diff --git a/docs/hc/en-us/articles/BloodHound-Configuration.mdx b/docs/analyze-data/bloodhound-gui/configuration.mdx similarity index 61% rename from docs/hc/en-us/articles/BloodHound-Configuration.mdx rename to docs/analyze-data/bloodhound-gui/configuration.mdx index 394a732f0f..cead2bb017 100644 --- a/docs/hc/en-us/articles/BloodHound-Configuration.mdx +++ b/docs/analyze-data/bloodhound-gui/configuration.mdx @@ -3,7 +3,7 @@ title: BloodHound Configuration --- - + This article explains the multiple tenant-wide configurations supported by BloodHound Enterprise. The configurations can be changed by a BloodHound Administrator in ⚙️ > Administration > BloodHound Configuration. @@ -11,10 +11,10 @@ This article explains the multiple tenant-wide configurations supported by Blood ## Reconciliation Configuration -When enabled, BloodHound Enterprise will perform data reconciliation and retention. The configuration also allows for the changing of the default retention time. See [Data reconciliation and retention](/hc/en-us/articles/Data-reconciliation-and-retention). +When enabled, BloodHound Enterprise will perform data reconciliation and retention. The configuration also allows for the changing of the default retention time. See [Data reconciliation and retention](/collect-data/enterprise-collection/data-retention). ## Citrix RDP Support When enabled, BloodHound Enterprise will prevent false-positive CanRDP findings for Citrix VDAs. -This configuration adds to the [CanRDP edge conditions](/hc/en-us/articles/CanRDP) that a non-administrative principal must also be a member of the computer's local "Direct Access Users" group, which Citrix created to allow non-brokered access to VDAs. +This configuration adds to the [CanRDP edge conditions](/resources/edges/can-rdp) that a non-administrative principal must also be a member of the computer's local "Direct Access Users" group, which Citrix created to allow non-brokered access to VDAs. diff --git a/docs/hc/en-us/articles/Searching-with-Cypher.mdx b/docs/analyze-data/bloodhound-gui/cypher-search.mdx similarity index 50% rename from docs/hc/en-us/articles/Searching-with-Cypher.mdx rename to docs/analyze-data/bloodhound-gui/cypher-search.mdx index 9de3f3d2f4..a9cbfb2b51 100644 --- a/docs/hc/en-us/articles/Searching-with-Cypher.mdx +++ b/docs/analyze-data/bloodhound-gui/cypher-search.mdx @@ -3,7 +3,7 @@ title: Searching with Cypher --- - + Purpose @@ -14,38 +14,38 @@ This article describes how to use Cypher Search within BloodHound. Users of Bloo Process ======= -One of the most overlooked features of BloodHound is the ability to enter raw Cypher queries directly into the user interface. Likely, a lot of that has to do with the fact that it’s not a very emphasized feature and requires learning Cypher. However, with some work, using raw Cypher queries can let you manipulate and examine BloodHound data in custom ways to help you further understand your network or identify interesting relationships. +One of the most overlooked features of BloodHound is the ability to enter raw Cypher queries directly into the user interface. Likely, a lot of that has to do with the fact that it's not a very emphasized feature and requires learning Cypher. However, with some work, using raw Cypher queries can let you manipulate and examine BloodHound data in custom ways to help you further understand your network or identify interesting relationships. - + What is Cypher?[](#what-is-cypher) ---------------------------------- -Just like SQL exists for MSSQL and other traditional relational databases, Cypher is a language designed for graph databases with its own syntax. Cypher enables users to write queries using an "ASCII-art" style syntax. If you can describe the path you're trying to find, you can probably right it in Cypher.  +Just like SQL exists for MSSQL and other traditional relational databases, Cypher is a language designed for graph databases with its own syntax. Cypher enables users to write queries using an "ASCII-art" style syntax. If you can describe the path you're trying to find, you can probably right it in Cypher. Elements of the graph database[](#elements-of-the-neo4j-database) ----------------------------------------------------------------- Everything in the graph database is represented using common terms from graph theory, particularly **edges,** and **nodes**. -Nodes represent discrete objects that can be acted upon when moving through an environment. In BloodHound, a node can, for example, represent a User in an Active Directory environment. Read more about BloodHound nodes in [About BloodHound Nodes](/hc/en-us/articles/About-BloodHound-Nodes). +Nodes represent discrete objects that can be acted upon when moving through an environment. In BloodHound, a node can, for example, represent a User in an Active Directory environment. Read more about BloodHound nodes in [About BloodHound Nodes](/resources/nodes/overview). -Edges represent a relationship between two nodes and can be the action necessary to act on a node. In BloodHound, an edge can, for example, represent the relationship between a User node and a Group node through the MemberOf edge, indicating that the user is a group member. Read more about BloodHound edges in the article [About BloodHound Edges](/hc/en-us/articles/About-BloodHound-Edges). +Edges represent a relationship between two nodes and can be the action necessary to act on a node. In BloodHound, an edge can, for example, represent the relationship between a User node and a Group node through the MemberOf edge, indicating that the user is a group member. Read more about BloodHound edges in the article [About BloodHound Edges](/resources/edges/overview). Together, edges and nodes create the paths we use in BloodHound to demonstrate how different permissions in Active Directory and Azure can be executed to gain control over a given target. Basic Cypher[](#basic-cypher) ----------------------------- -When building Cypher queries, it’s important to note that you’re generally trying to build a path using the relationships available to you. Let’s look at an extremely basic query: +When building Cypher queries, it's important to note that you're generally trying to build a path using the relationships available to you. Let's look at an extremely basic query: ``` - MATCH (B)-[A]->(R) RETURN B  + MATCH (B)-[A]->(R) RETURN B ``` -Let’s break down how this Cypher query is constructed. When querying the database, we start our queries with the MATCH keyword. The MATCH clause lets you specify a pattern in the database. +Let's break down how this Cypher query is constructed. When querying the database, we start our queries with the MATCH keyword. The MATCH clause lets you specify a pattern in the database. * Each variable in the Cypher query is defined using an identifier, in this case, the following ones: B, A, and R. The identifier for variables can be anything you want, including entire words, such as 'groups'. * In Cypher queries, nodes are specified using parentheses, so B and R are nodes in the sample query above. @@ -53,40 +53,40 @@ Let’s break down how this Cypher query is constructed. When querying the datab The dashes between the nodes and relationships can be used to specify direction. Relationships in BloodHound always go in the direction of compromise or further privilege, whether through group membership or user credentials from a session. -In the above query, the **->** specifies that the query should return relationships that go from B to R. Removing the **>** will allow the query to search relationships in both directions. Finally, the RETURN statement instructs the database to return the item matched with the corresponding variable name B. +In the above query, the **->** specifies that the query should return relationships that go from B to R. Removing the **>** will allow the query to search relationships in both directions. Finally, the RETURN statement instructs the database to return the item matched with the corresponding variable name B. -Now, let’s take our previous query and make it a bit more complex: +Now, let's take our previous query and make it a bit more complex: ``` MATCH (n:User),(m:Group) MATCH p=(n)-[r:MemberOf*1..3]->(m) RETURN p ``` -This query is a bit more refined than the previous one. By using labels on both nodes and edges, we can make our query a lot more specific. We also pre-assign the variables **n** and **m** and give them labels to make the query easier to read. In this particular case, we’re asking BloodHound to find nodes with the labels User and Group, and then match those nodes using the _MemberOf_ relationship. We added a length modifier as well to the relationship. Adding ***1..3** limits the search to relationships that are between one and three links. In simple terms, give me any users that are a member of a group up to three links away. Additionally, we’re assigning the result of the pattern to the variable **p** and returning that variable. When we get **p** back, it will contain the result of each path it can find that matches our pattern we asked for. +This query is a bit more refined than the previous one. By using labels on both nodes and edges, we can make our query a lot more specific. We also pre-assign the variables **n** and **m** and give them labels to make the query easier to read. In this particular case, we're asking BloodHound to find nodes with the labels User and Group, and then match those nodes using the _MemberOf_ relationship. We added a length modifier as well to the relationship. Adding ***1..3** limits the search to relationships that are between one and three links. In simple terms, give me any users that are a member of a group up to three links away. Additionally, we're assigning the result of the pattern to the variable **p** and returning that variable. When we get **p** back, it will contain the result of each path it can find that matches our pattern we asked for. -Now that we’ve looked at the basic building blocks of queries, let’s look at a more complicated one. As an example, here’s the query we use to calculate shortest paths to Domain Admins, one of the most important queries in the BloodHound interface: +Now that we've looked at the basic building blocks of queries, let's look at a more complicated one. As an example, here's the query we use to calculate shortest paths to Domain Admins, one of the most important queries in the BloodHound interface: ``` MATCH p=shortestPath((n:User)-[*1..]->(m:Group))WHERE m.name = "DOMAIN ADMINS@INTERNAL.LOCAL"RETURN p ``` -Cypher is case-sensitive, and the node property "name" is always all uppercase and postfixed with the directory's domain. In the code above, "Domain Admins" in the domain "internal.local" has become **"DOMAIN ADMINS@INTERNAL.LOCAL"**.  +Cypher is case-sensitive, and the node property "name" is always all uppercase and postfixed with the directory's domain. In the code above, "Domain Admins" in the domain "internal.local" has become **"DOMAIN ADMINS@INTERNAL.LOCAL"**. -In this query, we add a few more elements to our previous ones. We still use labels to specify our nodes, but we also add another degree of specificity to our group node by restricting the group nodes that can be returned to only the **DOMAIN ADMINS@INTERNAL.LOCAL** by specifying the name parameter. We also use the shortestPath function. Using this function, we ask the graph to give us the shortest path it can find between each node **n** and the Domain Admins group. Because we didn’t specify any relationship labels, the query will use any possible relationship it can find. We also removed the limit on how many hops the database can search. By not specifying an upper limit, the database will go as many hops as possible to find a path. +In this query, we add a few more elements to our previous ones. We still use labels to specify our nodes, but we also add another degree of specificity to our group node by restricting the group nodes that can be returned to only the **DOMAIN ADMINS@INTERNAL.LOCAL** by specifying the name parameter. We also use the shortestPath function. Using this function, we ask the graph to give us the shortest path it can find between each node **n** and the Domain Admins group. Because we didn't specify any relationship labels, the query will use any possible relationship it can find. We also removed the limit on how many hops the database can search. By not specifying an upper limit, the database will go as many hops as possible to find a path. -There is also an allShortestPaths function available, which, as the name implies, will find every shortest path from each node to your target. Note that this results in more data analysis to perform the query and could result in higher resource consumption.  +There is also an allShortestPaths function available, which, as the name implies, will find every shortest path from each node to your target. Note that this results in more data analysis to perform the query and could result in higher resource consumption. -Another important part of Cypher to note is that wildcard matches are possible using regex, although the syntax for the query changes slightly. As an example, here’s the query that’s run each time you type a letter in the search bar: +Another important part of Cypher to note is that wildcard matches are possible using regex, although the syntax for the query changes slightly. As an example, here's the query that's run each time you type a letter in the search bar: ``` - MATCH (n)WHERE n.name =~ “(?i).*searchterm.*”RETURN nLIMIT 10 + MATCH (n)WHERE n.name =~ "(.i).*searchterm.*"RETURN nLIMIT 10 ``` -In this query, we ask the graph to return any nodes of any type that match the search term given. The (**?i)** tells the graph this is a case-insensitive regex, with the **.**\* on each side indicating that we want to match anything on either side. We limit the number of items returned to the first ten using the **LIMIT** keyword. +In this query, we ask the graph to return any nodes of any type that match the search term given. The (**?i**) tells the graph this is a case-insensitive regex, with the **.**\* on each side indicating that we want to match anything on either side. We limit the number of items returned to the first ten using the **LIMIT** keyword. Advanced Concepts[](#advanced-concepts) --------------------------------------- -As you build into more complicated queries, the **WITH** keyword will become important. The **WITH** keyword allows you to use multiple queries and pass the results of each query to the next step. An example of this is in the BloodHound interface whenever you click on a group node. The "Session" section displays the number of places where users in this group (including its subgroups) currently have sessions. +As you build into more complicated queries, the **WITH** keyword will become important. The **WITH** keyword allows you to use multiple queries and pass the results of each query to the next step. An example of this is in the BloodHound interface whenever you click on a group node. The "Session" section displays the number of places where users in this group (including its subgroups) currently have sessions. The UI calculates the number of sessions for the group using two separate queries put together: @@ -94,25 +94,25 @@ The UI calculates the number of sessions for the group using two separate querie MATCH p=shortestPath((m:User)-[r:MemberOf*1..]->(n:Group))WHERE n.name = "$name_of_group"WITH m MATCH q=((m)<-[:HasSession]-(o:Computer)) RETURN count(o) ``` -This query looks more complicated than we had before, so let’s break it down into two components. +This query looks more complicated than we had before, so let's break it down into two components. ``` MATCH p=shortestPath((m:User)-[r:MemberOf*1..]->(n:Group))WHERE n.name = "$name_of_group" ``` -This is the first query we run. We ask BloodHound to find the shortestPath possible from any user node to the group we specify. Note that we allow the _MemberOf_ relationship to span any number of hops, allowing us to include users inside nested groups. This first query gives us all the effective members of the group we ask for. +This is the first query we run. We ask BloodHound to find the shortestPath possible from any user node to the group we specify. Note that we allow the _MemberOf_ relationship to span any number of hops, allowing us to include users inside nested groups. This first query gives us all the effective members of the group we ask for. ``` MATCH q=((m)<-[:HasSession]-(o:Computer))RETURN count(o) ``` -This is the second query that actually gives us the session data. The variable **m** is carried over from the previous query and contains all the users relevant to the group we’re attempting to find sessions for. We ask BloodHound to find any computer where any of the users we found in the first step has a session using the _HasSession_ relationship. We’re not interested in returning the relationships in this particular case, so we don’t assign a variable. Finally, we return the count of the number of computers we have sessions on. The two queries we execute are joined together using the **WITH** keyword. When using the keyword, you specify any variables you want to carry over from the previous part of the query. These variables will be available with the data for the next query in your chain. +This is the second query that actually gives us the session data. The variable **m** is carried over from the previous query and contains all the users relevant to the group we're attempting to find sessions for. We ask BloodHound to find any computer where any of the users we found in the first step has a session using the _HasSession_ relationship. We're not interested in returning the relationships in this particular case, so we don't assign a variable. Finally, we return the count of the number of computers we have sessions on. The two queries we execute are joined together using the **WITH** keyword. When using the keyword, you specify any variables you want to carry over from the previous part of the query. These variables will be available with the data for the next query in your chain. Outcome ======= -Now that we’ve explained Cypher and the syntax and all the cool ways you can narrow down search results, the next step is for you to build some new and interesting queries and start examining how you can view relationships. +Now that we've explained Cypher and the syntax and all the cool ways you can narrow down search results, the next step is for you to build some new and interesting queries and start examining how you can view relationships. A quick way to start looking at Cypher queries is through the many examples included in the "Pre-built Searches" section, which is expanded after clicking the folder icon. - + diff --git a/docs/hc/en-us/articles/Explore-Search-for-Objects.mdx b/docs/analyze-data/bloodhound-gui/explore-objects.mdx similarity index 59% rename from docs/hc/en-us/articles/Explore-Search-for-Objects.mdx rename to docs/analyze-data/bloodhound-gui/explore-objects.mdx index 570046bef5..ab9f07b08e 100644 --- a/docs/hc/en-us/articles/Explore-Search-for-Objects.mdx +++ b/docs/analyze-data/bloodhound-gui/explore-objects.mdx @@ -3,19 +3,19 @@ title: Explore -> Search for Objects --- - + -In the top left of the GUI is the search bar. Start typing the name of a node, and the GUI will automatically recommend nodes that match what you’ve typed so far. Click one of the suggestions, and the GUI will render that node. +In the top left of the GUI is the search bar. Start typing the name of a node, and the GUI will automatically recommend nodes that match what you've typed so far. Click one of the suggestions, and the GUI will render that node. -You can also constrain your search to particular node types by prepending your search with the appropriate node label. Supported node names can be found in the [Nodes section](/hc/en-us/sections/Nodes). +You can also constrain your search to particular node types by prepending your search with the appropriate node label. Supported node names can be found in the [Nodes section](/resources/nodes/overview). -For example, you can search for group nodes containing the word “admin” with this search: +For example, you can search for group nodes containing the word "admin" with this search: ``` group:admin ``` The search as seen in BloodHound: - + diff --git a/docs/hc/en-us/articles/Mute-unmute-attack-path-finding.mdx b/docs/analyze-data/bloodhound-gui/mute-paths.mdx similarity index 74% rename from docs/hc/en-us/articles/Mute-unmute-attack-path-finding.mdx rename to docs/analyze-data/bloodhound-gui/mute-paths.mdx index 1200168b0c..a218387c25 100644 --- a/docs/hc/en-us/articles/Mute-unmute-attack-path-finding.mdx +++ b/docs/analyze-data/bloodhound-gui/mute-paths.mdx @@ -3,18 +3,18 @@ title: Mute/unmute attack path finding --- - + Purpose ======= -This article outlines how to mute a principal in an attack path finding so it is hidden in the principal table of the finding. It should be used by BHE users whenever a risk has been decided to be accepted or [while waiting for a change to leave its retention period](/hc/en-us/articles/Data-reconciliation-and-retention). +This article outlines how to mute a principal in an attack path finding so it is hidden in the principal table of the finding. It should be used by BHE users whenever a risk has been decided to be accepted or [while waiting for a change to leave its retention period](/collect-data/enterprise-collection/data-retention). Prerequisites ============= -* Logged in as a user role which is authorized to mute attack path impacted principals, see [Administering users and roles](/hc/en-us/articles/Administering-users-and-roles). +* Logged in as a user role which is authorized to mute attack path impacted principals, see [Administering users and roles](/manage-bloodhound/auth/users-and-roles). Process ======= @@ -25,13 +25,13 @@ Mute a principal[](#heading-1) 1. Navigate to the Attack Paths page. 2. Expand the attack path finding and click the menu to the left of the principal's name (three vertical dots), then click \`Mute\`. - + 3. In the pop-up window \`Mute Attack Path\`, set the number of days the finding's principal should be muted and click the button \`MUTE\`. * If muting permanently: set the duration for a long duration. - * If muting while while waiting for a change to leave it's retention period: set the duration depending on the retention scenario, for example when muting a principal from \`Logons from Tier Zero Users\` the duration should be 7 days. See [Data reconciliation and retention in BloodHound Enterprise](/hc/en-us/articles/Data-reconciliation-and-retention). + * If muting while while waiting for a change to leave it's retention period: set the duration depending on the retention scenario, for example when muting a principal from \`Logons from Tier Zero Users\` the duration should be 7 days. See [Data reconciliation and retention in BloodHound Enterprise](/collect-data/enterprise-collection/data-retention). - + Unmute a principal[](#heading-2) @@ -40,15 +40,15 @@ Unmute a principal[](#heading-2) 1. Navigate to the Attack Paths page. 2. Expand the attack path finding and toggle the setting \`Show Muted\`. - + 3. In the menu to the left of the muted principal's name (three vertical dots), click \`Unmute\`. - + 4. In the pop-up window \`Unmute Attack Path\` click the button \`UNMUTE\`. - + Outcome @@ -57,5 +57,5 @@ Outcome When a principal is muted, it is hidden from the principal table in the attack path until you toggle the setting \`Show Muted\`. The principal and it's edges will still visible in the Explore and Posture page. - + diff --git a/docs/analyze-data/bloodhound-gui/overview.mdx b/docs/analyze-data/bloodhound-gui/overview.mdx new file mode 100644 index 0000000000..366acd1285 --- /dev/null +++ b/docs/analyze-data/bloodhound-gui/overview.mdx @@ -0,0 +1,14 @@ +--- +title: The BloodHound GUI +description: "Learn about the graphical user interface of BloodHound." +mode: wide +sidebarTitle: Overview +--- + + + + + + + + diff --git a/docs/hc/en-us/articles/Posture-Page.mdx b/docs/analyze-data/bloodhound-gui/posture-page.mdx similarity index 89% rename from docs/hc/en-us/articles/Posture-Page.mdx rename to docs/analyze-data/bloodhound-gui/posture-page.mdx index a6d4b24ce8..d03f420847 100644 --- a/docs/hc/en-us/articles/Posture-Page.mdx +++ b/docs/analyze-data/bloodhound-gui/posture-page.mdx @@ -3,7 +3,7 @@ title: Posture Page --- - + ## Summary @@ -13,7 +13,7 @@ The Posture page is a simplified reporting dashboard that helps users understand This page allows users to select an environment and a duration over which to view the overall risk to the selected environment. - + ## Attack Paths @@ -44,4 +44,4 @@ The graph in the middle right of the page has multiple paginated graphs that sho For Active Directory environments, the **Group Completeness** and **Session Completeness** graphs in the bottom right of the page provide a view of how complete of a perspective BloodHound Enterprise has within the environment to indicate how accurately the assessed risk is communicated. -The total collection completeness significantly impacts the accuracy of the graph available for analysis within BloodHound Enterprise. See [Why perform privileged collection in SharpHound](/hc/en-us/articles/Why-perform-privileged-collection-in-SharpHound) for more details. +The total collection completeness significantly impacts the accuracy of the graph available for analysis within BloodHound Enterprise. See [Why perform privileged collection in SharpHound](/collect-data/enterprise-collection/privileged-collection) for more details. diff --git a/docs/analyze-data/overview.mdx b/docs/analyze-data/overview.mdx new file mode 100644 index 0000000000..5f92447057 --- /dev/null +++ b/docs/analyze-data/overview.mdx @@ -0,0 +1,40 @@ +--- +title: Data Analysis +description: "Analyzing ingested BloodHound data, identify and remediating attack paths/risks." +mode: wide +sidebarTitle: Overview +--- + +## [The BloodHound GUI](/analyze-data/bloodhound-gui/overview) + + + + + + + + +## [Nodes](/resources/nodes/overview) + + + + + + + + +[See all 37 articles](/resources/nodes/overview) + + +## [Edges](/resources/edges/overview) + + + + + + + + + +[See all 115 articles](/resources/edges/overview) + diff --git a/docs/hc/article_attachments/11427974352283.png b/docs/assets/11427974352283.png similarity index 100% rename from docs/hc/article_attachments/11427974352283.png rename to docs/assets/11427974352283.png diff --git a/docs/assets/11427976083355.png b/docs/assets/11427976083355.png new file mode 100644 index 0000000000..4f7a2ab1f5 Binary files /dev/null and b/docs/assets/11427976083355.png differ diff --git a/docs/hc/article_attachments/17779888642587.png b/docs/assets/17779888642587.png similarity index 100% rename from docs/hc/article_attachments/17779888642587.png rename to docs/assets/17779888642587.png diff --git a/docs/hc/article_attachments/17780014110363.png b/docs/assets/17780014110363.png similarity index 100% rename from docs/hc/article_attachments/17780014110363.png rename to docs/assets/17780014110363.png diff --git a/docs/hc/article_attachments/18246479746331.png b/docs/assets/18246479746331.png similarity index 100% rename from docs/hc/article_attachments/18246479746331.png rename to docs/assets/18246479746331.png diff --git a/docs/hc/article_attachments/18258001080731.png b/docs/assets/18258001080731.png similarity index 100% rename from docs/hc/article_attachments/18258001080731.png rename to docs/assets/18258001080731.png diff --git a/docs/hc/article_attachments/18382121980827.png b/docs/assets/18382121980827.png similarity index 100% rename from docs/hc/article_attachments/18382121980827.png rename to docs/assets/18382121980827.png diff --git a/docs/hc/article_attachments/18383320555675.png b/docs/assets/18383320555675.png similarity index 100% rename from docs/hc/article_attachments/18383320555675.png rename to docs/assets/18383320555675.png diff --git a/docs/hc/article_attachments/18383344818331.png b/docs/assets/18383344818331.png similarity index 100% rename from docs/hc/article_attachments/18383344818331.png rename to docs/assets/18383344818331.png diff --git a/docs/hc/article_attachments/18502449134491.png b/docs/assets/18502449134491.png similarity index 100% rename from docs/hc/article_attachments/18502449134491.png rename to docs/assets/18502449134491.png diff --git a/docs/hc/article_attachments/19622280069019.png b/docs/assets/19622280069019.png similarity index 100% rename from docs/hc/article_attachments/19622280069019.png rename to docs/assets/19622280069019.png diff --git a/docs/hc/article_attachments/19622280078363.png b/docs/assets/19622280078363.png similarity index 100% rename from docs/hc/article_attachments/19622280078363.png rename to docs/assets/19622280078363.png diff --git a/docs/hc/article_attachments/24924875820827.png b/docs/assets/24924875820827.png similarity index 100% rename from docs/hc/article_attachments/24924875820827.png rename to docs/assets/24924875820827.png diff --git a/docs/hc/article_attachments/26565152880155.png b/docs/assets/26565152880155.png similarity index 100% rename from docs/hc/article_attachments/26565152880155.png rename to docs/assets/26565152880155.png diff --git a/docs/hc/article_attachments/26565169766427.gif b/docs/assets/26565169766427.gif similarity index 100% rename from docs/hc/article_attachments/26565169766427.gif rename to docs/assets/26565169766427.gif diff --git a/docs/hc/article_attachments/28842139193883.png b/docs/assets/28842139193883.png similarity index 100% rename from docs/hc/article_attachments/28842139193883.png rename to docs/assets/28842139193883.png diff --git a/docs/hc/article_attachments/28842139211035.png b/docs/assets/28842139211035.png similarity index 100% rename from docs/hc/article_attachments/28842139211035.png rename to docs/assets/28842139211035.png diff --git a/docs/hc/article_attachments/28842168428699.png b/docs/assets/28842168428699.png similarity index 100% rename from docs/hc/article_attachments/28842168428699.png rename to docs/assets/28842168428699.png diff --git a/docs/hc/article_attachments/30567820642459.png b/docs/assets/30567820642459.png similarity index 100% rename from docs/hc/article_attachments/30567820642459.png rename to docs/assets/30567820642459.png diff --git a/docs/hc/article_attachments/31630065613339.png b/docs/assets/31630065613339.png similarity index 100% rename from docs/hc/article_attachments/31630065613339.png rename to docs/assets/31630065613339.png diff --git a/docs/hc/article_attachments/31630065618075.png b/docs/assets/31630065618075.png similarity index 100% rename from docs/hc/article_attachments/31630065618075.png rename to docs/assets/31630065618075.png diff --git a/docs/hc/article_attachments/31706404737563.png b/docs/assets/31706404737563.png similarity index 100% rename from docs/hc/article_attachments/31706404737563.png rename to docs/assets/31706404737563.png diff --git a/docs/hc/article_attachments/31706404739355.png b/docs/assets/31706404739355.png similarity index 100% rename from docs/hc/article_attachments/31706404739355.png rename to docs/assets/31706404739355.png diff --git a/docs/hc/article_attachments/31706404740891.png b/docs/assets/31706404740891.png similarity index 100% rename from docs/hc/article_attachments/31706404740891.png rename to docs/assets/31706404740891.png diff --git a/docs/hc/images/BHE-logo-square.png b/docs/assets/BHE-logo-square.png similarity index 100% rename from docs/hc/images/BHE-logo-square.png rename to docs/assets/BHE-logo-square.png diff --git a/docs/hc/images/CE-logo-square.svg b/docs/assets/CE-logo-square.svg similarity index 100% rename from docs/hc/images/CE-logo-square.svg rename to docs/assets/CE-logo-square.svg diff --git a/docs/assets/apiclient.py b/docs/assets/apiclient.py new file mode 100644 index 0000000000..35f52af1b0 --- /dev/null +++ b/docs/assets/apiclient.py @@ -0,0 +1,318 @@ +""" +To utilize this example please install requests. The rest of the dependencies are part of the Python 3 standard +library. + +# pip install --upgrade requests + +Note: this script was written for Python 3.6.X or greater. + +Insert your BHE API creds in the BHE constants and change the PRINT constants to print desired data. +""" + +import hmac +import hashlib +import base64 +import requests +import datetime +import json + +from typing import Optional + + +BHE_DOMAIN = "xyz.bloodhoundenterprise.io" +BHE_PORT = 443 +BHE_SCHEME = "https" +BHE_TOKEN_ID = "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" +BHE_TOKEN_KEY = "" + +PRINT_PRINCIPALS = False +PRINT_ATTACK_PATH_TIMELINE_DATA = False +PRINT_POSTURE_DATA = False + +DATA_START = "1970-01-01T00:00:00.000Z" +DATA_END = datetime.datetime.now(datetime.timezone.utc).strftime('%Y-%m-%dT%H:%M:%S.