Échangeons
← Sentinel Explorer
↳ Source GitHubConnecteur

BloodHound Enterprise Data Connector (using Azure Functions)

Voir sur GitHub ↗Fichier original ↗

Description

**[BloodHound Enterprise](https://bloodhoundenterprise.io/)** from **[SpecterOps](https://specterops.io/)** is an **Identity Attack Path Management** platform: it maps how attackers can move through identity relationships to reach critical assets so teams can **prioritize and remediate** those paths not only detect them. It brings clarity to identity sprawl in **Active Directory**, **Azure**, and beyond, including **Privilege Zone** style protection around what matters most in your environment. This **Microsoft Sentinel** connector adds **BloodHound Enterprise attack path context** into your workspace alongside logs and alerts so you can **enrich investigations**, focus on high-value findings, and track exposure, audit activity, and **Tier Zero** assets in one place. **What this connector does** - Connects to the **BloodHound Enterprise REST API** using your configured credentials (see [Working with the API](https://bloodhound.specterops.io/integrations/bloodhound-api/working-with-api)) and runs on a **schedule** you set when the Azure Function is deployed. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).
Statut déclaré
1
Auteur / éditeur déclaré
SpecterOps

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

BHEAttackPathsData_CLBHEAttackPathsTimelineData_CLBHEAuditLogsData_CLBHEFindingTrendsData_CLBHEPostureHistoryData_CLBHETierZeroAssetsData_CL

Permissions déclarées

read and write permissions on the workspace are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
Microsoft.Web/sites permissions
Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/).
BloodHound Enterprise API access
**Token ID**, **Token key**, and your tenant **base URL** are required to authenticate to the BloodHound Enterprise REST API (requests are signed per the SpecterOps API model see [Working with the API](https://bloodhound.specterops.io/integrations/bloodhound-api/working-with-api)).

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

Step 1. Create BloodHound Enterprise API credentials
In your BloodHound Enterprise tenant, create API credentials (**Token ID** and **Token key**) used to sign requests to the REST API. Follow [Working with the API](https://bloodhound.specterops.io/integrations/bloodhound-api/working-with-api) to create API credentials then store the values securely.
Step 2. Create Microsoft Entra application
Create a Microsoft Entra ID (Azure AD) application used for ingestion to Log Analytics (for example DCE/DCR-related access). Follow [Create a Microsoft Entra application](https://learn.microsoft.com/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#create-microsoft-entra-application) to create Microsoft Entra application & its credentials then save **Application (client) ID**, **Client secret** value, and any other IDs your administrator requires. Store the client secret securely.
Step 3. Deploy Function App
>**NOTE:** This connector uses Azure Functions to pull data from BloodHound Enterprise into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
>**IMPORTANT:** Before deploying the BloodHound Enterprise connector, have the **Workspace name** (see below), **BloodHound Enterprise tenant URL**, **Token ID** and **Token key**, **Microsoft Entra Application (client) ID** and **client secret**, and your desired **environment** and **finding type** filters (or use template defaults such as **All**) ready.
Workspace Name
Deploy all the resources related to the data connector
1. Click the **Deploy to Azure** button below. [![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-BloodhoundEnterprise-azuredeploy) 2. Select the preferred **Subscription**, **Resource Group**, and **Location**. 3. Enter **Function App name**, **Log Analytics workspace name** (Microsoft Sentinel workspace), **BloodHound Enterprise tenant domain** (URL), **BloodHound Token ID** and **Token key** (secure parameters), **Microsoft Entra Application (client) ID**, and **Microsoft Entra application client secret**. 4. Optional: set **Lookup days** (historical lookback), **Selected BloodHound environments** (comma-separated or **All**), and **Selected finding types** (or **All**) as described in the template. 5. Click **Review + create**, then **Create** to deploy.

