findings. Recommended: SpecterOps BloodHound Enterprise Attack Path. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

bloodhound-object-id-get

Fetches the object ID using the object name.

Base Command

bloodhound-object-id-get

Input

Argument Name Description Required
object_names The object name associated with object ID. Required

Context Output

Path Type Description
SpecterOpsBloodHoundEnterprise.Object.Status string The status of the object ID lookup (success or error).
SpecterOpsBloodHoundEnterprise.Object.Message string The message describing the result of the lookup.
SpecterOpsBloodHoundEnterprise.Object.ObjectID string The unique object ID of the found object.
SpecterOpsBloodHoundEnterprise.Object.ObjectName string The name of the object that was searched.

Command Example

!bloodhound-object-id-get object_names="OBJECTNAME@example.com"

Human Readable Output

Object Name Status Message Object ID
OBJECTNAME@example.com success Object ID found. 12345678-1234-1234-1234-123456789abc

bloodhound-asset-info-get

Fetches asset information using the object ID.

Base Command

bloodhound-asset-info-get

Input

Argument Name Description Required
object_ids The object ID to fetch asset information. Required

Context Output

Path Type Description
SpecterOpsBloodHoundEnterprise.Asset.Status string The status of the asset information fetch (success or error).
SpecterOpsBloodHoundEnterprise.Asset.Message string The message describing the result of the asset information fetch.
SpecterOpsBloodHoundEnterprise.Asset.ObjectID string The object ID for which asset information was fetched.
SpecterOpsBloodHoundEnterprise.Asset.Data json The raw asset data containing all asset information fields (name, type, objectid, domain, enabled, email, and other properties).

Command Example

!bloodhound-asset-info-get object_ids="12345678-1234-1234-1234-123456789abc,87654321-4321-4321-4321-cba987654321"

Human Readable Output

Object ID Status Message Raw Data
12345678-1234-1234-1234-123456789abc success Asset information retrieved successfully. {"name": "OBJECTNAME@example.com", "type": "User", "objectid": "12345678-1234-1234-1234-123456789abc", "domain": "example.com", "enabled": true}

bloodhound-path-exist

Checks if a path exists between the two nodes.

Base Command

bloodhound-path-exist

Input

Argument Name Description Required
from_principal The start node. Optional
to_principal The end node. Optional

Context Output

Path Type Description
SpecterOpsBloodHoundEnterprise.Path.FromPrincipal string The start node (from principal) used in the path check.
SpecterOpsBloodHoundEnterprise.Path.ToPrincipal string The end node (to principal) used in the path check.
SpecterOpsBloodHoundEnterprise.Path.Status string The status of the path check (success or error).
SpecterOpsBloodHoundEnterprise.Path.Message string The message describing the result of the path check.
SpecterOpsBloodHoundEnterprise.Path.Data Boolean Whether a path exists between the nodes (True or False).

Command Example

!bloodhound-path-exist from_principal="12345678-1234-1234-1234-123456789abc" to_principal="87654321-4321-4321-4321-cba987654321"

Human Readable Output

From Principal To Principal Status Message Path Exists
12345678-1234-1234-1234-123456789abc 87654321-4321-4321-4321-cba987654321 success Path exists between nodes. True

<~PLATFORM>

License Requirements

The following configuration parameters require one of these licenses: Cortex XSIAM or Agentix:

  • Fetch incidents

</~PLATFORM>

Configuration parameters

  • url — BloodHound Enterprise Domain (required)
  • credentials — Token ID (required)
  • proxy_url — Proxy URL
  • proxy_username — Proxy URL Username
  • proxy_password — Proxy URL Password
  • finding_domain — Finding Environment
  • finding_category — Finding Category
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type

Commands (3)

  • bloodhound-asset-info-get

    Fetches asset information using the object ID.

  • bloodhound-object-id-get

    Fetches the object ID using the object name.

  • bloodhound-path-exist

    Checks if a path exists between the two nodes.