%f')[:-3] + 'Z' # Now + +class Credentials(object): + def __init__(self, token_id: str, token_key: str) -> None: + self.token_id = token_id + self.token_key = token_key + + +class APIVersion(object): + def __init__(self, api_version: str, server_version: str) -> None: + self.api_version = api_version + self.server_version = server_version + + +class Domain(object): + def __init__(self, name: str, id: str, collected: bool, domain_type: str, impact_value: int) -> None: + self.name = name + self.id = id + self.type = domain_type + self.collected = collected + self.impact_value = impact_value + + +class AttackPath(object): + def __init__(self, id: str, title: str, domain: Domain) -> None: + self.id = id + self.title = title + self.domain_id = domain.id + self.domain_name = domain.name.strip() + + def __lt__(self, other): + return self.exposure < other.exposure + + +class Client(object): + def __init__(self, scheme: str, host: str, port: int, credentials: Credentials) -> None: + self._scheme = scheme + self._host = host + self._port = port + self._credentials = credentials + + def _format_url(self, uri: str) -> str: + formatted_uri = uri + if uri.startswith("/"): + formatted_uri = formatted_uri[1:] + + return f"{self._scheme}://{self._host}:{self._port}/{formatted_uri}" + + def _request(self, method: str, uri: str, body: Optional[bytes] = None) -> requests.Response: + # Digester is initialized with HMAC-SHA-256 using the token key as the HMAC digest key. + digester = hmac.new(self._credentials.token_key.encode(), None, hashlib.sha256) + + # OperationKey is the first HMAC digest link in the signature chain. This prevents replay attacks that seek to + # modify the request method or URI. It is composed of concatenating the request method and the request URI with + # no delimiter and computing the HMAC digest using the token key as the digest secret. + # + # Example: GET /api/v1/test/resource HTTP/1.1 + # Signature Component: GET/api/v1/test/resource + digester.update(f"{method}{uri}".encode()) + + # Update the digester for further chaining + digester = hmac.new(digester.digest(), None, hashlib.sha256) + + # DateKey is the next HMAC digest link in the signature chain. This encodes the RFC3339 formatted datetime + # value as part of the signature to the hour to prevent replay attacks that are older than max two hours. This + # value is added to the signature chain by cutting off all values from the RFC3339 formatted datetime from the + # hours value forward: + # + # Example: 2020-12-01T23:59:60Z + # Signature Component: 2020-12-01T23 + datetime_formatted = datetime.datetime.now().astimezone().isoformat("T") + digester.update(datetime_formatted[:13].encode()) + + # Update the digester for further chaining + digester = hmac.new(digester.digest(), None, hashlib.sha256) + + # Body signing is the last HMAC digest link in the signature chain. This encodes the request body as part of + # the signature to prevent replay attacks that seek to modify the payload of a signed request. In the case + # where there is no body content the HMAC digest is computed anyway, simply with no values written to the + # digester. + if body is not None: + digester.update(body) + + # Perform the request with the signed and expected headers + return requests.request( + method=method, + url=self._format_url(uri), + headers={ + "User-Agent": "bhe-python-sdk 0001", + "Authorization": f"bhesignature {self._credentials.token_id}", + "RequestDate": datetime_formatted, + "Signature": base64.b64encode(digester.digest()), + "Content-Type": "application/json", + }, + data=body, + ) + + def get_version(self) -> APIVersion: + response = self._request("GET", "/api/version") + payload = response.json() + + return APIVersion(api_version=payload["data"]["API"]["current_version"], server_version=payload["data"]["server_version"]) + + def get_domains(self) -> list[Domain]: + response = self._request('GET', '/api/v2/available-domains') + payload = response.json()['data'] + + domains = list() + for domain in payload: + domains.append(Domain(domain["name"], domain["id"], domain["collected"], domain["type"], domain["impactValue"])) + + return domains + + def get_paths(self, domain: Domain) -> list: + response = self._request('GET', '/api/v2/domains/' + domain.id + '/available-types') + path_ids = response.json()['data'] + + paths = list() + for path_id in path_ids: + # Get nice title from API and strip newline + path_title = self._request('GET', '/ui/findings/' + path_id + '/title.md') + + # Create attackpath object + path = AttackPath(path_id, path_title.text.strip(), domain) + paths.append(path) + + return paths + + def get_path_principals(self, path: AttackPath) -> list: + # Get path details from API + response = self._request('GET', '/api/v2/domains/' + path.domain_id + '/details?finding=' + path.id + '&skip=0&limit=0&Accepted=eq:False') + payload = response.json() + + # Build dictionary of impacted pricipals + if 'count' in payload: + path.impacted_principals = list() + for path_data in payload['data']: + # Check for both From and To to determine whether relational or configuration path + if (path.id.startswith('LargeDefault')): + from_principal = path_data['FromPrincipalProps']['name'] + to_principal = path_data['ToPrincipalProps']['name'] + principals = { + 'Group': from_principal, + 'Principal': to_principal + } + elif ('FromPrincipalProps' in path_data) and ('ToPrincipalProps' in path_data): + from_principal = path_data['FromPrincipalProps']['name'] + to_principal = path_data['ToPrincipalProps']['name'] + principals = { + 'Non Tier Zero Principal': from_principal, + 'Tier Zero Principal': to_principal + } + else: + principals = { + 'User': path_data['Props']['name'] + } + path.impacted_principals.append(principals) + path.principal_count = payload['count'] + else: + path.principal_count = 0 + + return path + + def get_path_timeline(self, path: AttackPath, from_timestamp: str, to_timestamp: str): + # Sparkline data + response = self._request('GET', '/api/v2/domains/' + path.domain_id + '/sparkline?finding=' + path.id + '&from=' + from_timestamp + '&to=' + to_timestamp) + exposure_data = response.json()['data'] + + events = list() + for event in exposure_data: + e = {} + e['finding_id'] = path.id + e['domain_id'] = path.domain_id + e['path_title'] = path.title + e['exposure'] = event['CompositeRisk'] + e['finding_count'] = event['FindingCount'] + e['principal_count'] = event['ImpactedAssetCount'] + e['id'] = event['id'] + e['created_at'] = event['created_at'] + e['updated_at'] = event['updated_at'] + e['deleted_at'] = event['deleted_at'] + + # Determine severity from exposure + e['severity'] = self.get_severity(e['exposure']) + events.append(e) + + return events + + def get_posture(self, from_timestamp: str, to_timestamp: str) -> list: + response = self._request('GET', '/api/v2/posture-stats?from=' + from_timestamp + '&to=' + to_timestamp) + payload = response.json() + return payload["data"] + + def get_severity(self, exposure: int) -> str: + severity = 'Low' + if exposure > 40: severity = 'Moderate' + if exposure > 80: severity = 'High' + if exposure > 95: severity = 'Critical' + return severity + + def run_cypher(self, query, include_properties=False) -> requests.Response: + """ Runs a Cypher query and returns the results + + Parameters: + query (string): The Cypher query to run + include_properties (bool): Should all properties of result nodes/edges be returned + + Returns: + string: JSON result + + """ + + data = { + "include_properties": include_properties, + "query": query + } + body = json.dumps(data).encode('utf8') + response = self._request("POST", "/api/v2/graphs/cypher", body) + return response.json() + +def main() -> None: + # This might be best loaded from a file + credentials = Credentials( + token_id=BHE_TOKEN_ID, + token_key=BHE_TOKEN_KEY, + ) + + # Create the client and perform an example call using token request signing + client = Client(scheme=BHE_SCHEME, host=BHE_DOMAIN, port=BHE_PORT, credentials=credentials) + version = client.get_version() + + print("BHE Python API Client Example") + print(f"API version: {version.api_version} - Server version: {version.server_version}\n") + + domains = client.get_domains() + + print("Available Domains") + for domain in domains: + print(f"* {domain.name} (id: {domain.id}, collected: {domain.collected}, type: {domain.type}, exposure: {domain.impact_value})") + + # Cypher query for Kerberoastable users + print("Kerberoastable Users") + cypher = "MATCH (n:User) WHERE n.hasspn=true RETURN n" + cypher_result = client.run_cypher(cypher) + # Get nodes from Cypher result + nodes = cypher_result['data']['nodes'] + if cypher_result['data']['nodes']: + for node_id, node_data in nodes.items(): + print(node_data['label']) + + # Display paths in each domain + for domain in domains: + if domain.collected: + # Get paths for domain + attack_paths = client.get_paths(domain) + print(("\nProcessing %s attack paths for domain %s" % (len(attack_paths), domain.name))) + + for attack_path in attack_paths: + print("Processing attack path %s" % attack_path.id) + + # Get attack path principals + if (PRINT_PRINCIPALS): + path_principals = client.get_path_principals(attack_path) + print(path_principals.__dict__) + + # Get attack path timeline + if (PRINT_ATTACK_PATH_TIMELINE_DATA): + path_events = client.get_path_timeline( + path = attack_path, + from_timestamp = DATA_START, + to_timestamp = DATA_END + ) + print(path_events) + + # Get posture data + if (PRINT_POSTURE_DATA): + posture_events = client.get_posture( + from_timestamp = DATA_START, + to_timestamp = DATA_END + ) + print("%s events of posture data" % len(posture_events)) + print(posture_events) + + +if __name__ == "__main__": + main() diff --git a/docs/hc/images/ce-logo.png b/docs/assets/ce-logo.png similarity index 100% rename from docs/hc/images/ce-logo.png rename to docs/assets/ce-logo.png diff --git a/docs/assets/deployment.yaml b/docs/assets/deployment.yaml new file mode 100644 index 0000000000..e365b382de --- /dev/null +++ b/docs/assets/deployment.yaml @@ -0,0 +1,72 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: azurehound-deployment + labels: + app: azurehound +spec: + replicas: 1 + selector: + matchLabels: + app: azurehound + template: + metadata: + labels: + app: azurehound + spec: + containers: + - name: azurehound + image: ghcr.io/bloodhoundad/azurehound:latest + imagePullPolicy: IfNotPresent + args: ['start'] + env: + # Azure Configuration + - name: AZUREHOUND_TENANT # The directory tenant that you want to request permission from. This can be in GUID or friendly name format. + value: '[ INSERT HERE ]' + + - name: AZUREHOUND_APP # The Application Id that the Azure app registration portal assigned when the app was registered. + value: '[ INSERT HERE ]' + + - name: AZUREHOUND_CERT # The path to the certificate uploaded to the app registration portal. + value: '/etc/azurehound/tls.crt' + + - name: AZUREHOUND_KEY # The path to the key file for a certificate uploaded to the app registration portal. + value: '/etc/azurehound/tls.key' + + - name: AZUREHOUND_KEYPASS # The passphrase for the key file, if any + valueFrom: + secretKeyRef: + name: azurehound-secret + key: keypass + optional: true + + # BloodHound Enterprise Configuration + - name: AZUREHOUND_INSTANCE # The BloodHound Enterprise instance URL. + value: '[ INSERT HERE ]' + + - name: AZUREHOUND_TOKENID # The BloodHound Enterprise token ID. + valueFrom: + secretKeyRef: + name: azurehound-secret + key: tokenId + + - name: AZUREHOUND_TOKEN # The BloodHound Enterprise token. + valueFrom: + secretKeyRef: + name: azurehound-secret + key: token + + # Logging Configuration + - name: AZUREHOUND_JSON # Output logs as json + value: 'true' + + - name: AZUREHOUND_VERBOSITY # Verbosity level [Min: -1 (logging disabled), Max: 2 (noisy)] + value: '0' + + volumeMounts: + - name: tls + mountPath: '/etc/azurehound' + volumes: + - name: tls + secret: + secretName: azurehound-tls diff --git a/docs/assets/docker-compose.yaml b/docs/assets/docker-compose.yaml new file mode 100644 index 0000000000..a43f3ad6f4 --- /dev/null +++ b/docs/assets/docker-compose.yaml @@ -0,0 +1,13 @@ +version: "3.8" +services: + azurehound: + image: ghcr.io/bloodhoundad/azurehound:latest + command: 'start --config /config/config.json' + container_name: azurehound + network_mode: bridge + environment: + - AZUREHOUND_CONFIG=/config/config.json + - PUID=${PUID} + - PGID=${PGID} + volumes: + - ${ROOT}/azurehound:/config \ No newline at end of file diff --git a/docs/hc/images/enterprise-logo.png b/docs/assets/enterprise-logo.png similarity index 100% rename from docs/hc/images/enterprise-logo.png rename to docs/assets/enterprise-logo.png diff --git a/docs/hc/images/image-1.png b/docs/assets/image-1.png similarity index 100% rename from docs/hc/images/image-1.png rename to docs/assets/image-1.png diff --git a/docs/hc/images/image-10.png b/docs/assets/image-10.png similarity index 100% rename from docs/hc/images/image-10.png rename to docs/assets/image-10.png diff --git a/docs/hc/images/image-100.png b/docs/assets/image-100.png similarity index 100% rename from docs/hc/images/image-100.png rename to docs/assets/image-100.png diff --git a/docs/hc/images/image-101.png b/docs/assets/image-101.png similarity index 100% rename from docs/hc/images/image-101.png rename to docs/assets/image-101.png diff --git a/docs/hc/images/image-102.png b/docs/assets/image-102.png similarity index 100% rename from docs/hc/images/image-102.png rename to docs/assets/image-102.png diff --git a/docs/hc/images/image-103.png b/docs/assets/image-103.png similarity index 100% rename from docs/hc/images/image-103.png rename to docs/assets/image-103.png diff --git a/docs/hc/images/image-104.png b/docs/assets/image-104.png similarity index 100% rename from docs/hc/images/image-104.png rename to docs/assets/image-104.png diff --git a/docs/hc/images/image-105.png b/docs/assets/image-105.png similarity index 100% rename from docs/hc/images/image-105.png rename to docs/assets/image-105.png diff --git a/docs/hc/images/image-106.png b/docs/assets/image-106.png similarity index 100% rename from docs/hc/images/image-106.png rename to docs/assets/image-106.png diff --git a/docs/hc/images/image-107.png b/docs/assets/image-107.png similarity index 100% rename from docs/hc/images/image-107.png rename to docs/assets/image-107.png diff --git a/docs/hc/images/image-108.png b/docs/assets/image-108.png similarity index 100% rename from docs/hc/images/image-108.png rename to docs/assets/image-108.png diff --git a/docs/hc/images/image-109.png b/docs/assets/image-109.png similarity index 100% rename from docs/hc/images/image-109.png rename to docs/assets/image-109.png diff --git a/docs/hc/images/image-11.png b/docs/assets/image-11.png similarity index 100% rename from docs/hc/images/image-11.png rename to docs/assets/image-11.png diff --git a/docs/hc/images/image-110.png b/docs/assets/image-110.png similarity index 100% rename from docs/hc/images/image-110.png rename to docs/assets/image-110.png diff --git a/docs/hc/images/image-111.png b/docs/assets/image-111.png similarity index 100% rename from docs/hc/images/image-111.png rename to docs/assets/image-111.png diff --git a/docs/hc/images/image-112.png b/docs/assets/image-112.png similarity index 100% rename from docs/hc/images/image-112.png rename to docs/assets/image-112.png diff --git a/docs/hc/images/image-113.png b/docs/assets/image-113.png similarity index 100% rename from docs/hc/images/image-113.png rename to docs/assets/image-113.png diff --git a/docs/hc/images/image-114.png b/docs/assets/image-114.png similarity index 100% rename from docs/hc/images/image-114.png rename to docs/assets/image-114.png diff --git a/docs/hc/images/image-115.png b/docs/assets/image-115.png similarity index 100% rename from docs/hc/images/image-115.png rename to docs/assets/image-115.png diff --git a/docs/hc/images/image-116.png b/docs/assets/image-116.png similarity index 100% rename from docs/hc/images/image-116.png rename to docs/assets/image-116.png diff --git a/docs/hc/images/image-117.png b/docs/assets/image-117.png similarity index 100% rename from docs/hc/images/image-117.png rename to docs/assets/image-117.png diff --git a/docs/hc/images/image-118.png b/docs/assets/image-118.png similarity index 100% rename from docs/hc/images/image-118.png rename to docs/assets/image-118.png diff --git a/docs/hc/images/image-119.png b/docs/assets/image-119.png similarity index 100% rename from docs/hc/images/image-119.png rename to docs/assets/image-119.png diff --git a/docs/hc/images/image-12.png b/docs/assets/image-12.png similarity index 100% rename from docs/hc/images/image-12.png rename to docs/assets/image-12.png diff --git a/docs/hc/images/image-120.png b/docs/assets/image-120.png similarity index 100% rename from docs/hc/images/image-120.png rename to docs/assets/image-120.png diff --git a/docs/hc/images/image-121.png b/docs/assets/image-121.png similarity index 100% rename from docs/hc/images/image-121.png rename to docs/assets/image-121.png diff --git a/docs/hc/images/image-122.png b/docs/assets/image-122.png similarity index 100% rename from docs/hc/images/image-122.png rename to docs/assets/image-122.png diff --git a/docs/hc/images/image-123.png b/docs/assets/image-123.png similarity index 100% rename from docs/hc/images/image-123.png rename to docs/assets/image-123.png diff --git a/docs/hc/images/image-124.png b/docs/assets/image-124.png similarity index 100% rename from docs/hc/images/image-124.png rename to docs/assets/image-124.png diff --git a/docs/hc/images/image-125.png b/docs/assets/image-125.png similarity index 100% rename from docs/hc/images/image-125.png rename to docs/assets/image-125.png diff --git a/docs/hc/images/image-126.png b/docs/assets/image-126.png similarity index 100% rename from docs/hc/images/image-126.png rename to docs/assets/image-126.png diff --git a/docs/hc/images/image-127.png b/docs/assets/image-127.png similarity index 100% rename from docs/hc/images/image-127.png rename to docs/assets/image-127.png diff --git a/docs/hc/images/image-128.png b/docs/assets/image-128.png similarity index 100% rename from docs/hc/images/image-128.png rename to docs/assets/image-128.png diff --git a/docs/hc/images/image-129.png b/docs/assets/image-129.png similarity index 100% rename from docs/hc/images/image-129.png rename to docs/assets/image-129.png diff --git a/docs/hc/images/image-13.png b/docs/assets/image-13.png similarity index 100% rename from docs/hc/images/image-13.png rename to docs/assets/image-13.png diff --git a/docs/hc/images/image-130.png b/docs/assets/image-130.png similarity index 100% rename from docs/hc/images/image-130.png rename to docs/assets/image-130.png diff --git a/docs/hc/images/image-131.png b/docs/assets/image-131.png similarity index 100% rename from docs/hc/images/image-131.png rename to docs/assets/image-131.png diff --git a/docs/hc/images/image-132.png b/docs/assets/image-132.png similarity index 100% rename from docs/hc/images/image-132.png rename to docs/assets/image-132.png diff --git a/docs/hc/images/image-133.png b/docs/assets/image-133.png similarity index 100% rename from docs/hc/images/image-133.png rename to docs/assets/image-133.png diff --git a/docs/hc/images/image-134.png b/docs/assets/image-134.png similarity index 100% rename from docs/hc/images/image-134.png rename to docs/assets/image-134.png diff --git a/docs/hc/images/image-135.png b/docs/assets/image-135.png similarity index 100% rename from docs/hc/images/image-135.png rename to docs/assets/image-135.png diff --git a/docs/hc/images/image-136.png b/docs/assets/image-136.png similarity index 100% rename from docs/hc/images/image-136.png rename to docs/assets/image-136.png diff --git a/docs/hc/images/image-137.png b/docs/assets/image-137.png similarity index 100% rename from docs/hc/images/image-137.png rename to docs/assets/image-137.png diff --git a/docs/hc/images/image-138.png b/docs/assets/image-138.png similarity index 100% rename from docs/hc/images/image-138.png rename to docs/assets/image-138.png diff --git a/docs/hc/images/image-139.png b/docs/assets/image-139.png similarity index 100% rename from docs/hc/images/image-139.png rename to docs/assets/image-139.png diff --git a/docs/hc/images/image-14.png b/docs/assets/image-14.png similarity index 100% rename from docs/hc/images/image-14.png rename to docs/assets/image-14.png diff --git a/docs/hc/images/image-140.png b/docs/assets/image-140.png similarity index 100% rename from docs/hc/images/image-140.png rename to docs/assets/image-140.png diff --git a/docs/hc/images/image-141.png b/docs/assets/image-141.png similarity index 100% rename from docs/hc/images/image-141.png rename to docs/assets/image-141.png diff --git a/docs/hc/images/image-142.png b/docs/assets/image-142.png similarity index 100% rename from docs/hc/images/image-142.png rename to docs/assets/image-142.png diff --git a/docs/hc/images/image-143.png b/docs/assets/image-143.png similarity index 100% rename from docs/hc/images/image-143.png rename to docs/assets/image-143.png diff --git a/docs/hc/images/image-144.png b/docs/assets/image-144.png similarity index 100% rename from docs/hc/images/image-144.png rename to docs/assets/image-144.png diff --git a/docs/hc/images/image-145.png b/docs/assets/image-145.png similarity index 100% rename from docs/hc/images/image-145.png rename to docs/assets/image-145.png diff --git a/docs/hc/images/image-146.png b/docs/assets/image-146.png similarity index 100% rename from docs/hc/images/image-146.png rename to docs/assets/image-146.png diff --git a/docs/hc/images/image-147.png b/docs/assets/image-147.png similarity index 100% rename from docs/hc/images/image-147.png rename to docs/assets/image-147.png diff --git a/docs/hc/images/image-148.png b/docs/assets/image-148.png similarity index 100% rename from docs/hc/images/image-148.png rename to docs/assets/image-148.png diff --git a/docs/hc/images/image-149.png b/docs/assets/image-149.png similarity index 100% rename from docs/hc/images/image-149.png rename to docs/assets/image-149.png diff --git a/docs/hc/images/image-15.png b/docs/assets/image-15.png similarity index 100% rename from docs/hc/images/image-15.png rename to docs/assets/image-15.png diff --git a/docs/hc/images/image-150.png b/docs/assets/image-150.png similarity index 100% rename from docs/hc/images/image-150.png rename to docs/assets/image-150.png diff --git a/docs/hc/images/image-151.png b/docs/assets/image-151.png similarity index 100% rename from docs/hc/images/image-151.png rename to docs/assets/image-151.png diff --git a/docs/hc/images/image-152.png b/docs/assets/image-152.png similarity index 100% rename from docs/hc/images/image-152.png rename to docs/assets/image-152.png diff --git a/docs/hc/images/image-153.png b/docs/assets/image-153.png similarity index 100% rename from docs/hc/images/image-153.png rename to docs/assets/image-153.png diff --git a/docs/hc/images/image-154.png b/docs/assets/image-154.png similarity index 100% rename from docs/hc/images/image-154.png rename to docs/assets/image-154.png diff --git a/docs/hc/images/image-155.png b/docs/assets/image-155.png similarity index 100% rename from docs/hc/images/image-155.png rename to docs/assets/image-155.png diff --git a/docs/hc/images/image-156.png b/docs/assets/image-156.png similarity index 100% rename from docs/hc/images/image-156.png rename to docs/assets/image-156.png diff --git a/docs/hc/images/image-157.png b/docs/assets/image-157.png similarity index 100% rename from docs/hc/images/image-157.png rename to docs/assets/image-157.png diff --git a/docs/hc/images/image-158.png b/docs/assets/image-158.png similarity index 100% rename from docs/hc/images/image-158.png rename to docs/assets/image-158.png diff --git a/docs/hc/images/image-16.png b/docs/assets/image-16.png similarity index 100% rename from docs/hc/images/image-16.png rename to docs/assets/image-16.png diff --git a/docs/hc/images/image-160.png b/docs/assets/image-160.png similarity index 100% rename from docs/hc/images/image-160.png rename to docs/assets/image-160.png diff --git a/docs/hc/images/image-161.png b/docs/assets/image-161.png similarity index 100% rename from docs/hc/images/image-161.png rename to docs/assets/image-161.png diff --git a/docs/hc/images/image-162.png b/docs/assets/image-162.png similarity index 100% rename from docs/hc/images/image-162.png rename to docs/assets/image-162.png diff --git a/docs/hc/images/image-163.png b/docs/assets/image-163.png similarity index 100% rename from docs/hc/images/image-163.png rename to docs/assets/image-163.png diff --git a/docs/hc/images/image-164.png b/docs/assets/image-164.png similarity index 100% rename from docs/hc/images/image-164.png rename to docs/assets/image-164.png diff --git a/docs/hc/images/image-165.png b/docs/assets/image-165.png similarity index 100% rename from docs/hc/images/image-165.png rename to docs/assets/image-165.png diff --git a/docs/hc/images/image-166.png b/docs/assets/image-166.png similarity index 100% rename from docs/hc/images/image-166.png rename to docs/assets/image-166.png diff --git a/docs/hc/images/image-167.png b/docs/assets/image-167.png similarity index 100% rename from docs/hc/images/image-167.png rename to docs/assets/image-167.png diff --git a/docs/hc/images/image-168.png b/docs/assets/image-168.png similarity index 100% rename from docs/hc/images/image-168.png rename to docs/assets/image-168.png diff --git a/docs/hc/images/image-169.png b/docs/assets/image-169.png similarity index 100% rename from docs/hc/images/image-169.png rename to docs/assets/image-169.png diff --git a/docs/hc/images/image-17.png b/docs/assets/image-17.png similarity index 100% rename from docs/hc/images/image-17.png rename