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques102
BloodHound Attack Path Finding - Add Key Credential Link Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - Add Member Privileges on Tier Zero Security GroupsMediumBloodHound Attack Path Finding - Add Members to Tier Zero GroupMediumBloodHound Attack Path Finding - Add Owner to Tier Zero Object via MS Graph App RoleMediumBloodHound Attack Path Finding - Add Resource-Based Constrained Delegation Privileges on Tier Zero ComputersMediumBloodHound Attack Path Finding - Add Secret to Tier Zero PrincipalMediumBloodHound Attack Path Finding - AddOwner Role on Tier Zero ResourceMediumBloodHound Attack Path Finding - AddSelf Privilege on Tier Zero Security GroupsMediumBloodHound Attack Path Finding - Admins on Tier Zero ComputersMediumBloodHound Attack Path Finding - AKS Contributor Role on Tier Zero Managed ClusterMediumBloodHound Attack Path Finding - AllExtended Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - App Admin Control of Tier Zero PrincipalMediumBloodHound Attack Path Finding - AS-REP Roastable User AccountsMediumBloodHound Attack Path Finding - Avere Contributor Role on Tier Zero Virtual MachineMediumBloodHound Attack Path Finding - Cloud App Admin Over Tier Zero PrincipalMediumBloodHound Attack Path Finding - Command Execution on Tier Zero Virtual MachineMediumBloodHound Attack Path Finding - Computers Vulnerable to Coercion-Based NTLM Relay to SMB AttackMediumBloodHound Attack Path Finding - Constrained Delegation on Tier Zero ComputersMediumBloodHound Attack Path Finding - Contributor Role on Tier Zero Automation AccountMediumBloodHound Attack Path Finding - Contributor Role on Tier Zero ResourceMediumBloodHound Attack Path Finding - DCOM Users on Tier Zero ComputersMediumBloodHound Attack Path Finding - ForceChangePassword Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - GenericAll Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - GenericWrite Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - Get Certifcates on Tier Zero Key VaultMediumBloodHound Attack Path Finding - Get Keys on Tier Zero Key VaultMediumBloodHound Attack Path Finding - Get Secrets on Tier Zero Key VaultMediumBloodHound Attack Path Finding - Kerberoastable User AccountsMediumBloodHound Attack Path Finding - Kerberos Delegation on Tier Zero ObjectsMediumBloodHound Attack Path Finding - Key Vault Contributor Role on Tier Zero ResourceMediumBloodHound Attack Path Finding - Large Default Group With SyncLapsPassword PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups in DCOM Users GroupsMediumBloodHound Attack Path Finding - Large Default Groups in Local Administrator GroupsMediumBloodHound Attack Path Finding - Large Default Groups in PS Remote Users GroupsMediumBloodHound Attack Path Finding - Large Default Groups in SQL Admins GroupsMediumBloodHound Attack Path Finding - Large Default Groups With Add Key Credential Link PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With Add Member PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With Add Self PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With All Extended PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With ForceChangePassword PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With GenericAll PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With GenericWrite PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With Limited Ownership PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With Ownership PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With RDP AccessMediumBloodHound Attack Path Finding - Large Default Groups With Read GMSA Password PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With Read LAPS Password PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With Resource-Based Constrained Delegation PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With WriteAccountRestrictions PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With WriteDacl PrivilegeMediumBloodHound Attack Path Finding - Large Default Groups With WriteGpLink PrivilegeMediumBloodHound Attack Path Finding - Large Default Groups With WriteOwner PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With WriteOwnerLimitedRights PrivilegesMediumBloodHound Attack Path Finding - Large Default Groups With WriteServicePrincipalName PrivilegesMediumBloodHound Attack Path Finding - Legacy SID History on Tier Zero ObjectsMediumBloodHound Attack Path Finding - Limited Ownership Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - Logic App Contributor Role on Tier Zero Logic AppMediumBloodHound Attack Path Finding - Logons From Tier Zero UsersMediumBloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC1 PrivilegesMediumBloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC10 Scenario A PrivilegesMediumBloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC13 Privileges Against Tier Zero GroupMediumBloodHound Attack Path Finding - Non Tier Zero Resource Assigned to Tier Zero Service PrincipalMediumBloodHound Attack Path Finding - Non-Tier Zero AD User Synced to Tier Zero Entra UserMediumBloodHound Attack Path Finding - Non-Tier Zero Computer Hosting EnterpriseCA Trusted for NT AuthenticationMediumBloodHound Attack Path Finding - Non-Tier Zero Entra User Synced to Tier Zero AD UserMediumBloodHound Attack Path Finding - Non-Tier Zero Principal Can Grant Tier Zero App RolesMediumBloodHound Attack Path Finding - Non-Tier Zero Principal Can Grant Tier Zero Entra ID RoleMediumBloodHound Attack Path Finding - Non-Tier Zero Principal Trusted for Unconstrained DelegationMediumBloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC10 Scenario B PrivilegesMediumBloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC3 PrivilegesMediumBloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC4 PrivilegesMediumBloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC6 Scenario A PrivilegesMediumBloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC6 Scenario B PrivilegesMediumBloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC9 Scenario A PrivilegesMediumBloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC9 Scenario B PrivilegesMediumBloodHound Attack Path Finding - Non-Tier Zero Principals With DCSync PrivilegesMediumBloodHound Attack Path Finding - Owner Role on Tier Zero ResourceMediumBloodHound Attack Path Finding - Ownership of Tier Zero PrincipalMediumBloodHound Attack Path Finding - Ownership Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - PS Remote Users on Tier Zero ComputersMediumBloodHound Attack Path Finding - RDP Users on Tier Zero ComputersMediumBloodHound Attack Path Finding - Read GMSA Password Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - ReadLapsPassword Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - Reset a Tier Zero User's PasswordMediumBloodHound Attack Path Finding - SQL Admin Users on Tier Zero ComputersMediumBloodHound Attack Path Finding - SyncLapsPassword Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to ADCS (ESC8) AttackMediumBloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to LDAP AttackMediumBloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to LDAPS AttackMediumBloodHound Attack Path Finding - Tier Zero Group Control via MS Graph App RoleMediumBloodHound Attack Path Finding - Tier Zero Service Principal Control via MS Graph App RoleMediumBloodHound Attack Path Finding - Tier Zero SMSA Installed on Non-Tier Zero ComputerMediumBloodHound Attack Path Finding - User Access Admin Role on Tier Zero ResourceMediumBloodHound Attack Path Finding - VM Admin Login Role on Tier Zero SystemMediumBloodHound Attack Path Finding - VM Contributor Role on Tier Zero SystemMediumBloodHound Attack Path Finding - Website Contributor Role on Tier Zero ResourceMediumBloodHound Attack Path Finding - Write Account Restrictions Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - WriteDacl Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - WriteGpLink Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - WriteOwner Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - WriteOwnerLimitedRights Privileges on Tier Zero ObjectsMediumBloodHound Attack Path Finding - WriteServicePrincipalName Privileges on Tier Zero ObjectsMedium
Solutions1

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
BloodHoundEnterprise
Autres fichiers source 2Solutions/BloodHound Enterprise/Data Connectors/BloodHoundFunction.jsonsource ↗Solutions/BloodHound Enterprise/Data/Solution_BloodHoundEnterprise.jsonsolution-membership ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.