Source

SpecterOpsBloodHoundEnterprise.py SpecterOpsBloodHoundEnterprise_test.py SpecterOpsBloodHoundEnterprise.yml SpecterOpsBloodHoundEnterprise_description.md command_examples.txt
Download History Raw 
sectionorder:
- Connect
- Collect
commonfields:
  id: SpecterOpsBloodHoundEnterprise
  version: -1
name: SpecterOpsBloodHoundEnterprise
display: SpecterOps BloodHound Enterprise
category: Vulnerability Management
provider: SpecterOps
description: Use the SpecterOpsBloodHoundEnterprise integration to retrieve attack path findings from BloodHound Enterprise to streamline incident creation and investigation.
detaileddescription: BloodHound Enterprise reduces risk in Active Directory and Microsoft Azure environments by continuously identifying and quantifying attack paths that attackers use to escalate privileges. The SpecterOpsBloodHoundEnterprise integration automatically ingests attack path findings from BloodHound Enterprise into Cortex XSOAR, streamlining incident creation and investigation. Configure the integration by providing your BloodHound Enterprise domain, API token ID and key, and optionally configure proxy settings and finding filters. Enable incident fetching to automatically retrieve attack paths at your specified interval.
configuration:
- section: Connect
  display: BloodHound Enterprise Domain
  name: url
  type: 0
  required: true
  additionalinfo: BloodHound Enterprise Domain URL
- section: Connect
  display: Token ID
  displaypassword: Token Key
  name: credentials
  type: 9
  required: true
  additionalinfo: BloodHound Enterprise API token ID
- section: Connect
  display: Proxy URL
  name: proxy_url
  type: 0
  required: false
- section: Connect
  display: Proxy URL Username
  name: proxy_username
  type: 0
  required: false
- section: Connect
  display: Proxy URL Password
  name: proxy_password
  type: 4
  required: false
- section: Connect
  display: Finding Environment
  name: finding_domain
  defaultvalue: all
  type: 0
  required: false
  additionalinfo: The environment from which to fetch attack paths. Default is all.
- section: Connect
  display: Finding Category
  name: finding_category
  defaultvalue: all
  type: 0
  required: false
  additionalinfo: The category of attack paths to fetch. Default is all.
- section: Collect
  display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  supportedModules:
  - agentix
  - xsiam
- section: Collect
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "10"
  type: 19
  required: false
  additionalinfo: The interval for fetching attack paths.
  supportedModules:
  - agentix
  - xsiam
- section: Collect
  display: Incident type
  name: incidentType
  type: 13
  required: false
  supportedModules:
  - agentix
  - xsiam
script:
  script: '-'
  commands:
  - name: bloodhound-object-id-get
    arguments:
    - name: object_names
      required: true
      description: The object name associated with object ID.
      isArray: true
    outputs:
    - contextPath: SpecterOpsBloodHoundEnterprise.Object.Status
      description: The status of the object ID lookup (success or error).
      type: string
    - contextPath: SpecterOpsBloodHoundEnterprise.Object.Message
      description: The message describing the result of the lookup.
      type: string
    - contextPath: SpecterOpsBloodHoundEnterprise.Object.ObjectID
      description: The unique object ID of the found object.
      type: string
    - contextPath: 'SpecterOpsBloodHoundEnterprise.Object.ObjectName'
      description: The name of the object that was searched.
      type: string
    description: Fetches the object ID using the object name.
  - name: bloodhound-asset-info-get
    arguments:
    - name: object_ids
      required: true
      description: The object ID to fetch asset information.
      isArray: true
    outputs:
    - contextPath: SpecterOpsBloodHoundEnterprise.Asset.Status
      description: The status of the asset information fetch (success or error).
      type: string
    - contextPath: SpecterOpsBloodHoundEnterprise.Asset.Message
      description: The message describing the result of the asset information fetch.
      type: string
    - contextPath: SpecterOpsBloodHoundEnterprise.Asset.ObjectID
      description: The object ID for which asset information was fetched.
      type: string
    - contextPath: SpecterOpsBloodHoundEnterprise.Asset.Data
      description: The raw asset data containing all asset information fields (name, type, objectid, domain, enabled, email, and other properties).
      type: unknown
    description: Fetches asset information using the object ID.
  - name: bloodhound-path-exist
    arguments:
    - name: from_principal
      description: The start node.
    - name: to_principal
      description: The end node.
    outputs:
    - contextPath: SpecterOpsBloodHoundEnterprise.Path.FromPrincipal
      description: The start node (from principal) used in the path check.
      type: String
    - contextPath: SpecterOpsBloodHoundEnterprise.Path.ToPrincipal
      description: The end node (to principal) used in the path check.
      type: String
    - contextPath: SpecterOpsBloodHoundEnterprise.Path.Status
      description: The status of the path check (success or error).
      type: String
    - contextPath: SpecterOpsBloodHoundEnterprise.Path.Message
      description: The message describing the result of the path check.
      type: String
    - contextPath: SpecterOpsBloodHoundEnterprise.Path.Data
      description: Whether a path exists between the nodes (True or False).
      type: Boolean
    description: Checks if a path exists between the two nodes.
  type: python
  dockerimage: demisto/python3:3.12.13.10116658
  subtype: python3
  isfetch: true
  runonce: false
  isFetchSamples: true
fromversion: 6.10.0
tests:
- No tests (auto formatted)