to docs/assets/image-17.png diff --git a/docs/hc/images/image-170.png b/docs/assets/image-170.png similarity index 100% rename from docs/hc/images/image-170.png rename to docs/assets/image-170.png diff --git a/docs/hc/images/image-171.png b/docs/assets/image-171.png similarity index 100% rename from docs/hc/images/image-171.png rename to docs/assets/image-171.png diff --git a/docs/hc/images/image-172.png b/docs/assets/image-172.png similarity index 100% rename from docs/hc/images/image-172.png rename to docs/assets/image-172.png diff --git a/docs/hc/images/image-173.png b/docs/assets/image-173.png similarity index 100% rename from docs/hc/images/image-173.png rename to docs/assets/image-173.png diff --git a/docs/hc/images/image-174.png b/docs/assets/image-174.png similarity index 100% rename from docs/hc/images/image-174.png rename to docs/assets/image-174.png diff --git a/docs/hc/images/image-175.png b/docs/assets/image-175.png similarity index 100% rename from docs/hc/images/image-175.png rename to docs/assets/image-175.png diff --git a/docs/hc/images/image-176.png b/docs/assets/image-176.png similarity index 100% rename from docs/hc/images/image-176.png rename to docs/assets/image-176.png diff --git a/docs/hc/images/image-177.png b/docs/assets/image-177.png similarity index 100% rename from docs/hc/images/image-177.png rename to docs/assets/image-177.png diff --git a/docs/hc/images/image-178.png b/docs/assets/image-178.png similarity index 100% rename from docs/hc/images/image-178.png rename to docs/assets/image-178.png diff --git a/docs/hc/images/image-179.png b/docs/assets/image-179.png similarity index 100% rename from docs/hc/images/image-179.png rename to docs/assets/image-179.png diff --git a/docs/hc/images/image-18.png b/docs/assets/image-18.png similarity index 100% rename from docs/hc/images/image-18.png rename to docs/assets/image-18.png diff --git a/docs/hc/images/image-180.png b/docs/assets/image-180.png similarity index 100% rename from docs/hc/images/image-180.png rename to docs/assets/image-180.png diff --git a/docs/hc/images/image-181.png b/docs/assets/image-181.png similarity index 100% rename from docs/hc/images/image-181.png rename to docs/assets/image-181.png diff --git a/docs/hc/images/image-182.png b/docs/assets/image-182.png similarity index 100% rename from docs/hc/images/image-182.png rename to docs/assets/image-182.png diff --git a/docs/hc/images/image-183.png b/docs/assets/image-183.png similarity index 100% rename from docs/hc/images/image-183.png rename to docs/assets/image-183.png diff --git a/docs/hc/images/image-184.png b/docs/assets/image-184.png similarity index 100% rename from docs/hc/images/image-184.png rename to docs/assets/image-184.png diff --git a/docs/hc/images/image-185.png b/docs/assets/image-185.png similarity index 100% rename from docs/hc/images/image-185.png rename to docs/assets/image-185.png diff --git a/docs/hc/images/image-186.png b/docs/assets/image-186.png similarity index 100% rename from docs/hc/images/image-186.png rename to docs/assets/image-186.png diff --git a/docs/hc/images/image-187.png b/docs/assets/image-187.png similarity index 100% rename from docs/hc/images/image-187.png rename to docs/assets/image-187.png diff --git a/docs/hc/images/image-188.png b/docs/assets/image-188.png similarity index 100% rename from docs/hc/images/image-188.png rename to docs/assets/image-188.png diff --git a/docs/hc/images/image-189.png b/docs/assets/image-189.png similarity index 100% rename from docs/hc/images/image-189.png rename to docs/assets/image-189.png diff --git a/docs/hc/images/image-19.png b/docs/assets/image-19.png similarity index 100% rename from docs/hc/images/image-19.png rename to docs/assets/image-19.png diff --git a/docs/hc/images/image-190.png b/docs/assets/image-190.png similarity index 100% rename from docs/hc/images/image-190.png rename to docs/assets/image-190.png diff --git a/docs/hc/images/image-191.png b/docs/assets/image-191.png similarity index 100% rename from docs/hc/images/image-191.png rename to docs/assets/image-191.png diff --git a/docs/hc/images/image-192.svg b/docs/assets/image-192.svg similarity index 100% rename from docs/hc/images/image-192.svg rename to docs/assets/image-192.svg diff --git a/docs/hc/images/image-193.svg b/docs/assets/image-193.svg similarity index 100% rename from docs/hc/images/image-193.svg rename to docs/assets/image-193.svg diff --git a/docs/hc/images/image-194.svg b/docs/assets/image-194.svg similarity index 100% rename from docs/hc/images/image-194.svg rename to docs/assets/image-194.svg diff --git a/docs/hc/images/image-195.svg b/docs/assets/image-195.svg similarity index 100% rename from docs/hc/images/image-195.svg rename to docs/assets/image-195.svg diff --git a/docs/hc/images/image-2-1-1.jpg b/docs/assets/image-2-1-1.jpg similarity index 100% rename from docs/hc/images/image-2-1-1.jpg rename to docs/assets/image-2-1-1.jpg diff --git a/docs/hc/images/image-2-1.png b/docs/assets/image-2-1.png similarity index 100% rename from docs/hc/images/image-2-1.png rename to docs/assets/image-2-1.png diff --git a/docs/hc/images/image-2-10.png b/docs/assets/image-2-10.png similarity index 100% rename from docs/hc/images/image-2-10.png rename to docs/assets/image-2-10.png diff --git a/docs/hc/images/image-2-11.png b/docs/assets/image-2-11.png similarity index 100% rename from docs/hc/images/image-2-11.png rename to docs/assets/image-2-11.png diff --git a/docs/hc/images/image-2-12.png b/docs/assets/image-2-12.png similarity index 100% rename from docs/hc/images/image-2-12.png rename to docs/assets/image-2-12.png diff --git a/docs/hc/images/image-2-13.png b/docs/assets/image-2-13.png similarity index 100% rename from docs/hc/images/image-2-13.png rename to docs/assets/image-2-13.png diff --git a/docs/hc/images/image-2-14.png b/docs/assets/image-2-14.png similarity index 100% rename from docs/hc/images/image-2-14.png rename to docs/assets/image-2-14.png diff --git a/docs/hc/images/image-2-15.png b/docs/assets/image-2-15.png similarity index 100% rename from docs/hc/images/image-2-15.png rename to docs/assets/image-2-15.png diff --git a/docs/hc/images/image-2-16.png b/docs/assets/image-2-16.png similarity index 100% rename from docs/hc/images/image-2-16.png rename to docs/assets/image-2-16.png diff --git a/docs/hc/images/image-2-17.png b/docs/assets/image-2-17.png similarity index 100% rename from docs/hc/images/image-2-17.png rename to docs/assets/image-2-17.png diff --git a/docs/hc/images/image-2-18.png b/docs/assets/image-2-18.png similarity index 100% rename from docs/hc/images/image-2-18.png rename to docs/assets/image-2-18.png diff --git a/docs/hc/images/image-2-19.png b/docs/assets/image-2-19.png similarity index 100% rename from docs/hc/images/image-2-19.png rename to docs/assets/image-2-19.png diff --git a/docs/hc/images/image-2-2.png b/docs/assets/image-2-2.png similarity index 100% rename from docs/hc/images/image-2-2.png rename to docs/assets/image-2-2.png diff --git a/docs/hc/images/image-2-20.png b/docs/assets/image-2-20.png similarity index 100% rename from docs/hc/images/image-2-20.png rename to docs/assets/image-2-20.png diff --git a/docs/hc/images/image-2-21.png b/docs/assets/image-2-21.png similarity index 100% rename from docs/hc/images/image-2-21.png rename to docs/assets/image-2-21.png diff --git a/docs/hc/images/image-2-22.png b/docs/assets/image-2-22.png similarity index 100% rename from docs/hc/images/image-2-22.png rename to docs/assets/image-2-22.png diff --git a/docs/hc/images/image-2-23.png b/docs/assets/image-2-23.png similarity index 100% rename from docs/hc/images/image-2-23.png rename to docs/assets/image-2-23.png diff --git a/docs/hc/images/image-2-24.png b/docs/assets/image-2-24.png similarity index 100% rename from docs/hc/images/image-2-24.png rename to docs/assets/image-2-24.png diff --git a/docs/hc/images/image-2-25.png b/docs/assets/image-2-25.png similarity index 100% rename from docs/hc/images/image-2-25.png rename to docs/assets/image-2-25.png diff --git a/docs/hc/images/image-2-26.png b/docs/assets/image-2-26.png similarity index 100% rename from docs/hc/images/image-2-26.png rename to docs/assets/image-2-26.png diff --git a/docs/hc/images/image-2-27.png b/docs/assets/image-2-27.png similarity index 100% rename from docs/hc/images/image-2-27.png rename to docs/assets/image-2-27.png diff --git a/docs/hc/images/image-2-28.png b/docs/assets/image-2-28.png similarity index 100% rename from docs/hc/images/image-2-28.png rename to docs/assets/image-2-28.png diff --git a/docs/hc/images/image-2-29.png b/docs/assets/image-2-29.png similarity index 100% rename from docs/hc/images/image-2-29.png rename to docs/assets/image-2-29.png diff --git a/docs/hc/images/image-2-3.png b/docs/assets/image-2-3.png similarity index 100% rename from docs/hc/images/image-2-3.png rename to docs/assets/image-2-3.png diff --git a/docs/hc/images/image-2-30.png b/docs/assets/image-2-30.png similarity index 100% rename from docs/hc/images/image-2-30.png rename to docs/assets/image-2-30.png diff --git a/docs/hc/images/image-2-31.png b/docs/assets/image-2-31.png similarity index 100% rename from docs/hc/images/image-2-31.png rename to docs/assets/image-2-31.png diff --git a/docs/hc/images/image-2-32.png b/docs/assets/image-2-32.png similarity index 100% rename from docs/hc/images/image-2-32.png rename to docs/assets/image-2-32.png diff --git a/docs/hc/images/image-2-33.png b/docs/assets/image-2-33.png similarity index 100% rename from docs/hc/images/image-2-33.png rename to docs/assets/image-2-33.png diff --git a/docs/hc/images/image-2-34.png b/docs/assets/image-2-34.png similarity index 100% rename from docs/hc/images/image-2-34.png rename to docs/assets/image-2-34.png diff --git a/docs/hc/images/image-2-35.png b/docs/assets/image-2-35.png similarity index 100% rename from docs/hc/images/image-2-35.png rename to docs/assets/image-2-35.png diff --git a/docs/hc/images/image-2-36.png b/docs/assets/image-2-36.png similarity index 100% rename from docs/hc/images/image-2-36.png rename to docs/assets/image-2-36.png diff --git a/docs/hc/images/image-2-37.png b/docs/assets/image-2-37.png similarity index 100% rename from docs/hc/images/image-2-37.png rename to docs/assets/image-2-37.png diff --git a/docs/hc/images/image-2-38.png b/docs/assets/image-2-38.png similarity index 100% rename from docs/hc/images/image-2-38.png rename to docs/assets/image-2-38.png diff --git a/docs/hc/images/image-2-39.png b/docs/assets/image-2-39.png similarity index 100% rename from docs/hc/images/image-2-39.png rename to docs/assets/image-2-39.png diff --git a/docs/hc/images/image-2-4.png b/docs/assets/image-2-4.png similarity index 100% rename from docs/hc/images/image-2-4.png rename to docs/assets/image-2-4.png diff --git a/docs/hc/images/image-2-40.png b/docs/assets/image-2-40.png similarity index 100% rename from docs/hc/images/image-2-40.png rename to docs/assets/image-2-40.png diff --git a/docs/hc/images/image-2-41.png b/docs/assets/image-2-41.png similarity index 100% rename from docs/hc/images/image-2-41.png rename to docs/assets/image-2-41.png diff --git a/docs/hc/images/image-2-42.png b/docs/assets/image-2-42.png similarity index 100% rename from docs/hc/images/image-2-42.png rename to docs/assets/image-2-42.png diff --git a/docs/hc/images/image-2-43.png b/docs/assets/image-2-43.png similarity index 100% rename from docs/hc/images/image-2-43.png rename to docs/assets/image-2-43.png diff --git a/docs/hc/images/image-2-44.png b/docs/assets/image-2-44.png similarity index 100% rename from docs/hc/images/image-2-44.png rename to docs/assets/image-2-44.png diff --git a/docs/hc/images/image-2-45.png b/docs/assets/image-2-45.png similarity index 100% rename from docs/hc/images/image-2-45.png rename to docs/assets/image-2-45.png diff --git a/docs/hc/images/image-2-46.png b/docs/assets/image-2-46.png similarity index 100% rename from docs/hc/images/image-2-46.png rename to docs/assets/image-2-46.png diff --git a/docs/hc/images/image-2-47.png b/docs/assets/image-2-47.png similarity index 100% rename from docs/hc/images/image-2-47.png rename to docs/assets/image-2-47.png diff --git a/docs/hc/images/image-2-48.png b/docs/assets/image-2-48.png similarity index 100% rename from docs/hc/images/image-2-48.png rename to docs/assets/image-2-48.png diff --git a/docs/hc/images/image-2-49.png b/docs/assets/image-2-49.png similarity index 100% rename from docs/hc/images/image-2-49.png rename to docs/assets/image-2-49.png diff --git a/docs/hc/images/image-2-5.png b/docs/assets/image-2-5.png similarity index 100% rename from docs/hc/images/image-2-5.png rename to docs/assets/image-2-5.png diff --git a/docs/hc/images/image-2-50.png b/docs/assets/image-2-50.png similarity index 100% rename from docs/hc/images/image-2-50.png rename to docs/assets/image-2-50.png diff --git a/docs/hc/images/image-2-51.png b/docs/assets/image-2-51.png similarity index 100% rename from docs/hc/images/image-2-51.png rename to docs/assets/image-2-51.png diff --git a/docs/hc/images/image-2-52.png b/docs/assets/image-2-52.png similarity index 100% rename from docs/hc/images/image-2-52.png rename to docs/assets/image-2-52.png diff --git a/docs/hc/images/image-2-53.png b/docs/assets/image-2-53.png similarity index 100% rename from docs/hc/images/image-2-53.png rename to docs/assets/image-2-53.png diff --git a/docs/hc/images/image-2-54.png b/docs/assets/image-2-54.png similarity index 100% rename from docs/hc/images/image-2-54.png rename to docs/assets/image-2-54.png diff --git a/docs/hc/images/image-2-55.png b/docs/assets/image-2-55.png similarity index 100% rename from docs/hc/images/image-2-55.png rename to docs/assets/image-2-55.png diff --git a/docs/hc/images/image-2-56.png b/docs/assets/image-2-56.png similarity index 100% rename from docs/hc/images/image-2-56.png rename to docs/assets/image-2-56.png diff --git a/docs/hc/images/image-2-57.png b/docs/assets/image-2-57.png similarity index 100% rename from docs/hc/images/image-2-57.png rename to docs/assets/image-2-57.png diff --git a/docs/hc/images/image-2-58.png b/docs/assets/image-2-58.png similarity index 100% rename from docs/hc/images/image-2-58.png rename to docs/assets/image-2-58.png diff --git a/docs/hc/images/image-2-59.png b/docs/assets/image-2-59.png similarity index 100% rename from docs/hc/images/image-2-59.png rename to docs/assets/image-2-59.png diff --git a/docs/hc/images/image-2-6.png b/docs/assets/image-2-6.png similarity index 100% rename from docs/hc/images/image-2-6.png rename to docs/assets/image-2-6.png diff --git a/docs/hc/images/image-2-60.png b/docs/assets/image-2-60.png similarity index 100% rename from docs/hc/images/image-2-60.png rename to docs/assets/image-2-60.png diff --git a/docs/hc/images/image-2-61.png b/docs/assets/image-2-61.png similarity index 100% rename from docs/hc/images/image-2-61.png rename to docs/assets/image-2-61.png diff --git a/docs/hc/images/image-2-62.png b/docs/assets/image-2-62.png similarity index 100% rename from docs/hc/images/image-2-62.png rename to docs/assets/image-2-62.png diff --git a/docs/hc/images/image-2-63.png b/docs/assets/image-2-63.png similarity index 100% rename from docs/hc/images/image-2-63.png rename to docs/assets/image-2-63.png diff --git a/docs/hc/images/image-2-64.png b/docs/assets/image-2-64.png similarity index 100% rename from docs/hc/images/image-2-64.png rename to docs/assets/image-2-64.png diff --git a/docs/hc/images/image-2-65.png b/docs/assets/image-2-65.png similarity index 100% rename from docs/hc/images/image-2-65.png rename to docs/assets/image-2-65.png diff --git a/docs/hc/images/image-2-66.png b/docs/assets/image-2-66.png similarity index 100% rename from docs/hc/images/image-2-66.png rename to docs/assets/image-2-66.png diff --git a/docs/hc/images/image-2-67.png b/docs/assets/image-2-67.png similarity index 100% rename from docs/hc/images/image-2-67.png rename to docs/assets/image-2-67.png diff --git a/docs/hc/images/image-2-68.png b/docs/assets/image-2-68.png similarity index 100% rename from docs/hc/images/image-2-68.png rename to docs/assets/image-2-68.png diff --git a/docs/hc/images/image-2-69.png b/docs/assets/image-2-69.png similarity index 100% rename from docs/hc/images/image-2-69.png rename to docs/assets/image-2-69.png diff --git a/docs/hc/images/image-2-7.png b/docs/assets/image-2-7.png similarity index 100% rename from docs/hc/images/image-2-7.png rename to docs/assets/image-2-7.png diff --git a/docs/hc/images/image-2-70.png b/docs/assets/image-2-70.png similarity index 100% rename from docs/hc/images/image-2-70.png rename to docs/assets/image-2-70.png diff --git a/docs/hc/images/image-2-71.png b/docs/assets/image-2-71.png similarity index 100% rename from docs/hc/images/image-2-71.png rename to docs/assets/image-2-71.png diff --git a/docs/hc/images/image-2-72.png b/docs/assets/image-2-72.png similarity index 100% rename from docs/hc/images/image-2-72.png rename to docs/assets/image-2-72.png diff --git a/docs/hc/images/image-2-73.png b/docs/assets/image-2-73.png similarity index 100% rename from docs/hc/images/image-2-73.png rename to docs/assets/image-2-73.png diff --git a/docs/hc/images/image-2-74.png b/docs/assets/image-2-74.png similarity index 100% rename from docs/hc/images/image-2-74.png rename to docs/assets/image-2-74.png diff --git a/docs/hc/images/image-2-75.png b/docs/assets/image-2-75.png similarity index 100% rename from docs/hc/images/image-2-75.png rename to docs/assets/image-2-75.png diff --git a/docs/hc/images/image-2-76.png b/docs/assets/image-2-76.png similarity index 100% rename from docs/hc/images/image-2-76.png rename to docs/assets/image-2-76.png diff --git a/docs/hc/images/image-2-8.png b/docs/assets/image-2-8.png similarity index 100% rename from docs/hc/images/image-2-8.png rename to docs/assets/image-2-8.png diff --git a/docs/hc/images/image-2-9.png b/docs/assets/image-2-9.png similarity index 100% rename from docs/hc/images/image-2-9.png rename to docs/assets/image-2-9.png diff --git a/docs/hc/images/image-2.png b/docs/assets/image-2.png similarity index 100% rename from docs/hc/images/image-2.png rename to docs/assets/image-2.png diff --git a/docs/hc/images/image-20.png b/docs/assets/image-20.png similarity index 100% rename from docs/hc/images/image-20.png rename to docs/assets/image-20.png diff --git a/docs/hc/images/image-21.png b/docs/assets/image-21.png similarity index 100% rename from docs/hc/images/image-21.png rename to docs/assets/image-21.png diff --git a/docs/hc/images/image-22.png b/docs/assets/image-22.png similarity index 100% rename from docs/hc/images/image-22.png rename to docs/assets/image-22.png diff --git a/docs/hc/images/image-23.png b/docs/assets/image-23.png similarity index 100% rename from docs/hc/images/image-23.png rename to docs/assets/image-23.png diff --git a/docs/hc/images/image-24.png b/docs/assets/image-24.png similarity index 100% rename from docs/hc/images/image-24.png rename to docs/assets/image-24.png diff --git a/docs/hc/images/image-25.png b/docs/assets/image-25.png similarity index 100% rename from docs/hc/images/image-25.png rename to docs/assets/image-25.png diff --git a/docs/hc/images/image-26.png b/docs/assets/image-26.png similarity index 100% rename from docs/hc/images/image-26.png rename to docs/assets/image-26.png diff --git a/docs/hc/images/image-27.png b/docs/assets/image-27.png similarity index 100% rename from docs/hc/images/image-27.png rename to docs/assets/image-27.png diff --git a/docs/hc/images/image-28.png b/docs/assets/image-28.png similarity index 100% rename from docs/hc/images/image-28.png rename to docs/assets/image-28.png diff --git a/docs/hc/images/image-29.png b/docs/assets/image-29.png similarity index 100% rename from docs/hc/images/image-29.png rename to docs/assets/image-29.png diff --git a/docs/hc/images/image-3.png b/docs/assets/image-3.png similarity index 100% rename from docs/hc/images/image-3.png rename to docs/assets/image-3.png diff --git a/docs/hc/images/image-30.png b/docs/assets/image-30.png similarity index 100% rename from docs/hc/images/image-30.png rename to docs/assets/image-30.png diff --git a/docs/hc/images/image-31.png b/docs/assets/image-31.png similarity index 100% rename from docs/hc/images/image-31.png rename to docs/assets/image-31.png diff --git a/docs/hc/images/image-32.png b/docs/assets/image-32.png similarity index 100% rename from docs/hc/images/image-32.png rename to docs/assets/image-32.png diff --git a/docs/hc/images/image-33.gif b/docs/assets/image-33.gif similarity index 100% rename from docs/hc/images/image-33.gif rename to docs/assets/image-33.gif diff --git a/docs/hc/images/image-34.png b/docs/assets/image-34.png similarity index 100% rename from docs/hc/images/image-34.png rename to docs/assets/image-34.png diff --git a/docs/hc/images/image-35.png b/docs/assets/image-35.png similarity index 100% rename from docs/hc/images/image-35.png rename to docs/assets/image-35.png diff --git a/docs/hc/images/image-36.png b/docs/assets/image-36.png similarity index 100% rename from docs/hc/images/image-36.png rename to docs/assets/image-36.png diff --git a/docs/hc/images/image-37.png b/docs/assets/image-37.png similarity index 100% rename from docs/hc/images/image-37.png rename to docs/assets/image-37.png diff --git a/docs/hc/images/image-38.svg b/docs/assets/image-38.svg similarity index 100% rename from docs/hc/images/image-38.svg rename to docs/assets/image-38.svg diff --git a/docs/hc/images/image-39.png b/docs/assets/image-39.png similarity index 100% rename from docs/hc/images/image-39.png rename to docs/assets/image-39.png diff --git a/docs/hc/images/image-4.png b/docs/assets/image-4.png similarity index 100% rename from docs/hc/images/image-4.png rename to docs/assets/image-4.png diff --git a/docs/hc/images/image-40.png b/docs/assets/image-40.png similarity index 100% rename from docs/hc/images/image-40.png rename to docs/assets/image-40.png diff --git a/docs/hc/images/image-41.png b/docs/assets/image-41.png similarity index 100% rename from docs/hc/images/image-41.png rename to docs/assets/image-41.png diff --git a/docs/hc/images/image-42.png b/docs/assets/image-42.png similarity index 100% rename from docs/hc/images/image-42.png rename to docs/assets/image-42.png diff --git a/docs/hc/images/image-43.png b/docs/assets/image-43.png similarity index 100% rename from docs/hc/images/image-43.png rename to docs/assets/image-43.png diff --git a/docs/hc/images/image-44.png b/docs/assets/image-44.png similarity index 100% rename from docs/hc/images/image-44.png rename to docs/assets/image-44.png diff --git a/docs/hc/images/image-45.png b/docs/assets/image-45.png similarity index 100% rename from docs/hc/images/image-45.png rename to docs/assets/image-45.png diff --git a/docs/hc/images/image-46.png b/docs/assets/image-46.png similarity index 100% rename from docs/hc/images/image-46.png rename to docs/assets/image-46.png diff --git a/docs/hc/images/image-47.png b/docs/assets/image-47.png similarity index 100% rename from docs/hc/images/image-47.png rename to docs/assets/image-47.png diff --git a/docs/hc/images/image-48.png b/docs/assets/image-48.png similarity index 100% rename from docs/hc/images/image-48.png rename to docs/assets/image-48.png diff --git a/docs/hc/images/image-49.png b/docs/assets/image-49.png similarity index 100% rename from docs/hc/images/image-49.png rename to docs/assets/image-49.png diff --git a/docs/hc/images/image-5.png b/docs/assets/image-5.png similarity index 100% rename from docs/hc/images/image-5.png rename to docs/assets/image-5.png diff --git a/docs/hc/images/image-50.png b/docs/assets/image-50.png similarity index 100% rename from docs/hc/images/image-50.png rename to docs/assets/image-50.png diff --git a/docs/hc/images/image-51.png b/docs/assets/image-51.png similarity index 100% rename from docs/hc/images/image-51.png rename to docs/assets/image-51.png diff --git a/docs/hc/images/image-52.png b/docs/assets/image-52.png similarity index 100% rename from docs/hc/images/image-52.png rename to docs/assets/image-52.png diff --git a/docs/hc/images/image-53.png b/docs/assets/image-53.png similarity index 100% rename from docs/hc/images/image-53.png rename to docs/assets/image-53.png diff --git a/docs/hc/images/image-54.png b/docs/assets/image-54.png similarity index 100% rename from docs/hc/images/image-54.png rename to docs/assets/image-54.png diff --git a/docs/hc/images/image-55.png b/docs/assets/image-55.png similarity index 100% rename from docs/hc/images/image-55.png rename to docs/assets/image-55.png diff --git a/docs/hc/images/image-56.png b/docs/assets/image-56.png similarity index 100% rename from docs/hc/images/image-56.png rename to docs/assets/image-56.png diff --git a/docs/hc/images/image-57.png b/docs/assets/image-57.png similarity index 100% rename from docs/hc/images/image-57.png rename to docs/assets/image-57.png diff --git a/docs/hc/images/image-58.png b/docs/assets/image-58.png similarity index 100% rename from docs/hc/images/image-58.png rename to docs/assets/image-58.png diff --git a/docs/hc/images/image-6.png b/docs/assets/image-6.png similarity index 100% rename from docs/hc/images/image-6.png rename to docs/assets/image-6.png diff --git a/docs/hc/images/image-60.png b/docs/assets/image-60.png similarity index 100% rename from docs/hc/images/image-60.png rename to docs/assets/image-60.png diff --git a/docs/hc/images/image-61.png b/docs/assets/image-61.png similarity index 100% rename from docs/hc/images/image-61.png rename to docs/assets/image-61.png diff --git a/docs/hc/images/image-62.png b/docs/assets/image-62.png similarity index 100% rename from docs/hc/images/image-62.png rename to docs/assets/image-62.png diff --git a/docs/hc/images/image-63.png b/docs/assets/image-63.png similarity index 100% rename from docs/hc/images/image-63.png rename to docs/assets/image-63.png diff --git a/docs/hc/images/image-64.png b/docs/assets/image-64.png similarity index 100% rename from docs/hc/images/image-64.png rename to docs/assets/image-64.png diff --git a/docs/hc/images/image-65.png b/docs/assets/image-65.png similarity index 100% rename from docs/hc/images/image-65.png rename to docs/assets/image-65.png diff --git a/docs/hc/images/image-66.png b/docs/assets/image-66.png similarity index 100% rename from docs/hc/images/image-66.png rename to docs/assets/image-66.png diff --git a/docs/hc/images/image-67.png b/docs/assets/image-67.png similarity index 100% rename from docs/hc/images/image-67.png rename to docs/assets/image-67.png diff --git a/docs/hc/images/image-68.png b/docs/assets/image-68.png similarity index 100% rename from docs/hc/images/image-68.png rename to docs/assets/image-68.png diff --git a/docs/hc/images/image-69.png b/docs/assets/image-69.png similarity index 100% rename from docs/hc/images/image-69.png rename to docs/assets/image-69.png diff --git a/docs/hc/images/image-7.png b/docs/assets/image-7.png similarity index 100% rename from docs/hc/images/image-7.png rename to docs/assets/image-7.png diff --git a/docs/hc/images/image-70.png b/docs/assets/image-70.png similarity index 100% rename from docs/hc/images/image-70.png rename to docs/assets/image-70.png diff --git a/docs/hc/images/image-71.png b/docs/assets/image-71.png similarity index 100% rename from docs/hc/images/image-71.png rename to docs/assets/image-71.png diff --git a/docs/hc/images/image-72.png b/docs/assets/image-72.png similarity index 100% rename from docs/hc/images/image-72.png rename to docs/assets/image-72.png diff --git a/docs/hc/images/image-73.png b/docs/assets/image-73.png similarity index 100% rename from docs/hc/images/image-73.png rename to docs/assets/image-73.png diff --git a/docs/hc/images/image-74.png b/docs/assets/image-74.png similarity index 100% rename from docs/hc/images/image-74.png rename to docs/assets/image-74.png diff --git a/docs/hc/images/image-75.png b/docs/assets/image-75.png similarity index 100% rename from docs/hc/images/image-75.png rename to docs/assets/image-75.png diff --git a/docs/hc/images/image-76.png b/docs/assets/image-76.png similarity index 100% rename from docs/hc/images/image-76.png rename to docs/assets/image-76.png diff --git a/docs/hc/images/image-77.png b/docs/assets/image-77.png similarity index 100% rename from docs/hc/images/image-77.png rename to docs/assets/image-77.png diff --git a/docs/hc/images/image-78.png b/docs/assets/image-78.png similarity index 100% rename from docs/hc/images/image-78.png rename to docs/assets/image-78.png diff --git a/docs/hc/images/image-79.png b/docs/assets/image-79.png similarity index 100% rename from docs/hc/images/image-79.png rename to docs/assets/image-79.png diff --git a/docs/hc/images/image-8.png b/docs/assets/image-8.png similarity index 100% rename from docs/hc/images/image-8.png rename to docs/assets/image-8.png diff --git a/docs/hc/images/image-80.png b/docs/assets/image-80.png similarity index 100% rename from docs/hc/images/image-80.png rename to docs/assets/image-80.png diff --git a/docs/hc/images/image-81.png b/docs/assets/image-81.png similarity index 100% rename from docs/hc/images/image-81.png rename to docs/assets/image-81.png diff --git a/docs/hc/images/image-82.png b/docs/assets/image-82.png similarity index 100% rename from docs/hc/images/image-82.png rename to docs/assets/image-82.png diff --git a/docs/hc/images/image-83.png b/docs/assets/image-83.png similarity index 100% rename from docs/hc/images/image-83.png rename to docs/assets/image-83.png diff --git a/docs/hc/images/image-84.png b/docs/assets/image-84.png similarity index 100% rename from docs/hc/images/image-84.png rename to docs/assets/image-84.png diff --git a/docs/hc/images/image-85.png b/docs/assets/image-85.png similarity index 100% rename from docs/hc/images/image-85.png rename to docs/assets/image-85.png diff --git a/docs/hc/images/image-86.png b/docs/assets/image-86.png similarity index 100% rename from docs/hc/images/image-86.png rename to docs/assets/image-86.png diff --git a/docs/hc/images/image-87.webp b/docs/assets/image-87.webp similarity index 100% rename from docs/hc/images/image-87.webp rename to docs/assets/image-87.webp diff --git a/docs/hc/images/image-88.png b/docs/assets/image-88.png similarity index 100% rename from docs/hc/images/image-88.png rename to docs/assets/image-88.png diff --git a/docs/hc/images/image-89.png b/docs/assets/image-89.png similarity index 100% rename from docs/hc/images/image-89.png rename to docs/assets/image-89.png diff --git a/docs/hc/images/image-9.png b/docs/assets/image-9.png similarity index 100% rename from docs/hc/images/image-9.png rename to docs/assets/image-9.png diff --git a/docs/hc/images/image-90.png b/docs/assets/image-90.png similarity index 100% rename from docs/hc/images/image-90.png rename to docs/assets/image-90.png diff --git a/docs/hc/images/image-91.png b/docs/assets/image-91.png similarity index 100% rename from docs/hc/images/image-91.png rename to docs/assets/image-91.png diff --git a/docs/hc/images/image-92.png b/docs/assets/image-92.png similarity index 100% rename from docs/hc/images/image-92.png rename to docs/assets/image-92.png diff --git a/docs/hc/images/image-93.png b/docs/assets/image-93.png similarity index 100% rename from docs/hc/images/image-93.png rename to docs/assets/image-93.png diff --git a/docs/hc/images/image-94.png b/docs/assets/image-94.png similarity index 100% rename from docs/hc/images/image-94.png rename to docs/assets/image-94.png diff --git a/docs/hc/images/image-95.png b/docs/assets/image-95.png similarity index 100% rename from docs/hc/images/image-95.png rename to docs/assets/image-95.png diff --git a/docs/hc/images/image-96.png b/docs/assets/image-96.png similarity index 100% rename from docs/hc/images/image-96.png rename to docs/assets/image-96.png diff --git a/docs/hc/images/image-97.png b/docs/assets/image-97.png similarity index 100% rename from docs/hc/images/image-97.png rename to docs/assets/image-97.png diff --git a/docs/hc/images/image-98.png b/docs/assets/image-98.png similarity index 100% rename from docs/hc/images/image-98.png rename to docs/assets/image-98.png diff --git a/docs/hc/images/image-99.png b/docs/assets/image-99.png similarity index 100% rename from docs/hc/images/image-99.png rename to docs/assets/image-99.png diff --git a/docs/hc/images/image1-1.png b/docs/assets/image1-1.png similarity index 100% rename from docs/hc/images/image1-1.png rename to docs/assets/image1-1.png diff --git a/docs/hc/images/image1-10.png b/docs/assets/image1-10.png similarity index 100% rename from docs/hc/images/image1-10.png rename to docs/assets/image1-10.png diff --git a/docs/hc/images/image1-11.png b/docs/assets/image1-11.png similarity index 100% rename from docs/hc/images/image1-11.png rename to docs/assets/image1-11.png diff --git a/docs/hc/images/image1-12.png b/docs/assets/image1-12.png similarity index 100% rename from docs/hc/images/image1-12.png rename to docs/assets/image1-12.png diff --git a/docs/hc/images/image1-13.png b/docs/assets/image1-13.png similarity index 100% rename from docs/hc/images/image1-13.png rename to docs/assets/image1-13.png diff --git a/docs/hc/images/image1-14.png b/docs/assets/image1-14.png similarity index 100% rename from docs/hc/images/image1-14.png rename to docs/assets/image1-14.png diff --git a/docs/hc/images/image1-15.png b/docs/assets/image1-15.png similarity index 100% rename from docs/hc/images/image1-15.png rename to docs/assets/image1-15.png diff --git a/docs/hc/images/image1-16.png b/docs/assets/image1-16.png similarity index 100% rename from docs/hc/images/image1-16.png rename to docs/assets/image1-16.png diff --git a/docs/hc/images/image1-17.png b/docs/assets/image1-17.png similarity index 100% rename from docs/hc/images/image1-17.png rename to docs/assets/image1-17.png diff --git a/docs/hc/images/image1-18.png b/docs/assets/image1-18.png similarity index 100% rename from docs/hc/images/image1-18.png rename to docs/assets/image1-18.png diff --git a/docs/hc/images/image1-19.png b/docs/assets/image1-19.png similarity index 100% rename from docs/hc/images/image1-19.png rename to docs/assets/image1-19.png diff --git a/docs/hc/images/image1-2.png b/docs/assets/image1-2.png similarity index 100% rename from docs/hc/images/image1-2.png rename to docs/assets/image1-2.png diff --git a/docs/hc/images/image1-20.png b/docs/assets/image1-20.png similarity index 100% rename from docs/hc/images/image1-20.png rename to docs/assets/image1-20.png diff --git a/docs/hc/images/image1-21.png b/docs/assets/image1-21.png similarity index 100% rename from docs/hc/images/image1-21.png rename to docs/assets/image1-21.png diff --git a/docs/hc/images/image1-22.png b/docs/assets/image1-22.png similarity index 100% rename from docs/hc/images/image1-22.png rename to docs/assets/image1-22.png diff --git a/docs/hc/images/image1-23.png b/docs/assets/image1-23.png similarity index 100% rename from docs/hc/images/image1-23.png rename to docs/assets/image1-23.png diff --git a/docs/hc/images/image1-24.png b/docs/assets/image1-24.png similarity index 100% rename from docs/hc/images/image1-24.png rename to docs/assets/image1-24.png diff --git a/docs/hc/images/image1-25.png b/docs/assets/image1-25.png similarity index 100% rename from docs/hc/images/image1-25.png rename to docs/assets/image1-25.png diff --git a/docs/hc/images/image1-26.png b/docs/assets/image1-26.png similarity index 100% rename from docs/hc/images/image1-26.png rename to docs/assets/image1-26.png diff --git a/docs/hc/images/image1-27.png b/docs/assets/image1-27.png similarity index 100% rename from docs/hc/images/image1-27.png rename to docs/assets/image1-27.png diff --git a/docs/hc/images/image1-3.png b/docs/assets/image1-3.png similarity index 100% rename from docs/hc/images/image1-3.png rename to docs/assets/image1-3.png diff --git a/docs/hc/images/image1-4.png b/docs/assets/image1-4.png similarity index 100% rename from docs/hc/images/image1-4.png rename to docs/assets/image1-4.png diff --git a/docs/hc/images/image1-5.png b/docs/assets/image1-5.png similarity index 100% rename from docs/hc/images/image1-5.png rename to docs/assets/image1-5.png diff --git a/docs/hc/images/image1-6.png b/docs/assets/image1-6.png similarity index 100% rename from docs/hc/images/image1-6.png rename to docs/assets/image1-6.png diff --git a/docs/hc/images/image1-7.png b/docs/assets/image1-7.png similarity index 100% rename from docs/hc/images/image1-7.png rename to docs/assets/image1-7.png diff --git a/docs/hc/images/image1-8.png b/docs/assets/image1-8.png similarity index 100% rename from docs/hc/images/image1-8.png rename to docs/assets/image1-8.png diff --git a/docs/hc/images/image1-9.png b/docs/assets/image1-9.png similarity index 100% rename from docs/hc/images/image1-9.png rename to docs/assets/image1-9.png diff --git a/docs/hc/images/mceclip0-1.png b/docs/assets/mceclip0-1.png similarity index 100% rename from docs/hc/images/mceclip0-1.png rename to docs/assets/mceclip0-1.png diff --git a/docs/hc/images/mceclip1-2.png b/docs/assets/mceclip1-2.png similarity index 100% rename from docs/hc/images/mceclip1-2.png rename to docs/assets/mceclip1-2.png diff --git a/docs/hc/images/mceclip2-3.png b/docs/assets/mceclip2-3.png similarity index 100% rename from docs/hc/images/mceclip2-3.png rename to docs/assets/mceclip2-3.png diff --git a/docs/hc/images/mceclip3-4.png b/docs/assets/mceclip3-4.png similarity index 100% rename from docs/hc/images/mceclip3-4.png rename to docs/assets/mceclip3-4.png diff --git a/docs/hc/en-us/articles/All-AzureHound-Community-Edition-Flags-Explained.mdx b/docs/collect-data/ce-collection/azurehound-flags.mdx similarity index 98% rename from docs/hc/en-us/articles/All-AzureHound-Community-Edition-Flags-Explained.mdx rename to docs/collect-data/ce-collection/azurehound-flags.mdx index 7a6478d3f2..1e8a69e6fa 100644 --- a/docs/hc/en-us/articles/All-AzureHound-Community-Edition-Flags-Explained.mdx +++ b/docs/collect-data/ce-collection/azurehound-flags.mdx @@ -3,7 +3,7 @@ title: All AzureHound Community Edition Flags, Explained --- - + AzureHound Community Edition has several optional flags that let you control scan scope, performance, output, and other behaviors. diff --git a/docs/hc/en-us/articles/AzureHound-Community-Edition.mdx b/docs/collect-data/ce-collection/azurehound.mdx similarity index 98% rename from docs/hc/en-us/articles/AzureHound-Community-Edition.mdx rename to docs/collect-data/ce-collection/azurehound.mdx index c1aad5bc13..b612e70b56 100644 --- a/docs/hc/en-us/articles/AzureHound-Community-Edition.mdx +++ b/docs/collect-data/ce-collection/azurehound.mdx @@ -3,7 +3,7 @@ title: AzureHound Community Edition --- - + AzureHound Community Edition is a Go binary that collects data from Entra ID (formerly known as AzureAD) and AzureRM via the Microsoft Graph and Azure REST APIs. It does not use any external dependencies and will run on any operating system. diff --git a/docs/collect-data/ce-collection/overview.mdx b/docs/collect-data/ce-collection/overview.mdx new file mode 100644 index 0000000000..b97fbeb780 --- /dev/null +++ b/docs/collect-data/ce-collection/overview.mdx @@ -0,0 +1,11 @@ +--- +title: BloodHound CE Collection +sidebarTitle: Overview +mode: wide +--- + +Learn about attack path data collection in BloodHound Community Edition. + +FollowFollow Section + + diff --git a/docs/hc/en-us/articles/All-SharpHound-Community-Edition-Flags-Explained.mdx b/docs/collect-data/ce-collection/sharphound-flags.mdx similarity index 99% rename from docs/hc/en-us/articles/All-SharpHound-Community-Edition-Flags-Explained.mdx rename to docs/collect-data/ce-collection/sharphound-flags.mdx index c41fbfe0eb..f525d4c8b2 100644 --- a/docs/hc/en-us/articles/All-SharpHound-Community-Edition-Flags-Explained.mdx +++ b/docs/collect-data/ce-collection/sharphound-flags.mdx @@ -3,7 +3,7 @@ title: All SharpHound Community Edition Flags, Explained --- - + SharpHound Community Edition has several optional flags that let you control scan scope, performance, output, and other behaviors. @@ -46,7 +46,7 @@ C:\> SharpHound.exe --CollectionMethods session Collection methods visualization: - + Image credit: [https://twitter.com/SadProcessor](https://twitter.com/SadProcessor) diff --git a/docs/hc/en-us/articles/SharpHound-Community-Edition.mdx b/docs/collect-data/ce-collection/sharphound.mdx similarity index 99% rename from docs/hc/en-us/articles/SharpHound-Community-Edition.mdx rename to docs/collect-data/ce-collection/sharphound.mdx index cc7a513b85..d74cf8f266 100644 --- a/docs/hc/en-us/articles/SharpHound-Community-Edition.mdx +++ b/docs/collect-data/ce-collection/sharphound.mdx @@ -4,7 +4,7 @@ description: "SharpHound Community Edition (CE) is the official data collector f --- - + SharpHound CE can be obtained in a few ways: diff --git a/docs/hc/en-us/articles/Ad-hoc-BHE-Data-Collection-with-SharpHound-CE.mdx b/docs/collect-data/enterprise-collection/ad-hoc-collection.mdx similarity index 81% rename from docs/hc/en-us/articles/Ad-hoc-BHE-Data-Collection-with-SharpHound-CE.mdx rename to docs/collect-data/enterprise-collection/ad-hoc-collection.mdx index 551829bb99..5ce4ab7586 100644 --- a/docs/hc/en-us/articles/Ad-hoc-BHE-Data-Collection-with-SharpHound-CE.mdx +++ b/docs/collect-data/enterprise-collection/ad-hoc-collection.mdx @@ -3,14 +3,14 @@ title: Ad-hoc BHE Data Collection with SharpHound CE --- - + ## Purpose This guide explains how to collect data ad-hoc for BloodHound Enterprise (BHE) using the BloodHound Community Edition (BHCE) collector: SharpHound CE. -It should be used by BloodHound Enterprise users who cannot deploy [SharpHound Enterprise](/hc/en-us/articles/SharpHound-Enterprise-System-Requirements-and-Deployment-Process), for example in: +It should be used by BloodHound Enterprise users who cannot deploy [SharpHound Enterprise](/install-data-collector/install-sharphound/system-requirements), for example in: * Environments with no internet access, such as SCADA or OT environments * Merger and acquisition scenarios, to assess risk before to assess risk before integration or consolidation of IT infrastructure @@ -22,7 +22,7 @@ SharpHound CE collects the same data as SharpHound Enterprise since they both us ## Prerequisites -* Logged in as a user role, which is authorized to perform file ingest, see [Administering users and roles](/hc/en-us/articles/Administering-users-and-roles) +* Logged in as a user role, which is authorized to perform file ingest, see [Administering users and roles](/manage-bloodhound/auth/users-and-roles) * Access to an account and computer in the in-scope domain or a domain trusted by the in-scope domain ## Process @@ -34,9 +34,9 @@ SharpHound CE collects the same data as SharpHound Enterprise since they both us * `DCOnly` is the recommended starting method and is equivalent to BHE's Active Directory Structure Data + Certificate Services * `All` performs all collection methods * Learn about collection methods and flags: - * [SharpHound Community Edition](/hc/en-us/articles/SharpHound-Community-Edition) - * [All SharpHound Community Edition Flags, Explained](/hc/en-us/articles/All-SharpHound-Community-Edition-Flags-Explained) - * [SharpHound Enterprise Data Collection and Permissions](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions) + * [SharpHound Community Edition](/collect-data/ce-collection/sharphound) + * [All SharpHound Community Edition Flags, Explained](/collect-data/ce-collection/sharphound-flags) + * [SharpHound Enterprise Data Collection and Permissions](/collect-data/enterprise-collection/permissions) 3. Start the collection ``` .\SharpHound.exe -c DCOnly @@ -50,15 +50,15 @@ SharpHound CE collects the same data as SharpHound Enterprise since they both us * From the Main Screen, click on the cog wheel in the upper right hand corner * From the drop down menu, select 'Administration' - + * In the left margin, select 'File Ingest' under the 'Data Collection' heading - + 3. Select 'Upload File(s)' and in the pop-up window, drag and drop the output '.zip' file and selecrt 'Upload' - + 4. BloodHound Enterprise will parse and process the data, making it available for analysis @@ -76,6 +76,5 @@ SharpHound CE collects the same data as SharpHound Enterprise since they both us ## Outcome - Once ingest and analysis is completed, BloodHound Enterprise will present a comprehensive report with actionable recommendations on the Attack Paths page. diff --git a/docs/hc/en-us/articles/Create-a-data-collection-schedule.mdx b/docs/collect-data/enterprise-collection/collection-schedule.mdx similarity index 60% rename from docs/hc/en-us/articles/Create-a-data-collection-schedule.mdx rename to docs/collect-data/enterprise-collection/collection-schedule.mdx index 63cb25c223..ad0c1578e7 100644 --- a/docs/hc/en-us/articles/Create-a-data-collection-schedule.mdx +++ b/docs/collect-data/enterprise-collection/collection-schedule.mdx @@ -2,44 +2,44 @@ title: Create a data collection schedule --- - + ## Purpose This article outlines how to create a collection schedule on a collector client that will ensure continuous data collection. BHE administrators should use it when deploying a new client or adding an additional schedule to an existing client. -Generally, Azure and Active Directory Structure do not change significantly enough to warrant more than daily collection.  Local Groups and Sessions can be scheduled to collect every 7 hours to ensure a good sampling of round-the-clock activity. +Generally, Azure and Active Directory Structure do not change significantly enough to warrant more than daily collection. Local Groups and Sessions can be scheduled to collect every 7 hours to ensure a good sampling of round-the-clock activity. ## Prerequisites -* Creation of one SharpHound Enterprise client, see [Create a SharpHound Enterprise collector client](/hc/en-us/articles/Create-a-BloodHound-Enterprise-collector-client) -* Logged in as a user role which is authorized to modify clients, see [User Role Definitions](/hc/en-us/articles/Administering-users-and-roles) +* Creation of one SharpHound Enterprise client, see [Create a SharpHound Enterprise collector client](/collect-data/enterprise-collection/create-collector) +* Logged in as a user role which is authorized to modify clients, see [User Role Definitions](/manage-bloodhound/auth/users-and-roles) ## Process 1. In the top right, click settings ⚙️ → **Administration** - + 2. In the top left side, click **Manage Clients** - + 3. On a client, click the burger menu and select **Edit Client** - + 4. In the _Edit SharpHound Client_ window, under the heading _Collection Schedule_, click the **\+ icon** to add a new schedule. - + 5. In the _Schedule_ window, configure the schedule: * **Start Date**: The time on which the first collection should run * **Frequency**: The frequency of the schedule - * **Data**: The type of data the schedule collects, see [SharpHound Enterprise Data Collection and Permissions](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions) - * **Advanced Options**: See the [Scanning section in the article SharpHound Enterprise Tenant Configuration](/hc/en-us/articles/SharpHound-Enterprise-Tenant-Configuration#h_01GECVA74SF7JN7XRYPFBXASYW) + * **Data**: The type of data the schedule collects, see [SharpHound Enterprise Data Collection and Permissions](/collect-data/enterprise-collection/permissions) + * **Advanced Options**: See the [Scanning section in the article SharpHound Enterprise Tenant Configuration](/install-data-collector/install-sharphound/tenant-configuration#h_01GECVA74SF7JN7XRYPFBXASYW) - + 6. Save the schedule by clicking **Save** 7. Save the collector client by clicking **Save** @@ -51,10 +51,10 @@ The client is now configured for continuous data collection with one schedule. Y A brief of a client's schedule is shown in the client table's column _Collection Schedule_. - + -After the next schedule, see the job's status in the _Finished Jobs Log_ by clicking ⚙️ → **Administration**, and in the top left side, click **Finished Jobs** **Log**_. _The columns **Status** and **Status Message** report on the job's completion. +After the next schedule, see the job's status in the _Finished Jobs Log_ by clicking ⚙️ → **Administration**, and in the top left side, click **Finished Jobs** **Log**_. _The columns **Status** and **Status Message** report on the job's completion. - + diff --git a/docs/hc/en-us/articles/Create-a-BloodHound-Enterprise-collector-client.mdx b/docs/collect-data/enterprise-collection/create-collector.mdx similarity index 73% rename from docs/hc/en-us/articles/Create-a-BloodHound-Enterprise-collector-client.mdx rename to docs/collect-data/enterprise-collection/create-collector.mdx index ad65eb9394..6065e15335 100644 --- a/docs/hc/en-us/articles/Create-a-BloodHound-Enterprise-collector-client.mdx +++ b/docs/collect-data/enterprise-collection/create-collector.mdx @@ -3,7 +3,7 @@ title: Create a BloodHound Enterprise collector client --- - + ## Purpose @@ -18,34 +18,34 @@ It should be used by BloodHound Enterprise (BHE) administrators when deploying S ## Prerequisites * Having deployed a BloodHound Enterprise Tenant -* Logged in as a user role, which is authorized to create a new collector client, see [Administering users and roles](/hc/en-us/articles/Administering-users-and-roles) +* Logged in as a user role, which is authorized to create a new collector client, see [Administering users and roles](/manage-bloodhound/auth/users-and-roles) ## Process 1. In the top right, click settings ⚙️ → **Administration** - + 2. In the top left side, click **Manage Clients** - + 3. On the right side, click **Create Client** and, from the drop-down, select one of the collector clients, for example **Create SharpHound Client** - + 4. In the pop-up window, for example named _New SharpHound Client_, input the **Client Name** and click **CREATE** - + 5. The pop-up window _Client Token Info_ will appear; follow the instructions in it - save the key before clicking **CLOSE** - + ## Outcome The collector client will appear in the **Manage Clients** table with a **Status** of **Unconfigured**. - + diff --git a/docs/hc/en-us/articles/SharpHound-Enterprise-Cross-Trust-Collection.mdx b/docs/collect-data/enterprise-collection/cross-trust.mdx similarity index 87% rename from docs/hc/en-us/articles/SharpHound-Enterprise-Cross-Trust-Collection.mdx rename to docs/collect-data/enterprise-collection/cross-trust.mdx index c712434d94..42fc2d2a5c 100644 --- a/docs/hc/en-us/articles/SharpHound-Enterprise-Cross-Trust-Collection.mdx +++ b/docs/collect-data/enterprise-collection/cross-trust.mdx @@ -3,7 +3,7 @@ title: SharpHound Enterprise Cross-Trust Collection --- - + By default, SharpHound Enterprise only collects data from the same domain the service account belongs to. However, it is possible to configure the collection scope to include domains trusting the service account domain. @@ -15,7 +15,7 @@ When configuring a SharpHound Enterprise client, it is possible to specify addit Alternatively, the SharpHound Enterprise client can collect from all domains trusting the service account domain by checking the option "_Collect from all domains trusting the SharpHound service account, including transitively"._ This option will also collect from trusting domains in other forests. - + If selective authentication is enabled on a trust, the SharpHound Enterprise service account must explicitly be granted read permissions on all AD objects in all domains of the targeted forest to perform collection. @@ -28,13 +28,13 @@ Kerberos authentication works by default for all Active Directory trust types ex Administrators can enable Kerberos authentication across external trusts by adding the name of the other domain to the [Use forest search order](https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.Kerberos::ForestSearch) policy setting on Domain Controllers. - + We recommend deploying this setting to all Domain Controllers in domains with external trusts to avoid using the older and less secure NTLM authentication. ### LDAP Authentication Auto-Negotiation -SharpHound Enterprise will, by default, only support Kerberos authentication for the LDAP connections to Domain Controllers for Active Directory Structure Data collection. This will cause the collection across the external trust to fail without modifying SharpHound's default behavior in the configuration file "settings.json". The configuration file default path is described in [SharpHound Enterprise Local Configuration](/hc/en-us/articles/SharpHound-Enterprise-Local-Configuration). +SharpHound Enterprise will, by default, only support Kerberos authentication for the LDAP connections to Domain Controllers for Active Directory Structure Data collection. This will cause the collection across the external trust to fail without modifying SharpHound's default behavior in the configuration file "settings.json". The configuration file default path is described in [SharpHound Enterprise Local Configuration](/install-data-collector/install-sharphound/local-configuration). To enable support for auto-negotiation in LDAP connections: @@ -44,7 +44,7 @@ To enable support for auto-negotiation in LDAP connections: 4. Save settings.json 5. Start the SharpHound Delegator service. -If NTLM-fallback is enabled, we recommend denying outbound NTLM authentication from the SharpHound server to all servers except Domain Controllers in domains with external trust relationships, as described in the [SharpHound Service Hardening Guidelines](/hc/en-us/articles/SharpHound-Enterprise-Service-Hardening) in the _NTLM cracking (and relaying) remediation_ section. +If NTLM-fallback is enabled, we recommend denying outbound NTLM authentication from the SharpHound server to all servers except Domain Controllers in domains with external trust relationships, as described in [SharpHound Service Hardening Guidelines](/manage-bloodhound/securing-bloodhound-and-collectors/sharphound-hardening) in the _NTLM cracking (and relaying) remediation_ section. ## Troubleshoot Cross-Trust Collection diff --git a/docs/hc/en-us/articles/Data-reconciliation-and-retention.mdx b/docs/collect-data/enterprise-collection/data-retention.mdx similarity index 67% rename from docs/hc/en-us/articles/Data-reconciliation-and-retention.mdx rename to docs/collect-data/enterprise-collection/data-retention.mdx index dbd19c026e..b5f6498dfe 100644 --- a/docs/hc/en-us/articles/Data-reconciliation-and-retention.mdx +++ b/docs/collect-data/enterprise-collection/data-retention.mdx @@ -3,7 +3,7 @@ title: Data reconciliation and retention --- - + ## Data reconciliation @@ -12,13 +12,13 @@ BloodHound Enterprise (BHE) will perform data reconciliation. That is, BHE will ### HasSession edge reconciliation -[HasSession](/hc/en-us/articles/HasSession) edges are generated to indicate patterns of behavior rather than session active at any exact moment. For this reason, HasSession edges are only reconciled based on their retention/time-to-live expiring, rather than reconciling upon follow-on collections no longer seeing the active session. +[HasSession](/resources/edges/has-session) edges are generated to indicate patterns of behavior rather than session active at any exact moment. For this reason, HasSession edges are only reconciled based on their retention/time-to-live expiring, rather than reconciling upon follow-on collections no longer seeing the active session. ## Data retention BloodHound Enterprise (BHE) implements data retention, i.e., a time-to-live where data that has not been collected and ingested for a certain period will get deleted from BHE. This retention period is configurable and is by default: -* Session Data, i.e. [HasSession](/hc/en-us/articles/HasSession) edges: 3 days +* Session Data, i.e. [HasSession](/resources/edges/has-session) edges: 3 days * General Data, i.e. objects/nodes and relationships/edges, excluding HasSession edges: 7 days Tier Zero tags on deleted nodes will remain, and the Group Management page will show the deleted node as an object ID. @@ -26,25 +26,25 @@ Tier Zero tags on deleted nodes will remain, and the Group Management page will Data retention periods can be changed at ⚙️ > Administration > BloodHound Configuration: - + -Retention means BHE does not assume that lack of visibility during a single collection means that an object or edge no longer exists; it’s possible that the most recent collection, for example, if BHE doesn't see a user object for some reason (operational issue, collection scoped to another domain, etc.). +Retention means BHE does not assume that lack of visibility during a single collection means that an object or edge no longer exists; it's possible that the most recent collection, for example, if BHE doesn't see a user object for some reason (operational issue, collection scoped to another domain, etc.). On objects, this timestamp is updated for both visibility of the object itself and visibility to references of the object. For example, if an object is deleted, but the SID remains present in an ACE applied to some other remaining object, this timestamp will be updated, and the object will appear present in BHE. -To implement this, BHE stores a timestamp on every data point, updated whenever a new collection includes the same data point. The timestamp on nodes can be seen as the “Last Collected by BloodHound” attribute in every node’s entity panel on the “Explore” page. +To implement this, BHE stores a timestamp on every data point, updated whenever a new collection includes the same data point. The timestamp on nodes can be seen as the "Last Collected by BloodHound" attribute in every node's entity panel on the "Explore" page. - + -In cases where retention maintains visibility into an already resolved finding, the “Mute” feature may be used to hide nodes/principals in the “Attack Paths” page, see [Mute/unmute attack path finding](/hc/en-us/articles/Mute-unmute-attack-path-finding). +In cases where retention maintains visibility into an already resolved finding, the "Mute" feature may be used to hide nodes/principals in the "Attack Paths" page, see [Mute/unmute attack path finding](/analyze-data/bloodhound-gui/mute-paths). ### Active Directory recycle bin -BHE's data retention period starts once an object has been permanently deleted from Active Directory, that is, after the object has left retention in the AD recycle bin. By default, the AD recycle bin has a retention (tombstone lifetime) of 180 days; thus, the default total retention for nodes will be 180 days + 7 days = 187 days. +BHE's data retention period starts once an object has been permanently deleted from Active Directory, that is, after the object has left retention in the AD recycle bin. By default, the AD recycle bin has a retention (tombstone lifetime) of 180 days; thus, the default total retention for nodes will be 180 days + 7 days = 187 days. Check if the AD recycle bin has been enabled for the forest: ```json diff --git a/docs/hc/en-us/articles/SharpHound-Collection-FAQ.mdx b/docs/collect-data/enterprise-collection/faq.mdx similarity index 98% rename from docs/hc/en-us/articles/SharpHound-Collection-FAQ.mdx rename to docs/collect-data/enterprise-collection/faq.mdx index d1dce36159..f133968161 100644 --- a/docs/hc/en-us/articles/SharpHound-Collection-FAQ.mdx +++ b/docs/collect-data/enterprise-collection/faq.mdx @@ -4,7 +4,7 @@ description: "The following are common questions about the data collection capab --- - + diff --git a/docs/hc/en-us/articles/Run-an-On-Demand-Scan.mdx b/docs/collect-data/enterprise-collection/on-demand-scan.mdx similarity index 58% rename from docs/hc/en-us/articles/Run-an-On-Demand-Scan.mdx rename to docs/collect-data/enterprise-collection/on-demand-scan.mdx index 258b4c757a..42090c7737 100644 --- a/docs/hc/en-us/articles/Run-an-On-Demand-Scan.mdx +++ b/docs/collect-data/enterprise-collection/on-demand-scan.mdx @@ -3,7 +3,7 @@ title: Run an On Demand Scan --- - + ## Purpose @@ -12,29 +12,29 @@ This article outlines how to run an On Demand Scan to perform a one-time immedia ## Prerequisites -* Creation of one SharpHound Enterprise client, see [Create a SharpHound Enterprise collector client](/hc/en-us/articles/Create-a-BloodHound-Enterprise-collector-client) -* Logged in as a user role which is authorized to run an On Demand Scan, see [User Role Definitions](/hc/en-us/articles/Administering-users-and-roles#h_01H6P9MK1XME9F91NR95XJXR3Z) +* Creation of one SharpHound Enterprise client, see [Create a SharpHound Enterprise collector client](/collect-data/enterprise-collection/create-collector) +* Logged in as a user role which is authorized to run an On Demand Scan, see [User Role Definitions](/manage-bloodhound/auth/users-and-roles#h_01H6P9MK1XME9F91NR95XJXR3Z) ## Process 1. In the top right, click settings ⚙️ → **Administration** - + 2. In the top left side, click **Manage Clients** - + -3. On the client, click the burger menu and select **On Demand Scan**  +3. On the client, click the burger menu and select **On Demand Scan** * Tip: Verify the client is online by validating **Status** is **Ready** - + 4. In the _On Demand Scan_ window, configure the scan: - 1. **Data**: The type of data the schedule collects, see [SharpHound Enterprise Data Collection and Permissions](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions) - 2. **Advanced Options**: See the [Scanning section in the article SharpHound Enterprise Tenant Configuration](/hc/en-us/articles/SharpHound-Enterprise-Tenant-Configuration#h_01GECVA74SF7JN7XRYPFBXASYW) + 1. **Data**: The type of data the schedule collects, see [SharpHound Enterprise Data Collection and Permissions](/collect-data/enterprise-collection/permissions) + 2. **Advanced Options**: See the [Scanning section in the article SharpHound Enterprise Tenant Configuration](/install-data-collector/install-sharphound/tenant-configuration#h_01GECVA74SF7JN7XRYPFBXASYW) - + 5. Start the scan by clicking **Run** @@ -45,12 +45,12 @@ The client will start the On Demand Scan after the next client check-in, usually Once started, the client's **Status** will show **Running a Job**: - + -After completion, see the job's status in the _Finished Jobs Log_ by clicking ⚙️ → **Administration**, and in the top left side, click **Finished Jobs** **Log**_. _The columns **Status** and **Status Message** report on the job's completion. +After completion, see the job's status in the _Finished Jobs Log_ by clicking ⚙️ → **Administration**, and in the top left side, click **Finished Jobs** **Log**_. _The columns **Status** and **Status Message** report on the job's completion. - + diff --git a/docs/collect-data/enterprise-collection/overview.mdx b/docs/collect-data/enterprise-collection/overview.mdx new file mode 100644 index 0000000000..d9d8b798cb --- /dev/null +++ b/docs/collect-data/enterprise-collection/overview.mdx @@ -0,0 +1,19 @@ +--- +title: BloodHound Enterprise Collection +sidebarTitle: Overview +description: "Learn about attack path data collection in BloodHound Enterprise." +--- + + + + + Promoted article + Promoted article + + + + + + + + \ No newline at end of file diff --git a/docs/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions.mdx b/docs/collect-data/enterprise-collection/permissions.mdx similarity index 80% rename from docs/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions.mdx rename to docs/collect-data/enterprise-collection/permissions.mdx index b55efd51c0..a5a72e8996 100644 --- a/docs/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions.mdx +++ b/docs/collect-data/enterprise-collection/permissions.mdx @@ -3,23 +3,23 @@ title: SharpHound Enterprise Data Collection and Permissions --- - + SharpHound Enterprise data collection utilizes the open-source [SharpHound Common](https://github.com/BloodHoundAD/SharpHoundCommon) library, maintained by the BloodHound Enterprise Engineering team. -In BloodHound Enterprise you can start scans for different data types via a [collection schedule](/hc/en-us/articles/Create-a-data-collection-schedule) or an [on-demand scan](/hc/en-us/articles/Run-an-On-Demand-Scan), the data types are: +In BloodHound Enterprise you can start scans for different data types via a [collection schedule](/collect-data/enterprise-collection/collection-schedule) or an [on-demand scan](/collect-data/enterprise-collection/on-demand-scan), the data types are: -* [Active Directory Structure Data](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions#ad-structure-data) +* [Active Directory Structure Data](/collect-data/enterprise-collection/permissions#ad-structure-data) * _Local Groups_, collecting: - * [Local Group Membership](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions#local-group-membership) - * [User Rights Assignments](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions#user-rights-assignments) -* [Sessions](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions#sessions) -* [Certificate Services](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions#certificate-services) -* [DC Registry](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions#dc-registry) -* [CA Registry](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions#ca-registry) + * [Local Group Membership](/collect-data/enterprise-collection/permissions#local-group-membership) + * [User Rights Assignments](/collect-data/enterprise-collection/permissions#user-rights-assignments) +* [Sessions](/collect-data/enterprise-collection/permissions#sessions) +* [Certificate Services](/collect-data/enterprise-collection/permissions#certificate-services) +* [DC Registry](/collect-data/enterprise-collection/permissions#dc-registry) +* [CA Registry](/collect-data/enterprise-collection/permissions#ca-registry) -Local Groups and Sessions can only be collected from domain-joined Windows systems, and require privileged collection to be configured, see [Why perform privileged collection in SharpHound](/hc/en-us/articles/Why-perform-privileged-collection-in-SharpHound). This collection helps understand Attack Paths to individual systems based on non-centralized configurations. +Local Groups and Sessions can only be collected from domain-joined Windows systems, and require privileged collection to be configured, see [Why perform privileged collection in SharpHound](/collect-data/enterprise-collection/privileged-collection). This collection helps understand Attack Paths to individual systems based on non-centralized configurations. ## AD Structure Data @@ -39,7 +39,7 @@ SharpHound collects this information utilizing signed LDAP queries against a dom ### [Granting Access to the Deleted Objects Container (Optional) -To improve reconciliation performance in tracking deleted objects, it is recommended to grant the SharpHound service account [access to the "Deleted Objects" container](https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/non-administrators-view-deleted-object-container).  +To improve reconciliation performance in tracking deleted objects, it is recommended to grant the SharpHound service account [access to the "Deleted Objects" container](https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/non-administrators-view-deleted-object-container). ## Local Group Membership @@ -90,7 +90,7 @@ SharpHound collects this information utilizing signed LDAP queries against a dom By default, all Authenticated Users can enumerate almost all Certificate Services data utilized by BloodHound Enterprise. -Two additional types of data can enhance the findings - [DC Registry](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions#dc-registry) and [CA Registry](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions#ca-registry). +Two additional types of data can enhance the findings - [DC Registry](/collect-data/enterprise-collection/permissions#dc-registry) and [CA Registry](/collect-data/enterprise-collection/permissions#ca-registry). ## DC Registry @@ -102,12 +102,12 @@ Collecting these registry key values requires membership of Administrators on th ## CA Registry -SharpHound collects the following registry key values on enterprise CAs stored under SYSTEM\\CurrentControlSet\\Services\\CertSvc\\Configuration\\<CA Name>:  +SharpHound collects the following registry key values on enterprise CAs stored under SYSTEM\\CurrentControlSet\\Services\\CertSvc\\Configuration\\<CA Name>: * **EnrollmentAgentRights - **Contains restrictions for enrollment agents. BloodHound will take the restrictions into account when calculating ADCS ESC3 edges, and assume no restrictions if not collected, as no restrictions are configured by default.  + **Contains restrictions for enrollment agents. BloodHound will take the restrictions into account when calculating ADCS ESC3 edges, and assume no restrictions if not collected, as no restrictions are configured by default. * **Security - **Contains the security descriptor for the enterprise CA i.e. the permissions for Enroll, ManageCA, and ManageCertificates edges against the enterprise CA. This security descriptor is also stored in the AD object of the enterprise CA. SharpHound collects both. The CA registry security descriptor holds the effective permissions. Changes in the CA registry security descriptor are replicated to the AD copy, however, not the other way. Therefore, collecting the CA registry security descriptor may reveal permissions of the enterprise CA that are not present if only collecting the AD object.  + **Contains the security descriptor for the enterprise CA i.e. the permissions for Enroll, ManageCA, and ManageCertificates edges against the enterprise CA. This security descriptor is also stored in the AD object of the enterprise CA. SharpHound collects both. The CA registry security descriptor holds the effective permissions. Changes in the CA registry security descriptor are replicated to the AD copy, however, not the other way. Therefore, collecting the CA registry security descriptor may reveal permissions of the enterprise CA that are not present if only collecting the AD object. * **PolicyModules\\CertificateAuthority_MicrosoftDefault.Policy\\EditFlags **SharpHound checks if the EDITF_ATTRIBUTESUBJECTALTNAME2 flag is present, required to calculate ADCS ESC6 edges. diff --git a/docs/hc/en-us/articles/Why-perform-privileged-collection-in-SharpHound.mdx b/docs/collect-data/enterprise-collection/privileged-collection.mdx similarity index 89% rename from docs/hc/en-us/articles/Why-perform-privileged-collection-in-SharpHound.mdx rename to docs/collect-data/enterprise-collection/privileged-collection.mdx index 692cc215c2..f0cd054509 100644 --- a/docs/hc/en-us/articles/Why-perform-privileged-collection-in-SharpHound.mdx +++ b/docs/collect-data/enterprise-collection/privileged-collection.mdx @@ -3,7 +3,7 @@ title: Why perform privileged collection in SharpHound --- - + Privileged collection allows BloodHound Enterprise to analyze Attack Paths based on non-centralized configurations, the local groups, active sessions, and user rights assignments configured on each domain-joined system in your environment. Without this data, BloodHound Enterprise will be limited in its ability to accurately assess the true risk each Attack Path poses to your environment. @@ -13,12 +13,12 @@ Privileged collection is similar to performing a privileged vulnerability scan - As an example, if BloodHound Enterprise identified the following set of Attack Paths in a given environment based on AD Structure alone: - + Based on this view, the tree of Attack Paths on the left would present the greatest risk to this environment, now lets collect Local Group membership information from the domain: - + BloodHound Enterprise has identified that a computer at the bottom of the right Attack Path tree has Authenticated Users (all users and computers contained within the current domains, and all domains trusted by the current domain) added as a local Administrator to a system at the beginning of one Attack Path. @@ -26,5 +26,5 @@ BloodHound Enterprise has identified that a computer at the bottom of the right After updating the exposure presented by this new information, BloodHound Enterprise would identify that the actual largest risk to this environment as the path on the right. - + diff --git a/docs/collect-data/overview.mdx b/docs/collect-data/overview.mdx new file mode 100644 index 0000000000..6153ec5768 --- /dev/null +++ b/docs/collect-data/overview.mdx @@ -0,0 +1,30 @@ +--- +title: Data Collection +sidebarTitle: Overview +mode: wide +description: "How attack path data collection and ingestion works, and how to run attack path data collection." +--- + +## BloodHound Enterprise Collection + + + Promoted article + Promoted article + + + + + + + + + + +## BloodHound CE Collection + + + + + + + diff --git a/docs/hc/en-us/get-started/introduction-to-bloodhound.mdx b/docs/get-started/introduction.mdx similarity index 80% rename from docs/hc/en-us/get-started/introduction-to-bloodhound.mdx rename to docs/get-started/introduction.mdx index a2d1f7b5ae..79eaae9da3 100644 --- a/docs/hc/en-us/get-started/introduction-to-bloodhound.mdx +++ b/docs/get-started/introduction.mdx @@ -15,10 +15,10 @@ There are two BloodHound products: BloodHound Enterprise and BloodHound Communit - BloodHound Enterprise logo + BloodHound Enterprise logo - BloodHound Community Edition logo + BloodHound Community Edition logo @@ -51,10 +51,10 @@ There are two BloodHound products: BloodHound Enterprise and BloodHound Communit - Get started + Get started - Get started + Get started @@ -65,29 +65,29 @@ There are two BloodHound products: BloodHound Enterprise and BloodHound Communit ## BloodHound Enterprise -BloodHound Enterprise is a fully deployed and secured SaaS offering by SpecterOps to address the need for Attack Path Management. +BloodHound Enterprise is a fully deployed and secured SaaS offering by SpecterOps to address the need for Attack Path Management. It requires requires no additional installation or maintenance. -[Attack Path Management](https://specterops.io/what-is-attack-path-management/) is a framework designed to help organizations measure and remediate the risk created by attack paths. +[Attack Path Management](https://specterops.io/what-is-attack-path-management/) is a framework designed to help organizations measure and remediate the risk created by attack paths. With BloodHound Enterprise, leverage ongoing collection, data reconciliation, and analysis to manage risk following the Attack Path Management framework. It's the only tool available that helps defenders easily identify and eliminate highly complex attack paths that would otherwise be impossible to manage. - [Get started](/hc/en-us/get-started/bloodhound-enterprise-quickstart) + [Get started](/get-started/quickstart/enterprise-quickstart) [Request a demo](https://specterops.io/get-a-demo/) ## BloodHound Community Edition BloodHound CE is free, open-source, and focused on enabling penetration testers and red teams to rapidly evaluate attack paths within Active Directory and Entra ID (formerly Azure AD). - [Get started](/hc/en-us/get-started/bloodhound-community-edition-quickstart) + [Get started](/get-started/quickstart/community-edition-quickstart) ## Need help? - [**Submit a request**](https://support.bloodhoundenterprise.io/hc/en-us/requests/new) for dedicated support or ask in the [**BloodHound user Slack community**](https://ghst.ly/BHSlack). + [**Submit a request**](https://support.bloodhoundenterprise.io/requests/new) for dedicated support or ask in the [**BloodHound user Slack community**](https://ghst.ly/BHSlack). - + Ask in the [**BloodHound user Slack community**](https://ghst.ly/BHSlack). diff --git a/docs/hc/en-us/get-started/bloodhound-community-edition-quickstart.mdx b/docs/get-started/quickstart/community-edition-quickstart.mdx similarity index 89% rename from docs/hc/en-us/get-started/bloodhound-community-edition-quickstart.mdx rename to docs/get-started/quickstart/community-edition-quickstart.mdx index ddfcfe8337..206ebb1abe 100644 --- a/docs/hc/en-us/get-started/bloodhound-community-edition-quickstart.mdx +++ b/docs/get-started/quickstart/community-edition-quickstart.mdx @@ -3,7 +3,7 @@ title: BloodHound Community Edition Quickstart --- - + Set up BloodHound Community Edition (BloodHound CE) with Docker Compose and start identifying and visualizing security risks.. @@ -13,7 +13,7 @@ Set up BloodHound Community Edition (BloodHound CE) with Docker Compose and star # Prerequisites -To complete the quickstart, ensure you meet these system requirements. +To complete the quickstart, ensure you meet these system requirements. BloodHound CE deploys in a traditional multi-tier container architecture consisting of databases, application, and UI layers. | Minimum specifications | For large environments (>50K users) | @@ -35,11 +35,11 @@ To install BloodHound CE: ```bash Linux/MAC curl -L https://ghst.ly/getbhce > .\docker-compose.yml ``` - + ``` bash Windows CMD curl -L https://ghst.ly/getbhce > .\docker-compose.yml ``` - + ```powershell Windows PowerShell Invoke-WebRequest -Uri https://ghst.ly/getbhce -OutFile .\docker-compose.yaml ``` @@ -51,19 +51,19 @@ To install BloodHound CE: ```bash docker compose pull && docker compose up ``` - - To run BloodHound CE without needing to maintain the terminal interface, add the flag `d` and run `docker compose logs` to see the most recent logs from the environment. - + + To run BloodHound CE without needing to maintain the terminal interface, add the flag `d` and run `docker compose logs` to see the most recent logs from the environment. + This pulls all the Docker images needed and runs Docker Compose to start up the services from the YAML configuration file. 4. In the terminal log output of Docker Compose, find and copy the randomly generated password from `Initial Password Set To`. - + This password cannot be regenerated. If you lose it, run `docker compose down -v` and then `docker compose up` to reset your databases. 5. Go to [http://localhost:8080/ui/login](http://localhost:8080/ui/login) and log in with the username `admin` and the password generated from the logs. - + The default `docker-compose.yml` example binds only to localhost (127.0.0.1). To access BloodHound outside of localhost, follow the instructions in [examples/docker-compose/README.md](https://github.com/SpecterOps/BloodHound/blob/main/examples/docker-compose/README.md) to configure host binding for the container. @@ -85,7 +85,7 @@ To ingest the BloodHound sample data: 1. Go to [Example Data](https://github.com/SpecterOps/BloodHound/wiki/Example-Data) and download sample data. 2. From the BloodHound CE UI, go to settings (⚙️) → **Administration** → **Upload Files**. - + The default admin email address is spam@example.com. You may notice this show up as the user who's ingesting the data. ## Option 2: Ingest your data with data collectors @@ -99,7 +99,7 @@ BloodHound CE analyzes data collected by its two collector services, each collec Each collector is a standalone binary. Download collectors using one of these methods: * From BloodHound CE, click ⚙️ → **Download Collectors** → the download button for **SHARPHOUND** or **AZUREHOUND**. * Download the collector from their respective GitHub repository: [SharpHound repository](https://github.com/BloodHoundAD/SharpHound/releases) or [AzureHound repository](https://github.com/BloodHoundAD/AzureHound/releases). -* Build the collector from source with the source code for [SharpHound](../articles/SharpHound-Community-Edition) or [AzureHound](../articles/AzureHound-Community-Edition). +* Build the collector from source with the source code for [SharpHound](/collect-data/ce-collection/sharphound) or [AzureHound](/collect-data/ce-collection/azurehound). ### Run a collector Run the SharpHound or AzureHound collector. During collection, JSON files are generated and compressed into a ZIP file. @@ -111,18 +111,18 @@ Run the SharpHound or AzureHound collector. During collection, JSON files are ge C:\> SharpHound.exe ``` -```bash Run AzureHound +```bash Run AzureHound # Run AzureHound CE C:\> AzureHound.exe --username "MattNelson@contoso.onmicrosoft.com" --password "MyVeryStrongPassword" --tenant "contoso.onmicrosoft.com" list ``` -For Azure argument definitions, see [All AzureHound Community Edition Flags, Explained](../articles/All-AzureHound-Community-Edition-Flags-Explained). +For Azure argument definitions, see [All AzureHound Community Edition Flags, Explained](/collect-data/ce-collection/azurehound-flags). ### Ingest data into BloodHound Use the BloodHound CE API or the BloodHound CE UI to ingest collected data into BloodHound. -To ingest collected data with the API, use the BloodHound CE endpoint `/api/v2/file-upload/`. See the [BloodHound API documentation](../articles/Working-with-the-BloodHound-API) for details. +To ingest collected data with the API, use the BloodHound CE endpoint `/api/v2/file-upload/`. See the [BloodHound API documentation](/integrations/bloodhound-api/working-with-api) for details. To ingest collected data with the BloodHound CE UI, go to settings (⚙️) → **Administration → Data Collection →** select **File Ingest →** click **UPLOAD FILES** and upload your files. @@ -148,8 +148,8 @@ To look at identified attack paths in the graph, go to the **Explore** page in t -Learn more in [Explore → Search for Objects](../articles/Explore-Search-for-Objects). +Learn more in [Explore → Search for Objects](/analyze-data/bloodhound-gui/explore-objects). # Next steps -* [Learn how to work with the BloodHound API](../articles/Working-with-the-BloodHound-API) -* [Configure BloodHound integrations](../articles/Overview-of-BloodHound-Integrations) +* [Learn how to work with the BloodHound API](/integrations/bloodhound-api/working-with-api) +* [Configure BloodHound integrations](/integrations/integrations/overview) diff --git a/docs/hc/en-us/get-started/bloodhound-enterprise-quickstart.mdx b/docs/get-started/quickstart/enterprise-quickstart.mdx similarity index 64% rename from docs/hc/en-us/get-started/bloodhound-enterprise-quickstart.mdx rename to docs/get-started/quickstart/enterprise-quickstart.mdx index 229ec4bb6d..80fc53144b 100644 --- a/docs/hc/en-us/get-started/bloodhound-enterprise-quickstart.mdx +++ b/docs/get-started/quickstart/enterprise-quickstart.mdx @@ -3,7 +3,7 @@ title: BloodHound Enterprise Quickstart --- - + Get started with your BloodHound Enterprise instance and start identifying and remediating security risks. @@ -23,26 +23,26 @@ You can run the two services from the same Windows system. AzureHound Enterprise ## Ingest with SharpHound Enterprise (Active Directory) -SharpHound Enterprise collects [multiple data types](../articles/SharpHound-Enterprise-Data-Collection-and-Permissions) from Active Directory and its domain-joined systems. We recommend collecting all types for full risk identification and accurate risk assessment calculation. +SharpHound Enterprise collects [multiple data types](/collect-data/enterprise-collection/data-retention) from Active Directory and its domain-joined systems. We recommend collecting all types for full risk identification and accurate risk assessment calculation. - + Install the SharpHound Enterprise collector service on a domain-joined Windows system and run it as an Active Directory account. - 1. Review the [SharpHound Enterprise System Requirements](../articles/SharpHound-Enterprise-System-Requirements-and-Deployment-Process) and [SharpHound Service Hardening Guidelines](../articles/SharpHound-Enterprise-Service-Hardening). - 2. [Install and Upgrade SharpHound Enterprise](../articles/Install-and-Upgrade-SharpHound-Enterprise). - 3. To fully secure a domain, collect data from all other domains with a trust relationship to it (in- and outgoing trust). Configure SharpHound Enterprise for [Cross-Trust Collection](../articles/SharpHound-Enterprise-Cross-Trust-Collection). + 1. Review the [SharpHound Enterprise System Requirements](/install-data-collector/install-sharphound/system-requirements) and [SharpHound Service Hardening Guidelines](/manage-bloodhound/securing-bloodhound-and-collectors/sharphound-hardening). + 2. [Install and Upgrade SharpHound Enterprise](/install-data-collector/install-sharphound/installation-upgrade). + 3. To fully secure a domain, collect data from all other domains with a trust relationship to it (in- and outgoing trust). Configure SharpHound Enterprise for [Cross-Trust Collection](/collect-data/enterprise-collection/cross-trust). ## Ingest with AzureHound Enterprise (Entra ID and Azure) Install and run the AzureHound Enterprise collector service on Windows, Docker, or Kubernetes. - 1. Review the [AzureHound Enterprise System Requirements and Deployment Process](../articles/AzureHound-Enterprise-System-Requirements-and-Deployment-Process). - 2. [Configure Azure](../articles/AzureHound-Enterprise-Azure-Configuration). - 3. [Create your AzureHound configuration](../articles/Create-an-AzureHound-Configuration). - 4. [Deploy and maintain AzureHound](../articles/Install-and-Upgrade-AzureHound-Windows-Docker-or-Kubernetes). + 1. Review the [AzureHound Enterprise System Requirements and Deployment Process](/install-data-collector/install-azurehound/system-requirements). + 2. [Configure Azure](/install-data-collector/install-azurehound/azure-configuration). + 3. [Create your AzureHound configuration](/install-data-collector/install-azurehound/create-configuration). + 4. [Deploy and maintain AzureHound](/install-data-collector/install-azurehound/installation-options). # Verify data quality @@ -50,29 +50,29 @@ After collecting data, to verify data quality: 1. Go to settings (⚙️) → **Administration** and select **Data Quality**. 2. Verify that the collectors have collected the expected amount of data and the number of principal types in each directory. - 3. If using privileged collection, verify that the charts **Local Group Completeness Over Time** and **Session Completeness Over Time** report higher than 0%. - + 3. If using privileged collection, verify that the charts **Local Group Completeness Over Time** and **Session Completeness Over Time** report higher than 0%. + Obtaining 100% completeness is not possible in most environments due to things like workstations being offline during collection. - + 4. If you see lower-than-expected data quality examine the data collection logs and contact your SpecterOps representative if you need assistance. # Scope Tier Zero objects BloodHound Enterprise identifies and prioritizes attack paths. To get the most accurate assessment scope your Tier Zero objects. - 1. [Scope Tier Zero for your environment](../articles/Tier-Zero-Members-and-Modification). - 2. [Mark your environment's Tier Zero objects in BloodHound](../articles/Modifying-Tier-Zero). + 1. [Scope Tier Zero for your environment](/get-started/security-boundaries/tier-zero-members). + 2. [Mark your environment's Tier Zero objects in BloodHound](/get-started/security-boundaries/modifying-tier-zero). # Grant users access Your BloodHound Enterprise instance has a few administrative users by default. To bring your team into your instance, grant your team access with dedicated users and roles. -To grant users access to your instance, [create users and set access control roles](../articles/Administering-users-and-roles). +To grant users access to your instance, [create users and set access control roles](/manage-bloodhound/auth/users-and-roles). BloodHound Enterprise supports two authentication methods for users: * Built-in authentication via username and password, supporting TOTP-based multi-factor authentication -* [SAML 2.0-based Single-Sign-On](../articles/SAML-in-BloodHound) +* [SAML 2.0-based Single-Sign-On](/manage-bloodhound/auth/saml) Your default users are configured with built-in authentication. For your team, you can also configure SAML authentication. @@ -84,5 +84,5 @@ Go to the **Attack Paths**, **Explore**, and **Posture** pages to see identified # Next steps -* Learn how to work with the [BloodHound Enterprise API](../articles/Working-with-the-BloodHound-API) -* [Configure BloodHound integrations](../articles/Overview-of-BloodHound-Integrations) +* Learn how to work with the [BloodHound Enterprise API](/integrations/bloodhound-api/working-with-api) +* [Configure BloodHound integrations](/integrations/integrations/overview) diff --git a/docs/hc/en-us/articles/BloodHound-Enterprise-Security-Overview.mdx b/docs/get-started/security-boundaries/enterprise-security-overview.mdx similarity index 92% rename from docs/hc/en-us/articles/BloodHound-Enterprise-Security-Overview.mdx rename to docs/get-started/security-boundaries/enterprise-security-overview.mdx index 351d9c7194..87be2ac450 100644 --- a/docs/hc/en-us/articles/BloodHound-Enterprise-Security-Overview.mdx +++ b/docs/get-started/security-boundaries/enterprise-security-overview.mdx @@ -3,12 +3,12 @@ title: BloodHound Enterprise Security Overview --- - + _**© 2023 Specter Ops, Inc. ALL RIGHTS RESERVED.**_ -_This guide contains proprietary information protected by copyright. The software and services described in this guide are furnished only under a separate master services agreement (a “Master Services Agreement”). This software and documentation may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser's personal use without the written permission of Specter Ops Inc._ +_This guide contains proprietary information protected by copyright. The software and services described in this guide are furnished only under a separate master services agreement (a "Master Services Agreement"). This software and documentation may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser's personal use without the written permission of Specter Ops Inc._ _No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document. EXCEPT AS SET FORTH IN AN APPLICABLE MASTER SERVICES AGREEMENT, SPECTER OPS ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS OR SERVICES INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL SPECTER OPS BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL, OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF SPECTER OPS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES._ @@ -23,7 +23,7 @@ SpecterOps built BloodHound Enterprise following the principles of [Attack Path ### Single-Tenant Architecture Diagram - + Customer Data Residency and Subprocessors @@ -149,7 +149,7 @@ User-interface sessions expire after eight (8) hours. #### Role-Based Access Control -[BloodHound Enterprise User Roles](/hc/en-us/articles/Administering-users-and-roles) +[BloodHound Enterprise User Roles](/manage-bloodhound/auth/users-and-roles) ## Third-Party Assessments and Certifications ### Penetration Testing @@ -193,7 +193,7 @@ This information is available from the API of a running BloodHound Enterprise en ## Data Collection Overview -For SharpHound, see [SharpHound Data Collection and Permissions](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions). +For SharpHound, see [SharpHound Data Collection and Permissions](/collect-data/enterprise-collection/permissions). -For AzureHound, see [AzureHound Enterprise System Requirements and Deployment Process.](/hc/en-us/articles/AzureHound-Enterprise-System-Requirements-and-Deployment-Process) +For AzureHound, see [AzureHound Enterprise System Requirements and Deployment Process](/install-data-collector/install-azurehound/system-requirements). diff --git a/docs/hc/en-us/articles/Modifying-Tier-Zero.mdx b/docs/get-started/security-boundaries/modifying-tier-zero.mdx similarity index 64% rename from docs/hc/en-us/articles/Modifying-Tier-Zero.mdx rename to docs/get-started/security-boundaries/modifying-tier-zero.mdx index d07b67e4fe..c5772fb45e 100644 --- a/docs/hc/en-us/articles/Modifying-Tier-Zero.mdx +++ b/docs/get-started/security-boundaries/modifying-tier-zero.mdx @@ -4,7 +4,7 @@ description: "This article outlines how to modify Tier Zero's membership in Bloo --- - + ## Purpose @@ -20,15 +20,15 @@ This process requires an Administrator account in BloodHound Enterprise. 1. Open the **Group Management** page - + -2. In the left-hand side, the "Add or Remove Members" input box allows you to [search](/hc/en-us/articles/Explore-Search-for-Objects) and select the object's you'd like to Add To or Remove From Tier Zero. +2. In the left-hand side, the "Add or Remove Members" input box allows you to [search](/analyze-data/bloodhound-gui/explore-objects) and select the object's you'd like to Add To or Remove From Tier Zero. - + 3. Once all changes are queued up, click on **Confirm Changes**. - + ## Outcome diff --git a/docs/hc/en-us/articles/Tier-Zero-Members-and-Modification.mdx b/docs/get-started/security-boundaries/tier-zero-members.mdx similarity index 97% rename from docs/hc/en-us/articles/Tier-Zero-Members-and-Modification.mdx rename to docs/get-started/security-boundaries/tier-zero-members.mdx index 793b0f7c56..51dee2863c 100644 --- a/docs/hc/en-us/articles/Tier-Zero-Members-and-Modification.mdx +++ b/docs/get-started/security-boundaries/tier-zero-members.mdx @@ -5,7 +5,7 @@ description: "Although implementing a tiered model remains the best path toward - + BloodHound Enterprise borrows from [Microsoft's Enhanced Security Administration Environment (ESAE - Retired)](https://learn.microsoft.com/en-us/security/compass/esae-retirement) model in utilizing the term "Tier Zero." In this model, Tier Zero is the set of objects with full control over the environment AND _any objects with control over those objects_. You may also be familiar with [Microsoft's Enterprise Access Model (EAM)](https://learn.microsoft.com/en-us/security/compass/privileged-access-access-model), which later replaced ESAE; however, they recommend effectively the same advice. diff --git a/docs/hc/en-us/articles/2023-02-21-Release-Notes.mdx b/docs/hc/en-us/articles/2023-02-21-Release-Notes.mdx deleted file mode 100644 index 07bb74de9b..0000000000 --- a/docs/hc/en-us/articles/2023-02-21-Release-Notes.mdx +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: 2023-02-21 Release Notes ---- - -## Announcements - -### SharpHound Upgrades Required - -SharpHound v2 is officially generally available. If you have not already done so, please make sure you upgrade your SharpHound collectors to v2.1+. SharpHound v1 will officially be end-of-life on May 1, 2023. - -**NOTE:** Upgrading to SharpHound v2+ must occur concurrently on all services and requires enabling the “Enable post processing of local groups” early access feature simultaneously. - -Instructions to upgrade your collector may be found [here](/hc/en-us/articles/Install-and-Upgrade-SharpHound-Enterprise)! Our Customer Success team will begin reaching out to all customers still running SharpHound v1 and would be happy to help if you require it. - -### A Taste of Kerberos Abuse Webinar - -Join us Tuesday, 2/28 at 1 PM ET for our next webinar, A Taste of Kerberos Abuse, presented by Elad Shamir. You'll get a taste of our Adversary Tactics: Red Team Operations training, with highlights from the Kerberos modules covering every step of the Kerberos authentication flow. - -Sign up here: [https://support.bloodhoundenterprise.io/hc/en-us/articles/ghst.ly/3X4leNV](https://support.bloodhoundenterprise.io/hc/en-us/articles/ghst.ly/3X4leNV) - -## Summary - -* BloodHound Enterprise - * New and Improved Features - Massive performance improvements for AD Entity Panels and Explore node searches - * Bug Fixes -  AzureHound checkins, API response fixes -* SharpHound Enterprise (v2.1.1) - * Bug Fixes - WriteAccountRestrictions edge fix, Service now properly marks domains as collected -* AzureHound Enterprise (v1.2.4) - * Bug Fixes - Fixed a bug in retry logic during ingest upload - -### BloodHound Enterprise - -* Improved Functionality - * Entity Panels for AD objects have undergone restructuring and should load significantly faster now! Previously, each panel would load all data elements at once; this meant that a big query like "Outbound Control" could take a long time and prevent you from seeing data. These now load separately and will allow you to view available data faster - _way faster._ Note, very large / complex environments may still hit constraints pulling information back from specific queries within the panel but this will no longer prevent the rest of the panel from loading.  Future work is planned in this area to provide partial results where applicable.  - * Explore node searches will also return much faster due to query optimizations and post-processing improvements.  - _Note: Azure Entity Panels are undergoing the same improvements and will be available soon!_ -* Bug Fixes - * Cleaned up logging in AzureHound related to stalled data collection jobs - * Cleaned up where API responses included skip, limit, and count where they were not in use - -### SharpHound Enterprise (v2.1.1 GA) - -_Minimum version of SharpHound Service to support all current functionality: v2.1.1_ - -* Bug Fixes - * Fixed a bug which prevented SharpHound Enterprise from creating WriteAccountRestrictions edges - * Fixed a bug that prevented domains from being marked as collected during cross domain trust collections - -**NOTE:** Upgrading to SharpHound v2+ must occur concurrently on all services and requires enabling the “User Rights Assignment Collection” experimental feature at the same time. Please contact your TAM or respond to this email for assistance. - -### AzureHound Enterprise (v1.2.4 GA) - -_Minimum version of AzureHound Service to support all current functionality: v1.2.4_ - -* Bug Fixes - * Fixed a bug in retry logic during ingest upload - diff --git a/docs/hc/en-us/articles/2023-03-27-Release-Notes.mdx b/docs/hc/en-us/articles/2023-03-27-Release-Notes.mdx deleted file mode 100644 index 79164f8be6..0000000000 --- a/docs/hc/en-us/articles/2023-03-27-Release-Notes.mdx +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: 2023-03-27 Release Notes ---- -## Announcements - -### SharpHound Upgrades Required - -SharpHound v2 is officially generally available. If you have not already done so, please make sure you upgrade your SharpHound collectors to v2.1+. SharpHound v1 will officially be end-of-life on May 1, 2023. - -**NOTE:** Upgrading to SharpHound v2+ must occur concurrently on all services and requires enabling the “Enable post processing of local groups” early access feature simultaneously. - -Instructions to upgrade your collector may be found [here](/hc/en-us/articles/Install-and-Upgrade-SharpHound-Enterprise)! Our Customer Success team will begin reaching out to all customers still running SharpHound v1 and would be happy to help if you require it. - -## Summary - -* BloodHound Enterprise - * New and improved functionality - Azure entity panels performance improvements - * Bug fixes - Entity panels properly show all object information values and fixed several bugs, resulting in inaccurate data results. -* SharpHound Enterprise (v2.1.2) - * _No release this week._ -* AzureHound Enterprise (v1.2.4) - * _No release this week._ - -### BloodHound Enterprise - -### Improved Functionality - -* Azure-based Entity Panels have undergone the same treatment as their AD-based counterparts. Azure entities should now load their panels significantly faster and queue up relationship-based results in the background to load when those counts become available. - -### Bug Fixes - -* Entity Panels will no longer hide keys based on their value. For example, "Enabled" should always appear, even if the value is "False". -* Resolved an issue where Inbound and Outbound Object Control options would show inconsistent results between a controlled and controlling object. -* Fixed an issue in Entity Panels for Groups where the Sessions tab would contain inaccurate results for Computers contained within the group. - -### SharpHound Enterprise (v2.1.2) - -_Minimum version of SharpHound Service to support all current functionality: v2.1.2_ - -No release this week. - - -**NOTE:** Upgrading to SharpHound v2+ must occur concurrently on all services and requires enabling the “User Rights Assignment Collection” experimental feature at the same time. Please contact your TAM or respond to this email for assistance. - -### AzureHound Enterprise (v1.2.4) - -_Minimum version of AzureHound Service to support all current functionality: v1.2.4_ - -No release this week. - diff --git a/docs/hc/en-us/articles/2024-01-04-Release-Notes-v5-4-0.mdx b/docs/hc/en-us/articles/2024-01-04-Release-Notes-v5-4-0.mdx deleted file mode 100644 index bbdf83667a..0000000000 --- a/docs/hc/en-us/articles/2024-01-04-Release-Notes-v5-4-0.mdx +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: 2024-01-04 Release Notes (v5.4.0) ---- - -## Announcements - -Active Directory Certificate Services Early Access - -BloodHound v5.4.0 includes early access support for collection, processing, and analysis of Active Directory Certificate Services (ADCS) Attack Paths! Our first Early Access release includes coverage for ESC1 and DPERSIST1 (hereafter referenced as "GoldenCert"). We will continue to expand this coverage throughout the coming weeks and months. - -To ingest and analyze ADCS paths in this version: - -1. Enable the Early Access flag in the Administration section of the app (requires Administrator role). -2. Ingest data collected via SharpHound v2.3.0+. -3. Allow post-processing to complete. - -Speaking of ADCS... - -### SO-CON 2024 - -SO-CON is rapidly approaching, and we've got three tracks of incredible presentations announced for Monday's summit, including a talk by Andy Robbins and Jonas Bülow Knudsen on ADCS Support within BloodHound! More details: - -* 🏔️ March 11, 2024 - Full-day, multi-track summit with presentations on a variety of security topics -* 🎓 March 12 - 15, 2024 - Four days of training classes, including our first-ever Azure Security Fundamentals course! -* 📍Location - Convene in Arlington, VA - -Training students will receive free entry to the summit, and summit entry is available now for a 50% early registration discount! - -See all talks and sign up at [https://specterops.io/so-con/#talks](https://specterops.io/so-con/#talks)! - -## Summary - -* **BloodHound (v5.4.0****)** - * New and Improved Features - * Early access for ADCS Attack Paths! - * Edge composition support - * _\[CE Only\] _Modified default docker compose example to bind only to localhost for improved security defaults -* **SharpHound (v2.3.2 - BHE, v2.3.0 - CE)** - * New and Improved Features - * Support for ADCS collection capabilities -* **AzureHound (v2.1.6)** - * _No new release._ - -### BloodHound (v5.4.0) - -#### New and Improved Features - -* **Early access support for ADCS Attack Paths - **Starting with Will Schroeder and Lee Chagolla-Christensen's research, it became clear that ADCS represents a massive attack surface within any Active Directory environment. Starting with this early access release, BloodHound will now natively support ADCS Attack Paths! This includes a significant number of new node and edge types, as well as the two post-processed edges representing escalation opportunity, ADCSESC1 and GoldenCert. - - _Note: To analyze ADCS Attack Paths, you must first enable the Early Access setting under Administration and then perform and import a collection using SharpHound v2.3.0+._ -* **Edge composition support - **While not the first post-processed edges created based on behind-the-scenes logic, ADCS Attack Paths represent the most complexity represented in a single edge in BloodHound by a very large margin. To make this complexity clear, we have introduced a new feature to edge context menus called "Composition". Clicking on this panel will expand out the edges utilized by BloodHound during post-processing necessary to create the selected edge. - - For now, this feature only supports the ADCSESC1 and GoldenCert edges; however, we will add support to other post-processed edges over time. - - - - Clicking "Composition" will show: - - - -* **_\[CE Only\]_ Improved default security on BloodHound CE -** Modified default docker compose example to bind only to localhost for improved security defaults. - -### SharpHound (v2.3.2 - BHE, v2.3.0 - CE) - -#### New and Improved Features - -* **Support for ADCS collection capabilities _-_**SharpHound will now collect information required to analyze and generate ADCS Attack Paths. - -### AzureHound (v2.1.6) - -_No new release._ - diff --git a/docs/hc/en-us/articles/AZAddOwner.mdx b/docs/hc/en-us/articles/AZAddOwner.mdx deleted file mode 100644 index 8f80fd2aaf..0000000000 --- a/docs/hc/en-us/articles/AZAddOwner.mdx +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: AZAddOwner -description: "This edge is created during post-processing." ---- - - - - - -It is created against all App Registrations and Service Principals within the same tenant when an Azure principal has one of the following Entra ID roles: - -* Hybrid Identity Administrator -* Partner Tier1 Support -* Partner Tier2 Support -* Directory Synchronization Accounts - -You will not see these privileges when auditing permissions against any of the mentioned objects when you use Microsoft tooling, including the Azure portal or any API. - -## Abuse Info - -You can use BARK to add a new owner to the target object. The BARK function you use will depend on the target object type, but all of the functions follow a similar syntax. - -These functions require you to supply an MS Graph-scoped JWT associated with the principal that has the privilege to add a new owner to your target object. There are several ways to acquire a JWT. For example, you may use BARK’s Get-GraphTokenWithRefreshToken to acquire an MS Graph-scoped JWT by supplying a refresh token: - -```bash -$MGToken = Get-GraphTokenWithRefreshToken ` - -RefreshToken "0.ARwA6WgJJ9X2qk..." ` - -TenantID "contoso.onmicrosoft.com" -``` - -To add a new owner to a Service Principal, use BARK’s New-ServicePrincipalOwner function: - -```bash -New-ServicePrincipalOwner ` - -ServicePrincipalObjectId "082cf9b3-24e2-427b-bcde-88ffdccb5fad" ` - -NewOwnerObjectId "cea271c4-7b01-4f57-932d-99d752bbbc60" ` - -Token $Token -``` -To add a new owner to an App Registration, use BARK’s New-AppOwner function: - -```bash -New-AppOwner ` - -AppObjectId "52114a0d-fa5b-4ee5-9a29-2ba048d46eee" ` - -NewOwnerObjectId "cea271c4-7b01-4f57-932d-99d752bbbc60" ` - -Token $Token -``` -## Opsec Considerations - -Any time you add an owner to any Azure object, the AzureAD audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was. - -## References - -* [https://attack.mitre.org/techniques/T1098/](https://attack.mitre.org/techniques/T1098/) -* [https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5](https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5) -* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) diff --git a/docs/hc/en-us/articles/AZAddSecret.mdx b/docs/hc/en-us/articles/AZAddSecret.mdx deleted file mode 100644 index 57c80947ff..0000000000 --- a/docs/hc/en-us/articles/AZAddSecret.mdx +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: AZAddSecret -description: Azure provides several systems and mechanisms for granting control of securable objects within Entra ID, including tenant-scoped admin roles, object-scoped admin roles, explicit object ownership, and API permissions. ---- - - - - - -When a principal has been granted “Cloud App Admin” or “App Admin” against the tenant, that principal gains the ability to add new secrets to all Service Principals and App Registrations. Additionally, a principal that has been granted “Cloud App Admin” or “App Admin” against, or explicit ownership of a Service Principal or App Registration gains the ability to add secrets to that particular object. - -## Abuse Info - -There are several ways to perform this abuse, depending on what sort of access you have to the credentials of the object that holds this privilege against the target object. If you have an interactive web browser session for the Azure portal, it is as simple as finding the target App in the portal and adding a new secret to the object using the “Certificates & secrets” tab. Service Principals do not have this tab in the Azure portal but you can add secrets to them with the MS Graph API. No matter what kind of control you have, you will be able to perform this abuse by using BARK’s New-AppRegSecret or New-ServicePrincipalSecret functions. - -These functions require you to supply an MS Graph-scoped JWT associated with the principal that has the privilege to add a new secret to your target application. There are several ways to acquire a JWT. For example, you may use BARK’s Get-GraphTokenWithRefreshToken to acquire an MS Graph-scoped JWT by supplying a refresh token: - -```bash -$MGToken = Get-GraphTokenWithRefreshToken -RefreshToken "0.ARwA6WgJJ9X2qk..." -TenantID "contoso.onmicrosoft.com" -``` - -Then use BARK’s New-AppRegSecret to add a new secret to the target application: - -```bash -New-AppRegSecret -AppRegObjectID "d878..." -Token $MGToken.access_token -``` -The output will contain the plain-text secret you just created for the target app: - -```bash -New-AppRegSecret -AppRegObjectID "d878..." -Token $MGToken.access_token - -Name Value ----- ----- -AppRegSecretValue odg8Q~... -AppRegAppId 4d31... -AppRegObjectId d878... -``` - -With this plain text secret, you can now acquire tokens as the service principal associated with the app. You can easily do this with BARK’s Get-MSGraphToken function: - -```bash -PS /Users/andyrobbins> $SPToken = Get-MSGraphToken ` --ClientID "4d31..." ` --ClientSecret "odg8Q~..." ` --TenantName "contoso.onmicrosoft.com" - -PS /Users/andyrobbins> $SPToken.access_token -eyJ0eXAiOiJKV1QiLCJub... -``` - -Now you can use this JWT to perform actions against any other MS Graph endpoint as the service principal, continuing your attack path with the privileges of that service principal. - -## Opsec Considerations - -When you create a new secret for an App or Service Principal, Azure creates an event called “Update application - Certificates and secrets management”. This event describes who added the secret to which application or service principal. - -## References - -* [https://attack.mitre.org/techniques/T1098/](https://attack.mitre.org/techniques/T1098/) -* [https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5](https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5) -* [https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/assign-roles-different-scopes](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/assign-roles-different-scopes) diff --git a/docs/hc/en-us/articles/AZOwns.mdx b/docs/hc/en-us/articles/AZOwns.mdx deleted file mode 100644 index 03b7fdf8bb..0000000000 --- a/docs/hc/en-us/articles/AZOwns.mdx +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: AZOwns -description: "The principal is granted owner rights on the principal." ---- - - - - - - -AZOwns targets resources in Entra ID (for example [AZGroup](/hc/en-us/articles/AZGroup), [AZServicePrincipal](/hc/en-us/articles/AZServicePrincipal), and [AZDevice](/hc/en-us/articles/AZDevice)) from various object-specific ownership. - - - **Note: The edges [AZOwner](/hc/en-us/articles/AZOwner) and [AZOwns](/hc/en-us/articles/AZOwns) are distinct as they each apply their own distinct identity and access management platform (AzureRM and Entra ID respectively) with distinct mechanics, abuse primitives, and remediation steps.** - - -## Abuse Info - -Object ownership means almost all abuses are possible against the target object. - -## Opsec Considerations -This depends on which abuse you perform, but in general Azure will create a log for each abuse action. diff --git a/docs/hc/en-us/articles/AddMember.mdx b/docs/hc/en-us/articles/AddMember.mdx deleted file mode 100644 index fff8a9bb35..0000000000 --- a/docs/hc/en-us/articles/AddMember.mdx +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: AddMember -description: "This edge indicates the principal has the ability to add arbitrary principlas to the target security group. Because of security group delegation, the members of a security group have the same privileges as that group." ---- - - - - - - -By adding yourself to a group and refreshing your token, you gain all the same privileges that group has. - -See this clip for an example of this edge being abused: - - - -## Abuse Info - -There are at least two ways to execute this attack. The first and most obvious is by using the built-in net.exe binary in Windows (e.g.: net group “Domain Admins” dfm.a /add /domain). See the opsec considerations tab for why this may be a bad idea. The second, and highly recommended method, is by using the Add-DomainGroupMember function in PowerView. This function is superior to using the net.exe binary in several ways. For instance, you can supply alternate credentials, instead of needing to run a process as or logon as the user with the AddMember privilege. Additionally, you have much safer execution options than you do with spawning net.exe (see the opsec tab). - -To abuse this privilege with PowerView’s Add-DomainGroupMember, first import PowerView into your agent session or into a PowerShell instance at the console. - -You may need to authenticate to the Domain Controller as the user with the AddMember right if you are not running a process as that user. To do this in conjunction with Add-DomainGroupMember, first create a PSCredential object (these examples comes from the PowerView help documentation): - -```bash -$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force -$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\\dfm.a', $SecPassword) -``` - -Then, use Add-DomainGroupMember, optionally specifying $Cred if you are not already running within a process owned by the user with the AddMember privilege - -```bash -Add-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' -Credential $Cred -``` - -Finally, verify that the user was successfully added to the group with PowerView’s Get-DomainGroupMember: -```bash -Get-DomainGroupMember -Identity 'Domain Admins' -``` - -## Opsec Considerations - -Executing this abuse with the net binary will require command line execution. If your target organization has command line logging enabled, this is a detection opportunity for their analysts. - -Regardless of what execution procedure you use, this action will generate a 4728 event on the domain controller that handled the request. This event may be centrally collected and analyzed by security analysts, especially for groups that are obviously very high privilege groups (i.e.: Domain Admins). Also be mindful that PowerShell 5 introduced several key security features such as script block logging and AMSI that provide security analysts another detection opportunity. - -You may be able to completely evade those features by downgrading to PowerShell v2. - -## References -* [https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1](https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1) -* [https://www.youtube.com/watch?v=z8thoG7gPd0](https://www.youtube.com/watch?v=z8thoG7gPd0) -* [https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728) diff --git a/docs/hc/en-us/articles/BloodHound-and-Security-Boundaries.mdx b/docs/hc/en-us/articles/BloodHound-and-Security-Boundaries.mdx deleted file mode 100644 index ad7699a631..0000000000 --- a/docs/hc/en-us/articles/BloodHound-and-Security-Boundaries.mdx +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: BloodHound and Security Boundaries ---- - -Understand how BloodHound relates to and works with secured privileged access; Active Directory Tiering and Enterprise Access Model. - -[Follow](https://bloodhoundenterprise.zendesk.com/auth/v2/login/signin?return_to=https%3A%2F%2Fsupport.bloodhoundenterprise.io%2Fhc%2Fen-us%2Fsections%2FBloodHound-and-Security-Boundaries&theme=hc&locale=en-us&brand_id=1260800482770&auth_origin=1260800482770%2Ctrue%2Ctrue) diff --git a/docs/hc/en-us/articles/Bloodhound-Enterprise-Compliance-Framework-Resource.mdx b/docs/hc/en-us/articles/Bloodhound-Enterprise-Compliance-Framework-Resource.mdx deleted file mode 100644 index 7b91a77cef..0000000000 --- a/docs/hc/en-us/articles/Bloodhound-Enterprise-Compliance-Framework-Resource.mdx +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Bloodhound Enterprise Compliance Framework Resource -description: "BloodHound Enterprise aids numerous organizations in meeting their compliance requirements through our continuous monitoring of identity Attack Path exposure within their environments. We're eager to support you and your auditors in gaining a deeper understanding of the inner workings of BloodHound Enterprise and how we can help you meet your compliance goals." ---- - -Below, you'll find tables outlining various standard controls, detailing how BloodHound Enterprise supports these controls, and mapping them to relevant sections within the specific compliance frameworks. - -Within each table, the specific controls can be expanded to learn how BloodHound Enterprise satisfies each particular control. - -## Asset Management - -| | | | | | | | -| --- | --- | --- | --- | --- | --- | --- | -| **Control Category/Activity** | **How Does Bloodhound Enterprise Satisfy This Control?** | **[NIST CSF v1.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource)** | [NIST CSF v2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource) | [NIST 800-171](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource) | [NIST 800-53 rev 8](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource) | | -| Asset Management

The organization retains control over a system of devices, which undergoes reconciliation at intervals defined by the organization. | Inventory of Active Directory/Azure environments and objects is accomplished by scheduled scans/on-demand scans of the environment. | [ID.AM-1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#ID.AM-1)

[ID.AM-2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#ID.AM-2)

[ID.AM-5](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#ID.AM-5)

[PR.IP-1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#PR.IP-1) | [ID.AM-01](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource#ID.AM-01)

[ID.AM-02](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource#ID.AM-02)

[ID.AM-05](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource#ID.AM-05) | [3.1.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.1.1)

[3.4.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.4.1) | [CM-8](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#CM-8-Information-System-Component-Inventory)

[CP-2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#CP-2-Contingency-Plan)

[PM-5](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#PM-5-Information-System-Inventory)

[RA-2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#RA-2-Security-Categorization) | | - -## Risk Assessment - -| | | | | | | | -| --- | --- | --- | --- | --- | --- | --- | -| **Control Category/Activity** | **How Does Bloodhound Enterprise Satisfy This Control?** | **[NIST CSF v1.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource)** | **[NIST CSF v2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource)** | **[NIST 800-171](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource)** | **[NIST 800-53 rev 8](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource)** | | -| Risk Assessment

The organization employs mechanisms to understand the cybersecurity risk to operations, assets, and individuals. | BloodHound Enterprise automated analysis will generate a quantifiable attack path exposure metric related in identity attack paths that can help to satisfy this control. | [ID.RA-1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#ID.RA-1)

[ID.RA-3](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#ID.RA-3)

[ID.RA-5](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#ID.RA-5) | [ID.RA-01](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource#ID.RA-01)

[ID.RA-03](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource#ID.RA-03)

[ID.RA-05](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource#ID.RA-05) | [3.11.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.11.1)

[3.11.2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.11.2)

[3.11.3](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.11.3)

[3.12.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.12.1)

[3.12.2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.12.1)

[3.12.3](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.12.3)

[3.14.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.14.1)

[3.14.2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.14.2) | [CA-2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#CA-2---Security-Assessments)

[CA-7](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#CA-7---Continuous-Monitoring)

[CA-8](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#CA-8-Penetration-Testing)

[RA-3](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#RA-3-Risk-Assessment)

[RA-5](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#RA-5-Vulnerability-Scanning)

[SA-5](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#SA-5-Information-System-Documentation)

[SA-11](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#SA-11-Security-Testing-and-Evaluation)

[SI-2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#SI-2-Flaw-Remediation)

[SI-4](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#SI-4-Information-Systems-Monitoring) | | - -## Configuration Management - -| | | | | | | | -| --- | --- | --- | --- | --- | --- | --- | -| **Control Category/Activity** | **How Does Bloodhound Enterprise Satisfy This Control?** | [NIST CSF v1.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource) | **[NIST CSF v2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource)** | **[NIST 800-171](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource)** | **[NIST 800-53 rev 8](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource)** | | -| Configuration Management

The organization employs proactive mechanisms to detect deviations from baseline configurations within production environments. | Analysis of Active Directory/Azure Identities audits user and object permissions for deviations from established access and identity baselines | [PR.AC-4](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#PR.AC-4)

[PR.IP-1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#PR.IP-1)

[DE.AE-1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#DE.AE-1) | [PR.PS-01](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource#PR.PS-01) | [3.1.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.12.3)

[3.1.2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.1.2)

[3.1.5](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.1.2)

[3.1.6](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.1.6)

[3.1.7](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.1.7)

[3.4.5](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.4.5)

[3.4.6](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.4.6) | [AC-2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#AC-2----Account-Management)

[AC-3](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#AC-3---Access-Enforcement)

[IA-1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#IA-1-Identification-and-Authentication)

[IA-2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#IA-2-Identification-and-Authentication-(Organizational-Users))

[IA-4](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#IA-4-Identifier-Management)

[IA-8](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#IA-8-Identification-and-Authentication) | | - -## Detection - -| | | | | | | | -| --- | --- | --- | --- | --- | --- | --- | - -| | | | | | | | -| --- | --- | --- | --- | --- | --- | --- | -| **Control Category/Activity** | **How Does Bloodhound Enterprise Satisfy This Control?** | **[NIST CSF v1.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource)** | **[NIST CSF v2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource)** | **[NIST 800-171](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource)** | **[NIST 800-53 rev 8](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource)** | | -| Detection

The organization employs mechanisms within the environment that continuously monitor for anomalies and events. | Identity Attack Path vectors are assigned a severity rating in BloodHound Enterprise when detected during routine and on-demand scans | [DE.AE-2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#DE.AE-2)

[DE.AE-4](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#DE.AE-4)

[DE.AE-5](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#DE.AE-5)

[DE.CM-1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#DE.CM-1)

[DE.CM-8](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#DE.CM-8) | [DE.AE-02](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource#DE.AE-02)

[DE.AE-04](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource#DE.AE-04)

[DE.AE-08](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource#DE.AE-08) | [3.3.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.4.6)

[3.3.2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.4.6)

[3.3.5](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.3.5) | [CA-3](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#IA-8-Identification-and-Authentication)

[CM-2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#IA-8-Identification-and-Authentication) | | - -## Respond - -| | | | | | | | -| --- | --- | --- | --- | --- | --- | --- | -| **Control Category/Activity** | **How Does Bloodhound Enterprise Satisfy This Control?** | **[NIST CSF v1.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource)** | **[NIST CSF v2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource)** | **[NIST 800-171](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource)** | **[NIST 800-53 rev 8](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource)** | | -| Respond

Activities are performed to ensure effective response, support recovery activities, and mitigating steps are taken to prevent the expansion of an incident. | Bloodhound Enterprise detects and reports identified attack paths with a quantifiable risk metric and inventory of all impacted systems. Relevant remediation and mitigation documentation provided during analysis may help to satisfy this control. | [RS.AN-1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#RS.AN-1)

[RS.AN-2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#RS.AN-2)

[RS.MI-2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v1-1-Compliance-Resource#RS.MI-2) | [RS.MI-02](/hc/en-us/articles/Bloodhound-Enterprise-NIST-CSF-v2-Compliance-Resource#RS.AN-03) | [3.3.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.3.1)

[3.3.2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.3.1)

[3.3.5](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.3.5)

[3.6.1](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.3.5)

[3.6.2](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-171-Compliance-Resource#3.3.5) | [CA-7](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#CA-7---Continuous-Monitoring)

[IR-5](/hc/en-us/articles/Bloodhound-Enterprise-NIST-SP-800-53-Rev-8-Compliance-Resource#IR-5-Incident-Monitoring) | | diff --git a/docs/hc/en-us/articles/Contains.mdx b/docs/hc/en-us/articles/Contains.mdx deleted file mode 100644 index 2a01f6e281..0000000000 --- a/docs/hc/en-us/articles/Contains.mdx +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Contains -description: "GPOs linked to a container apply to all objects that are contained by the container. Additionally, ACEs set on a parent OU may inherit down to child objects." ---- - - - - - -## Abuse Info - -With control of an OU, you may add a new ACE on the OU that will inherit down to the objects under that OU. Below are two options depending on how targeted you choose to be in this step: - -### Generic Descendent Object Takeover - -The simplest and most straight forward way to abuse control of the OU is to apply a GenericAll ACE on the OU that will inherit down to all object types. Again, this can be done using PowerView. This time we will use the New-ADObjectAccessControlEntry, which gives us more control over the ACE we add to the OU. - -First, we need to reference the OU by its ObjectGUID, not its name. You can find the ObjectGUID for the OU in the BloodHound GUI by clicking the OU, then inspecting the _objectid_ value - -Next, we will fetch the GUID for all objects. This should be ‘00000000-0000-0000-0000-000000000000’: - -```bash -$Guids = Get-DomainGUIDMap -$AllObjectsPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'All'} | select -ExpandProperty name -``` - -Then we will construct our ACE. This command will create an ACE granting the “JKHOLER” user full control of all descendant objects: - -```bash -ACE = New-ADObjectAccessControlEntry -Verbose -PrincipalIdentity 'JKOHLER' -Right GenericAll -AccessControlType Allow -InheritanceType All -InheritedObjectType $AllObjectsPropertyGuid -``` - -Finally, we will apply this ACE to our target OU: - -```bash -$OU = Get-DomainOU -Raw (OU GUID) -$DsEntry = $OU.GetDirectoryEntry() -$dsEntry.PsBase.Options.SecurityMasks = 'Dacl' -$dsEntry.PsBase.ObjectSecurity.AddAccessRule($ACE) -$dsEntry.PsBase.CommitChanges() -``` -Now, the “JKOHLER” user will have full control of all descendent objects of each type. - -### Targeted Descendent Object Takeoever - -If you want to be more targeted with your approach, it is possible to specify precisely what right you want to apply to precisely which kinds of descendent objects. You could, for example, grant a user “ForceChangePassword” privilege against all user objects, or grant a security group the ability to read every GMSA password under a certain OU. Below is an example taken from PowerView’s help text on how to grant the “ITADMIN” user the ability to read the LAPS password from all computer objects in the “Workstations” OU: -```bash -$Guids = Get-DomainGUIDMap -$AdmPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'ms-Mcs-AdmPwd'} | select -ExpandProperty name -$CompPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'Computer'} | select -ExpandProperty name -$ACE = New-ADObjectAccessControlEntry -Verbose -PrincipalIdentity itadmin -Right ExtendedRight,ReadProperty -AccessControlType Allow -ObjectType $AdmPropertyGuid -InheritanceType All -InheritedObjectType $CompPropertyGuid -$OU = Get-DomainOU -Raw Workstations -$DsEntry = $OU.GetDirectoryEntry() -$dsEntry.PsBase.Options.SecurityMasks = 'Dacl' -$dsEntry.PsBase.ObjectSecurity.AddAccessRule($ACE) -$dsEntry.PsBase.CommitChanges() -``` -## Opsec Considerations - -Creation and modification of ACEs will be logged depending on the auditing setup on Domain Controllers. - -## References - -* [https://wald0.com/?p=179](https://wald0.com/?p=179) -* [https://blog.cptjesus.com/posts/bloodhound15](https://blog.cptjesus.com/posts/bloodhound15) diff --git a/docs/hc/en-us/articles/Install-BloodHound-Community-Edition-with-Docker-Compose.mdx b/docs/hc/en-us/articles/Install-BloodHound-Community-Edition-with-Docker-Compose.mdx deleted file mode 100644 index 9180a7451e..0000000000 --- a/docs/hc/en-us/articles/Install-BloodHound-Community-Edition-with-Docker-Compose.mdx +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Install BloodHound Community Edition with Docker Compose ---- - - - - - -## Purpose - -This article outlines the configuration files of BloodHound Community Edition (BHCE) installed with Docker Compose and how to configure them. - -For a more advanced walkthrough of the deployment process, read our deployment [README.MD](https://github.com/SpecterOps/BloodHound#readme) in GitHub. - -**NOTE: Do not follow this guide if you intend to expose the databases outside of Docker. Use the instructions in README.MD to make sure you change the default database passwords accordingly.** - -## Prerequisites - -Running the example Docker Compose project requires the following: - -* A Docker-compatible container runtime, for example, [Docker Desktop](https://www.docker.com/) or [Podman (with Docker compatibility enabled)](https://www.redhat.com/sysadmin/podman-docker-compose) -* [Docker Compose](https://docs.docker.com/compose/install/) (automatically included with Docker Desktop) - -The simplest way to get started is to install [Docker Desktop](https://www.docker.com/products/docker-desktop/), as it will provide both prerequisites and require no additional configuration. - -## Process - -**Optional:** One-line command for Steps 1 & 2 -```json -curl -L https://ghst.ly/getbhce | docker compose -f - up -``` -_On Windows, execute the command in CMD, or use "curl.exe" instead of "curl" in PowerShell._ - -1. Download the [Docker Compose YAML file](https://github.com/SpecterOps/BloodHound/blob/main/examples/docker-compose/docker-compose.yml) and save it to a directory where you'd like to run BHCE. - * On Linux/Mac: `curl -L https://ghst.ly/getbhce > .\docker-compose.yml` - * On Windows, from CMD: `curl -L https://ghst.ly/getbhce > .\docker-compose.yml` - * On Windows, from PowerShell: `Invoke-WebRequest -Uri https://ghst.ly/getbhce -OutFile .\docker-compose.yaml` -2. Navigate to the folder with the saved `docker-compose.yaml` file and run `docker compose pull && docker compose up`. - * To run BHCE without the need to maintain the terminal interface, use `docker compose up -d`, and then `docker compose logs` to see the most recent logs from the environment. -3. Locate the randomly generated password in the terminal output of Docker Compose. - - - - * The password cannot be regenerated. If you lost the password, simply run `docker compose down -v` and then `docker compose up` to reset your databases. -4. In a browser, navigate to [http://localhost:8080/ui/login](http://localhost:8080/ui/login). Login with the username `admin` and the randomly generated password from the logs. - -Note: The default `docker-compose.yml` example binds only to localhost (127.0.0.1). If you want to access BHCE outside of localhost, you'll need to follow the instructions in examples/docker-compose/README.md to configure the host binding for the container. - -## Outcome - -At the completion of this process, users will be logged into a locally hosted BHCE tenant running with Docker Compose. - diff --git a/docs/hc/en-us/articles/MemberOf.mdx b/docs/hc/en-us/articles/MemberOf.mdx deleted file mode 100644 index fc33ddb42d..0000000000 --- a/docs/hc/en-us/articles/MemberOf.mdx +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: MemberOf ---- - - - - - -Groups in active directory grant their members any privileges the group itself has. If a group has rights to another principal, users/computers in the group, as well as other groups inside the group inherit those permissions. - -Abuse Info[](#heading-1) ------------------------- - -No abuse is necessary. This edge simply indicates that a principal belongs to a security group. - -Opsec Considerations[](#heading-2) ----------------------------------- - -No opsec considerations apply to this edge. - -References[](#heading-3) ------------------------- - -* [https://adsecurity.org/?tag=ad-delegation](https://adsecurity.org/?tag=ad-delegation) -* [https://www.itprotoday.com/management-mobility/view-or-remove-active-directory-delegated-permissions](https://www.itprotoday.com/management-mobility/view-or-remove-active-directory-delegated-permissions) - diff --git a/docs/hc/en-us/articles/Owns.mdx b/docs/hc/en-us/articles/Owns.mdx deleted file mode 100644 index b9cb902543..0000000000 --- a/docs/hc/en-us/articles/Owns.mdx +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Owns ---- - - - - - -Object owners retain the ability to modify object security descriptors, regardless of permissions on the object’s DACL - -This clip shows an example of abusing object ownership: - - - -Abuse Info[](#heading-1) ------------------------- - -With ownership of the object, you may modify the DACL of the object however you wish. For more information about that, see the WriteDacl edge section. - -Opsec Considerations[](#heading-2) ----------------------------------- - -This depends on the target object and how to take advantage of this privilege. - -When using the PowerView functions, keep in mind that PowerShell v5 introduced several security mechanisms that make it much easier for defenders to see what’s going on with PowerShell in their network, such as script block logging and AMSI. You can bypass those security mechanisms by downgrading to PowerShell v2, which all PowerView functions support. - -Modifying permissions on an object will generate 4670 and 4662 events on the domain controller that handled the request. - -References[](#heading-3) ------------------------- - -* [https://www.youtube.com/watch?v=z8thoG7gPd0](https://www.youtube.com/watch?v=z8thoG7gPd0) diff --git a/docs/hc/en-us/articles/Release-Notes-Summary-Overview.mdx b/docs/hc/en-us/articles/Release-Notes-Summary-Overview.mdx deleted file mode 100644 index 089fa9d4de..0000000000 --- a/docs/hc/en-us/articles/Release-Notes-Summary-Overview.mdx +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Release Notes Summary Overview -description: This article contains an overview of all release note summaries. Check out individual release notes for details. -mode: wide ---- - -| | | | | -| --- | --- | --- | --- | -| **Release** | **BloodHound** | **SharpHound** | **AzureHound** | -| 2024-11-20 (v6.2.2) | Bug Fixes

* Fixed an excessive resource utilization issue during post-processing.
* After migrating a user to login via SSO, their old password will be invalidated immediately. | _No new release._ | _No new release._ | -| 2024-11-15  (v6.2.1) | Bug Fixes

* Reverted the Azure post-processing changes due to excessive resource utilization. | _No new release._ | _No new release._ | -| [2024-11-14 Release Notes (v6.2.0)](/hc/en-us/articles/2024-11-14-Release-Notes-v6-2-0) | New and Improved Features

* Added multiple pre-saved Cypher queries regarding objects marked "Owned."
* Added the "Map OU structure" pre-saved query, previously available in BloodHound Legacy.
* Updated the "Kerberoastable Users" pre-saved cypher query to properly filter out disabled objects, MSAs, GMSAs, and the KRBTGT object.
* Updated all pre-saved Cypher queries to use consistent quotation marks for easier use in API integrations.
* Clicking the "Login via SSO" button will automatically redirect if only a single SSO provider is configured.
* Updated the permissions for the "Upload only" role to align more accurately with what the name implies. This role will no longer be able to modify asset group membership or trigger analysis runs.
* Renamed the "RemoteInteractiveLoginPrivilege" edge to "RemoveInteractiveLogonRight" to match the Microsoft naming schema.
* Improved performance of EntraID post-processing.

Bug Fixes

* Logins via SAML will now correctly appear in the Audit log.
* Corrected several property type errors in data coming from SharpHound.
* _\[CE Only\]_ Docker Compose health check will now work with a modified Neo4J web port set (Thank you, [@yannis-srl](https://github.com/yannis-srl), for your contribution!).
* _\[BHE Only__\]_ SyncedToEntraUser, SyncedToADUser, ADCSESC9b, and ExtendedByPolicy edges will now reconcile properly. | _No new release._ | _No new release._ | -| [2024-10-22 Release Notes (v6.1.0)](/hc/en-us/articles/2024-10-22-Release-Notes-v6-1-0) | _No new features or fixes._ | **SharpHound v2.5.11 - BHE, v2.5.8 - CE**

New and Improved Features

* Migrated ACL hashing functionality to utilize SHA1 to support environments that enforce FIPS-compliant algorithms.

Bug Fixes

* Fixed collection of LAPS edges in both legacy and modern systems. | _No new release.
_ | -| [2024-09-30 Release Notes (v6.0.0)](/hc/en-us/articles/2024-09-30-Release-Notes-v6-0-0) | New and Improved Features

* Dark mode is now generally available!
* Introducing optional support for Citrix Direct Access Users group in CanRDP logic!
* _\[BHE Only\]_ Reconciliation timelines are now configurable!
* Improved logic for identifying and creating complex edges requiring multiple permissions (including ADCS ESC, DCSync, etc.) when Authenticated Users@ or Everyone@ groups are involved.
* Improved accuracy on ADCS ESC9 and ESC10 processing logic
* CanRDP edges will now appropriately appear from Computer objects with permission to RDP to another computer.
* Provided additional abuse information to ADCSESC9b, ADCSESC10b, GenericAll, GenericWrite, Contains, Owns, WriteDacl, AllExtendedWrites, and WriteOwner Attack Path primitives.
* Support for .zip file uploads that include UTFBOM markings within contained JSON files has been added.

Bug Fixes

* Resolved an intermittent issue with the parallelization of ADCS post-processing.
* Applying multiple filter predicates to an API query will no longer throw an error.
* Admin Audit log API endpoints now correctly support the "skip" query parameter.
* The Cypher query window will no longer extend beyond the end of the browser.
* _\[BHE Only\]_ Resolved some duplicate collection issues related to highly available deployments. | **SharpHound (v2.5.10 - BHE)**

Bug Fixes

* _\[BHE Only\]_ Resolved several installation issues for specific scenarios. | _No new release._ | -| 2024-09-19 (v5.15.1) | _No changes._ | **SharpHound (v2.5.9 - BHE, v2.5.7 - CE)**

Bug Fixes

* Resolved an issue with enumerating domain objects where password rotation is not enforced.
* Improved collection performance related to the collection of ACEs with unresolvable SIDs. | _No new release._ | -| [2024-09-10 Release Notes (v5.15.0)](/hc/en-us/articles/2024-09-10-Release-Notes-v5-15-0) | New and Improved Features

* New Attack Path: WriteGPLink (Thank you, [@q-roland](https://github.com/q-roland), for your contribution! _Requires SharpHound v2.5.6+_).
* Added 22 additional AD properties, including information about authentication, passwords, and extra domain/trust information with supporting saved queries _(Requires SharpHound v2.5.6+)._
* Added support for GenericWrite Attack Paths targetting OUs and Domain objects (Thank you, [@q-roland](https://github.com/q-roland), for your contribution! _Requires SharpHound v2.5.6+_).
* Updated ESC6a logic to no longer require weak certificate mapping after confirming that it no longer prevents the escalation.
* OUs that contain Tier Zero / High Value objects will now be automatically tagged as Tier Zero objects, too.
* ESC6/9/10 analysis logic will now include domain controllers from child domains as well.
* Added a Login URL property to Entra Users to show the user's SSO URL.
* Removed all "CanAbuse" non-transitive edges from the graph schema and updated ESC logic accordingly.
* _\[CE Only\]_ Owned objects will now show an associated glyph icon in Explore (Thank you, [@palt](https://github.com/palt), for your contribution!).

Bug Fixes

* Fixed abuse info on multiple Attack Paths that grant the ability to abuse LAPS settings.
* Improved JSON error handling for file uploads.
* File uploads should no longer get stuck on "Analyzing."
* _\[BHE Only\]_ Fixed an issue where specific collection jobs would trigger twice.
* _\[BHE Only\]_ Attack Path titles may now easily be copied again. | **SharpHound (v2.5.8 - BHE, v2.5.6 - CE)**

New and Improved Features

* Complete re-write of LDAP connection and collection logic, resulting in improved consistency and performance.
* Add support for the collection of 22 additional properties and for GenericWrite Attack Paths targeting OU and Domain objects.
* _\[BHE Only\]_ Moved auth.json and settings.json to the service user's APPDATA directory.

Bug Fixes

* _\[BHE Only\]_ Resolved several cross-trust collection issues. | **AzureHound (v2.2.1)**

New and Improved Features

* Reduced default number of concurrent connections opened with Entra/Azure APIs (Thank you, [@olafhartong,](https://github.com/olafhartong) for your support in identifying the cause of these issues)
* Added several optional performance-tuning settings
* Reduced volume of data output by pruning empty or unnecessary fields (Thank you, [@malacupa](https://github.com/malacupa), for your support in identifying the cause of these issues)
* _\[BHE Only\]_ Reduced default batch size for upload of data to BloodHound Enterprise | -| [2024-08-20 Release Notes (v5.14.0)](/hc/en-us/articles/2024-08-20-Release-Notes-v5-14-0) | New and Improved Features

* Added support for ADCS certificate chains crossing AIA Certificate Authorities
* Improved logic across all included cypher queries for improved performance
* Clarified the "blocksinheritance" property on OUs is specific to GPO inheritance
* Users without administrative privileges will no longer see Group Management actions in right-click context menus
* Added support for ingesting JSON files which include UTFBOM encoding

Bug Fixes

* Improved visibility of several buttons and elements in dark mode
* Added abuse information for the GPLink edge
* Fixed the count of objects displayed in the Group Management page | _Note: We are working on a new version of SharpHound that has improved performance and reliability when querying data via LDAP. If you would like to test that version, please get in touch with your TAM.
_ | _No new release._ | -| [2024-08-06 Release Notes (v5.13.1)](/hc/en-us/articles/2024-08-06-Release-Notes-v5-13-1) | Bug Fixes

* Resolved an issue where hybrid paths were not created when the AD object did not have a known object type during path creation.
* The 2FA login screen will no longer return to the username/password screen if the browser window is unselected before completing the login flow.
* _\[BHE Only\]_ Resolved a race condition during analysis in highly-available deployments | _Note: We have reverted the available SharpHound build to v2.4.1 while we address issues identified in v2.5.4._ | _No new release.
_ | -| [2024-08-01 Release Notes (v5.13.0)](/hc/en-us/articles/2024-08-01-Release-Notes-v5-13-0) | New and Improved Features

* New Attack Paths: Entra-AD User Syncing
* Improved analysis performance - DCSync
* Added visibility of the current API version to the My Profile page
* _\[Early Access\]_ BloodHound dark mode

Bug Fixes

* Resolved an issue that resulted in objects having multiple types after import to BloodHound (A collection will be required to reintroduce appropriate object types on affected principals)
* File ingest will now show partial errors on upload
* Hovering errors in the Cypher query editor will no longer overflow the viewable area
* Negative numbers will now compare properly in Cypher
* Fixed a logic issue on composition panels for ESC3, 4, and 6 for multi-tier PKI environments
* Updated logic for EnrollOnBehalfOf to utilize the proper EKU property
* Improved error handling in specific circumstances on file ingest
* _\[BHE Only\]_ Resolved an issue with collectors improperly incrementing job counts | **SharpHound (v2.5.4 - BHE, v2.5.4 - CE)**

_Note: SharpHound's LDAP libraries have undergone a complete rewrite to improve stability and resolve issues. This will resolve issues that are not explicitly captured in these release notes. We will continue to iterate as we find more issues. Please work with your TAM if you have any questions about upgrading.
_

New and Improved Features

* Improved logic for identifying and querying available DCs (when a DC is not specified)
* Reduced reliance on paged LDAP queries for improved LDAP query performance
* Introduced a connection pool for improved LDAP query performance
* Improved fallback and retry logic for LDAP ServerDown message
* Computer availability for Local Group and Session collection will now be based on the last logon instead of the last password rotation
* Improved logging levels and message outputs

Bug Fixes

* _\[BHE Only\]_ Resolved an issue where allowing LDAPS connections would only attempt connections on the LDAPS-specified port
* _\[CE Only\]_ Improved handling of control characters using the "collectallproperties" flag to resolve ingestion issues | _No new release._ | -| [2024-07-17 Release Notes (v5.12.0)](/hc/en-us/articles/2024-07-17-Release-Notes-v5-12-0) | New and Improved Features

* _\[BHE Only\]_ Visual overhaul of the Attack Paths view
* Added documentation hints to all administrative pages
* Improved analysis performance - SyncLAPSPassword
* Example Azure data is now available

Bug Fixes

* Improved resolution of AzApp object names
* Reverted a change in Azure ingest that was resulting in inconsistent results in BloodHound | _No new release._ | _No new release._ | -| [2024-06-17 Release Notes (v5.11.0)](/hc/en-us/articles/2024-06-17-Release-Notes-v5-11-0) | New and Improved Features

* Password changes will now require validation of your current password to complete
* Updated pre-defined queries and added a hygiene section
* _\[BHE Only\]_ Azure findings have been collapsed based on path type only, aligning with Active Directory finding types
* _\[BHE Only__\]_ Clicking "Explore" on a finding will now automatically display the entity panel for the associated edge
* _\[BHE Only\]_ Findings documentation is now served by a proper API endpoint

Bug Fixes

* Azure principals with scoped Application Administrator or scoped Cloud App Admin role assignments will no longer receive a AzHasRole edge to the AzRole nodes. These nodes are only used for Tenant-scoped role assignments.
* Group Management view will now properly display members of custom groups
* Resolved several erroneous timeout issues
* Corrected inaccurate use of CONTAINS verb in several pre-defined queries
* Updated example abuse commands on several ADCS escalation paths
* Corrected specific certificate template names on entity panels
* _\[BHE Only\]_ Fixed several bugs in Azure finding logic | _No new release._ | _No new release._ | -| [2024-05-28 Release Notes (v5.10.0)](/hc/en-us/articles/2024-05-09-Release-Notes-v5-9-0) | New and Improved Features

* Improved Cypher quality controls to prevent failure and errors
* Example Active Directory data now available
* _\[BHE Only\]_ Updated reference links for all Attack Path findings
* _\[CE Only__\]_ Enable graph mutation via Cypher

Bug Fixes

* Entity panels will now appear regardless of the object type selected
* _\[CE Only\]_ Added missing package caches for offline builds | _No new release._ | _No new release._ | -| [2024-05-09 Release Notes (v5.9.0)](/hc/en-us/articles/2024-05-09-Release-Notes-v5-9-0) | New and Improved Features

* Support for ADCS ESC 13 (Requires SharpHound v2.4.1+)
* Added support for GenericWrite edges to ADCS node types
* Improved performance of AZAddSecret paths

Bug Fixes

* DCSync edges will no longer be filtered out from Tier Zero / High-Value principals
* ADCS ESC 1 edges will now generate properly across multiple domains regardless of domain collection status
* Several fixes to Edge Composition responses
* _\[BHE Only\]_ Collection schedules should now consistently display their scheduled start time
* _\[BHE Only\]_ Finished Jobs Log pagination controls no longer scroll
* _\[BHE Only\]_ Improved fallback logic for the Attack Paths page in the event of an unexpected failure
* _\[CE Only__\] _Modifying the default_admin fields will now properly reflect in a newly created environment | **SharpHound (v2.4.1 - BHE, v2.4.1 - CE)**

New and Improved Features

* Collection support for Issuance Policy Nodes
* Improved identification logic for Contains edges
* Added support for specific obsolete Trust type values

Bug Fixes

* Resolved several issues related to cross-trust collections | **AzureHound (v2.1.9)**

New and Improved Features

* Added backoff/retry logic to several calls for improved stability and resiliency

Bug Fixes

* AZAppAdmin and AZCloudAppAdmin edges will now properly link to the AzApps they target | -| [2024-04-15 Release Notes (v5.8.1)](/hc/en-us/articles/2024-04-15-Release-Notes-v5-8-1) | New and Improved Features

* Improved status messaging for the File Ingest Log
* Added additional node-type statistics to Data Quality
* _\[BHE Only\] _Improved performance for collection schedules for extremely large environments

Bug Fixes

* _\[BHE Only\] _DcFor edges will no longer appear in the Attack Path tree view
* Resolved multiple vulnerabilities identified across the product | **v2.3.10 - BHE, v2.3.3 - CE**

Bug Fixes

* _\[BHE Only\]_ Resolved an issue where the SharpHound service would restart in specific scenarios. | _No new release._ | -| [2024-03-27 Release Notes (v5.8.0)](/hc/en-us/articles/2024-03-27-Release-Notes-v5-8-0) | New and Improved Features

* File Ingest now supports .ZIP format and large files!
* Option to clear database from within Administration!
* Support for ADCS ESC4 Attack Path
* _\[BHE Only\]_ BUILTIN\\Users group will now appear within Large Default Groups findings
* Improved accuracy on several ADCS components
* Several API performance consistency improvements
* Various minor UI improvements

Bug Fixes

* Custom asset groups will no longer allow whitespace in tag property
* _\[CE Only\]_ Improved alignment of arrows and edges on graph canvas
* Various minor UI bug fixes
* _\[BHE Only\]_ Added finding documentation for the "Add Secret to Tier Zero Service Principal" finding | **v2.3.7 - BHE, v2.3.3 - CE**

New and Improved Features

* _\[BHE Only\]_ SharpHound Enterprise will now properly throw an error if SharpHoundRPC.dll is missing

Bug Fixes

* Failure to resolve SIDs from hostname will no longer result in errant object creation in BloodHound
* _\[BHE Only\]_ Resolved an issue where attempting to collect from uncollectible domains would result in SharpHound service restart. | **v2.1.8**

New and Improved Features

* Improved logging outputs on application panic | -| 2024-03-05 (v5.7.1) | Bug Fixes

* Resolved an issue with group name ingestion | _No new release._ | _No new release._ | -| [2024-03-04 Release Notes (v5.7.0)](/hc/en-us/articles/2024-03-04-Release-Notes-v5-7-0) | New and Improved Features

* Added support for AD Certificate Services ESC 6b / 9b / 10b Attack Paths
* Reduced memory impact during data ingest
* Improved performance on the Group Management view
* Improved visualization of edges that begin and end at the same node

Bug Fixes

* \[_BHE Only_\] Fixed an issue with Microsoft Graph App Role reconciliation
* \[_BHE Only_\] Truncated exposure measurements to two decimal places on the Attack Paths view
* Resolved several issues related to unexpected timeouts
* Improved handling of invalid JSON during ingest
* Creating custom asset groups no longer allows whitespace in the "tag" property | _No new release._ | _No new release._ | -| [2024-02-14 Release Notes (v5.6.0)](/hc/en-us/articles/2024-02-14-Release-Notes-v5-6-0) | New and Improved Features

* General Availability of AD Certificate Services paths: GoldenCert, ESC1, ESC3, ESC6a, ESC9a, ESC10a (requires latest version of SharpHound)
* New "Power User" role was added in BloodHound as a bridge between "User" and "Administrator"
* Added filtering capabilities to the Group Management view
* Significant expansion of data available in BloodHound audit logs
* Improved accuracy in the "... where Domain Users can RDP" default cypher queries
* _\[BHE Only\] _Analysis will now separate warnings from errors in completion, leading to more accurate completion of analysis in environments

Bug Fixes

* Data Quality page fails to count Azure tenant objects in specific scenarios
* Improved accuracy of the "count" responses from paginated API queries
* Resolved a specific issue with SAML implementations resulting in inaccurate "NotAuthorized" responses
* Resolved several role-privilege issues with BloodHound roles (The "User" role can no longer perform actions in the Manage Clients page, the "Upload Only" role can no longer view Experimental Features)
* Moving from "Pathfinding" to "Search" on the "Explore" page will now properly disable pathfinding
* Cursors will no longer jump to the end of the search fields on "Explore"
* _\[BHE Only\] _TrustedBy edges should now reconcile appropriately | **v2.3.5 - BHE, v2.3.2 - CE**

New and Improved Features

* Additional ADCS property collection

Bug Fixes

* Resolved issues with hitting KERNELFAULT errors during collection
* Improved handling and retries for LDAP ServerDown responses, preventing cross-trust collection | **v2.1.7**

New and Improved Features

* Significant reduction in memory consumption when processing Azure group membership information

Bug Fixes

* _\[BHE Only\]_ AzureHound will now properly respect the verbosity setting set in config.json | -| [2024-01-23 Release Notes (v5.5.0)](/hc/en-us/articles/2024-01-23-Release-Notes-v5-5-0) | New and Improved Features

* AD Certificate Services ESC3 Early Access support (Requires latest version of SharpHound)
* Expanded memory limit for query execution (Including Cypher and Entity Panel queries)
* Added Group Management tab for reviewing and modifying members of Tier Zero / High Value / Owned
* Improved performance of AZResetPassword paths
* The Azure role Partner Tier2 Support is now a default member of Tier Zero / High Value asset groups.
* _\[CE Only\]_ Added ability to mark objects as "Owned"

Bug Fixes

* Container nodes will now properly display an Entity Panel when selected in Explore.
* The "Affected Objects" section of GPO Entity Panels will no longer display "NaN" when no objects are affected.
* _\[BHE Only\]_ Attack Paths table and path view now use the same boundaries for severity highlighting.
* _\[BHE Only\]_ The AzureT0MgmtGroupControl finding will no longer appear, and historical records have been removed.
* _\[CE Only\]_ Resolved an issue impacting the use of multi-underscore environment variables when running an environment. | **v2.3.3 - BHE, v2.3.1 - CE**

New and Improved Features

* Additional support for ADCS collection capabilities.

Bug Fixes

* Updated logic for collection and reconciliation of ADCS objects.
* Resolving a SID to a domain will now appropriately utilize cache entries (@uidzeroo).
* _\[CE Only\] _GPO Local Group processing will no longer stop processing on a failed account name resolution (@nurfed1).
* _\[CE Only\] _Updated use of LDAP credentials when collecting domain details to prevent invalid username/password issues (@nurfed1). | _No new release._ | -| 2024-01-10 (v5.4.1) | Bug Fixes

* Analysis will no longer fail when expected properties do not exist in AD CS objects.
* Resolved a potential deadlock state for API access of backend databases.
* Improved accuracy of post-processing of CanRDP edges. This notably impacted BUILTIN\\Remote Desktop Users and Domain Controllers. | _No new release._ | _No new release._ | -| [2024-01-04 Release Notes (v5.4.0)](/hc/en-us/articles/2024-01-04-Release-Notes-v5-4-0) | New and Improved Features

* Early access for ADCS Attack Paths!
* Edge composition support
* _\[CE Only\] _Modified default docker compose example to bind only to localhost for improved security defaults | **v2.3.2 - BHE, v2.3.0 - CE**

New and Improved Features

* Support for ADCS collection capabilities | _No new release._ | -| 2023-12-11 (v5.3.1) | Minor database performance improvements for specific scenarios. | _No new release._ | _No new release._ | -| [2023-12-05 Release Notes (v5.3.0)](/hc/en-us/articles/2023-12-05-Release-Notes-v5-3-0) | New and Improved Features

* Added node action right-click menu with set start/end node and copy commands!
* Improved performance on AZResetPassword edges.
* Expanded memory available for queries.
* Disabling MFA on a user will provide a more explicit warning.
* Saved custom queries are now available in CE as well as BHE.
* _\[BHE Only\]_ Collection schedules may now be modified via the text and date/time pickers.

Bug Fixes

* Container nodes will now show an entity panel.
* Removed aggressive timeouts on File Ingest uploads.
* Affected Objects counts on GPO object entity panels should properly report "0" when appropriate.
* Saved queries created using the API will now properly associate with the creating user.
* _\[BHE Only\]_ Selecting a custom range on the Posture page will now highlight "Custom".
* _\[CE Only\]_ Resolved an issue with the ingestion of sessions in specific scenarios.
* _\[CE Only\] _Resolved an issue with multi-underscore keys breaking config values. | **v2.2.2 - BHE, v2.0.2 - CE**

New and Improved Features

* _\[CE Only\] _Added the ability to perform session enumeration as a local admin user (@LuemmelSec, @eversinc33)
* _\[BHE Only\]_ Expanded signing of files to aid in AV issues.

Bug Fixes

* Resolved an issue with collecting and processing special characters.
* Fixed a cache (de)serialization issue with checking versions. | **v2.1.6**

New and Improved Features

* Audited and removed additional opportunities for context-lock contention in the future. | -| _Please check individual release notes to read earlier summaries._ | | | | diff --git a/docs/hc/en-us/articles/SAML-ADFS-Configuration.mdx b/docs/hc/en-us/articles/SAML-ADFS-Configuration.mdx deleted file mode 100644 index b4f96c9912..0000000000 --- a/docs/hc/en-us/articles/SAML-ADFS-Configuration.mdx +++ /dev/null @@ -1,85 +0,0 @@ ---- -title: "SAML: ADFS Configuration" -description: "This document provides instructions for creating an application within ADFS for compatibility with BloodHound Enterprise." ---- - - - - - -For general instructions on adding a SAML provider to BloodHound Enterprise or for configuring users to utilize a SAML provider, see [SAML in BloodHound Enterprise](/hc/en-us/articles/SAML-in-BloodHound). - -See [SAML Order of Operations and Quick Reference](/hc/en-us/articles/SAML-in-BloodHound) before starting. - -## Create an Application - -1. In the AD FS management console, right-click on Relaying Party Trust and click “Add Relaying Party Trust”. - - - -2. Choose “Claims aware” and click “Start”. - - - -3. Insert the metadata URL based on your chosen name and click “Next.” - - - -4. Enter the preferred display name and click “Next.” - - - -5. Choose the desired Access Control Policy. (Note that access and permissions are configured within BloodHound Enterprise). - - - -6. Review the information presented and click “Next”. - - - -7. Leave the “Configure claims issuance policy for this application” box checked and click “Close”. - - - - -## Complete SAML Integration Configuration - -1. On the “Edit Claim Issuance Policy” dialog box, click “Add Rule…”. - - - -2. Choose “Send LDAP Attributes as Claims” and click “Next. - - - -3. Fill out the following and click “Finish”. - - LDAP Attribute: E-Mail-Addresses - Outgoing Claim Type : E-Mail Address - - - - -4. Click “Add Rule” to add another claim rule. - - - -5. Choose “Transform and Incoming Claim” and click “Next”. - - - -6. Fill out the following and click “Finish”. - - Incoming claim type: E-Mail Address - Outgoing claim type: Name ID - Outgoing name ID format: Email - Choose “Pass through all claim values” - - - -7. Click “Apply”. - - - -8. Download the metadata file provided by your ADFS environment. By default, this is hosted at: https://YOURDOMAIN/federationmetadata/2007-06/federationmetadata.xml -9. Follow the instructions at [SAML in BloodHound Enterprise](/hc/en-us/articles/SAML-in-BloodHound) to create the SAML provider in BloodHound Enterprise. diff --git a/docs/hc/en-us/articles/SAML-Auth0-Configuration.mdx b/docs/hc/en-us/articles/SAML-Auth0-Configuration.mdx deleted file mode 100644 index 1f2549a2bf..0000000000 --- a/docs/hc/en-us/articles/SAML-Auth0-Configuration.mdx +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: "SAML: Auth0 Configuration" -description: "This document provides instructions for creating an application within Auth0 for compatibility with BloodHound Enterprise." ---- - - - - - - -For general instructions on adding a SAML provider to BloodHound Enterprise, or for configuring users to utilize a SAML provider, see [SAML in BloodHound Enterprise](/hc/en-us/articles/SAML-in-BloodHound). - -See [SAML Order of Operations and Quick Reference](/hc/en-us/articles/SAML-in-BloodHound) before starting. - -## Create an Auth0 Application - -1. Create an authentication application for BloodHound Enterprise in Auth0. - - - -2. Assign a recognizable name to the application and select the integration option for "Regular Web Application." - - - -3. After the creation of the application in Auth0 you should see the application details page. - - - -4. Click on the "Addons" tab. - - - -5. Enable the "SAML2 Webapp" toggle and download the Identify Provider Metadata file. - - - -6. Follow the instructions at [SAML in BloodHound Enterprise](/hc/en-us/articles/SAML-in-BloodHound) to create the SAML provider in BloodHound Enterprise. diff --git a/docs/hc/en-us/articles/SAML-Google-IDP-Configuration.mdx b/docs/hc/en-us/articles/SAML-Google-IDP-Configuration.mdx deleted file mode 100644 index ed7920d204..0000000000 --- a/docs/hc/en-us/articles/SAML-Google-IDP-Configuration.mdx +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: "SAML: Google IDP Configuration" -description: "This document provides instructions for creating an application within Google for compatibility with BloodHound Enterprise." ---- - - - - - -For general instructions on adding a SAML provider to BloodHound Enterprise, or for configuring users to utilize a SAML provider, see [SAML in BloodHound Enterprise](/hc/en-us/articles/SAML-in-BloodHound). - -See [SAML Order of Operations and Quick Reference](/hc/en-us/articles/SAML-in-BloodHound) before starting. - -## Create a Google Application - -1. On the Admin Console for Google Workspaces, use the left navigation bar and go to Apps -> Web and Mobile Apps - - - - - -2. Select “Add App” -> Add Custom SAML app - - - - - -3. Give the app an appropriate name, such as BloodHound Enterprise. - - Optionally, add an icon and description. - - - - - - - -4. On the next screen, download the metadata file and continue. - - -5. Enter the ACS URL and Entity ID as follows: - - **ACS URL:** - - https://_TENANT_NAME_.bloodhoundenterprise.io/api/v1/login/saml/google/acs - - **Entity ID:** https://_TENANT_NAME_.bloodhoundenterprise.io/api/v1/login/saml/google

 - - **\*IMPORTANT: Replace “TENANT NAME” with your specific bloodhound tenant name.\* ** - - - - - - -6. On the next screen, it is required to send the email attribute to BloodHound. - - BloodHound will accept either of the following values as the “App Attributes”: - - * http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress - - * urn:oid:0.9.2342.19200300.100.1.3 - - - - - -7. Follow the instructions at [SAML in BloodHound Enterprise](/hc/en-us/articles/SAML-in-BloodHound) to create the SAML provider in BloodHound Enterprise. diff --git a/docs/hc/en-us/articles/Troubleshooting-Local-Collection-Coverage.mdx b/docs/hc/en-us/articles/Troubleshooting-Local-Collection-Coverage.mdx deleted file mode 100644 index e0ace862d2..0000000000 --- a/docs/hc/en-us/articles/Troubleshooting-Local-Collection-Coverage.mdx +++ /dev/null @@ -1,148 +0,0 @@ ---- -title: Troubleshooting Local Collection Coverage ---- - - - - - -SharpHound collects data from domain-joined systems utilizing SMB/RPC on port 445/TCP and requires the account running SharpHound (e.g., the SharpHound Enterprise gMSA) to have local administrator membership on each system in scope, see [SharpHound Data Collection and Permissions](/hc/en-us/articles/SharpHound-Enterprise-Data-Collection-and-Permissions). - -This article can assist in troubleshooting why a local collection is not successful for all systems in scope. - -## Computer status logfile -The computer status logfile, named \`compstatus.csv\` contains information about the collection results for each system in the collection's scope. - -* SharpHound Enterprise: Generates one \`compstatus.csv\` per local collection job (Sessions and/or Local Groups) and stores it within the \`log_archive\` directory on the SharpHound Enterprise server. The default location for this is `%APPDATA%\\Roaming\\BloodHound Enterprise` - that is, App Data for the service account running the SharpHound Enterprise service. However, you may override this location within \`settings.json\`, see [SharpHound Enterprise Local Configuration](/hc/en-us/articles/SharpHound-Enterprise-Local-Configuration). - - -* SharpHound Community Edition: Will generate \`compstatus.csv\` when run with the \`DumpComputerStatus\` flag. - -## Analyzing compstatus.csv - -The first step in troubleshooting local collection issues is by identifying and understanding errors in \`compstatus.csv\`. - -BloodHound Enterprise customers can reach out to their Technical Account Manager (TAM) for support in this analysis. - -Alternatively, you may do your own troubleshooting by utilizing the below example PowerShell commands and the process described below the code block. -```json -\### Import data and get uniques without sorting them -$stats\_file = Import-Csv -Path 'FILE\_PATH\_HERE' | Group-Object ComputerName, Task, Status, IPAddress | ForEach-Object { $\_.Group\[0\] } - -\### Status Pivot Table - Exclude GetMembersInAlias as it's irrelevant for troubleshooting -$stats\_file | Where-Object {$\_.Task -NotLike 'GetMembersInAlias -*'} | Group-Object Task, Status -NoElement | Format-Table -Autosize - -\### Pivot table for failures only -$stats\_file |  Where-Object {$\_.Status -ne "Success"} | Group-Object Task,Status -NoElement | Format-Table -Autosize - -\### Which systems were unreachable on 445/TCP -$stats\_file | Where-Object {$\_.Task -eq "ComputerAvailability" -and $_.Status -eq "PortNotOpen"} - -\### IPv4 /24 subnets unreachable on 445/TCP -$stats\_file | Where-Object {$\_.Task -eq "ComputerAvailability" -and $_.Status -eq "PortNotOpen" -and $_.IPAddress -match '^(?:\[0-9\]{1,3}\\.){3}\[0-9\]{1,3}$'} | Group-Object {$_.IPAddress.Remove($_.IPAddress.LastIndexOf('.'))+'.0/24'} -NoElement | Sort-Object -property Count | Format-Table -Autosize - -\### IPv4 /16 subnets unreachable on 445/TCP -$stats\_file | Where-Object {$\_.Task -eq "ComputerAvailability" -and $_.Status -eq "PortNotOpen" -and $_.IPAddress -match '^(?:\[0-9\]{1,3}\\.){3}\[0-9\]{1,3}$'} | Group-Object {($_.IPAddress.split(".")\[0..1\] -join ".") + ".0.0/16"} -NoElement | Sort-Object -property Count | Format-Table -Autosize - -\### Which systems are missing permissions -$stats\_file | Where-Object {$\_.Status -eq "ERROR\_ACCESS\_DENIED" -or $_.Status -eq "StatusAccessDenied"} -``` -To understand and resolve the errors outputted by the commands, you must understand the process involved in SharpHound's local collection, described below. - -### Domain computer enumeration - -First, SharpHound queries a Domain Controller to list every enabled computer object in the domain. Every enumerated system will be represented by one or more lines in \`compstatus.csv\`. - -### ComputerAvailability - -Next, SharpHound performs the \`ComputerAvailability\` check, which filters out inactive computers, so that SharpHound only connects to active computers to collect Local Groups and Sessions later on in the process. - -Each active computer object is checked to see whether it is a Windows OS. Local collection is not supported for any OS besides Windows. - -If the system is not a Windows OS, SharpHound will not perform additional checks on the system.  - -* If a system fails this check, \`compstatus.csv\` will contain a line for the system with the result \`Task = ComputerAvailability\` and \`Status = NonWindowsOS\`. - - -* If a Windows system is incorrectly marked with \`NonWindowsOS\`; ensure that the system's AD computer object attribute `[operatingSystem](https://learn.microsoft.com/en-us/windows/win32/adschema/a-operatingsystem)` is set to a string representing a Windows OS. - -If the system is a Windows OS, SharpHound proceeds with the next set of checks: - -1. Check if the system has changed it's password within the duration set for \`ComputerPasswordResetWindow\` in SharpHound's \`settings.json\`. - * If a system fails this check, \`compstatus.csv\` will contain a line for the system with the result \`Task = ComputerAvailability\` and \`Status = PwdLastSetOutOfRange\`. - * If an active system is incorrectly marked with \`PwdLastSetOutOfRange\`, try one of the following: - * Ensure that the \`ComputerPasswordResetWindow\` key in SharpHound's \`settings.json\` has a value corresponding to the computer's security policy `[Domain member: Maximum machine account password age](https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age)`. By default this value is 60 days. A description of the \`ComputerPasswordResetWindow\` value is found the article [SharpHound Enterprise Local Configuration](/hc/en-us/articles/SharpHound-Enterprise-Local-Configuration). - * Ensure that the system's password is changing as expected: Confirm that the system's AD computer object attribute `[pwdLastSet](https://learn.microsoft.com/en-us/windows/win32/adschema/a-pwdlastset)` has been changed within the period defined in the computer's security policy \`Domain member: Maximum machine account password age\` -2. Check if the system has TCP port 445 (SMB) open. - * If a system fails this check, \`compstatus.csv\` will contain a line for the system with the result \`Task = ComputerAvailability\` and \`Status = PortNotOpen\`. - * If an active system is incorrectly marked with \`PortNotOpen\`, try one of the following: - * Ensure that the system running SharpHound can reach the system checked on TCP port 445. - From the SharpHound system, run: -```json - Test-NetConnection -ComputerName <HOST> -Port 445 -``` - (replace <HOST> with the system's DNS name as seen in \`compstatus.csv\`). - * Ensure that the system running SharpHound can reach the system checked on TCP port 445 **within 500ms**. - From the SharpHound system, run: -```json - Measure-Command { Test-NetConnection -ComputerName <HOST> -Port 445 } -``` - (replace <HOST> with the system's DNS name as seen in \`compstatus.csv\`). - * Ensure that the system's DNS name found in \`compstatus.csv\` can be resolved, and matches the system's DNS name in Active Directory. - From the SharpHound system, check the name can be resolved by running: -```json - Resolve-DnsName -Name <HOST> -``` - (replace <HOST> with the system's DNS name as seen in \`compstatus.csv\`). - * Ensure that a network layer above TCP (e.g., SMB) is not being blocked by a security solution, such as an IDPS. - -After these steps, if the system is not available, no further collection attempts are made. - -If a system _is_ found available, \`compstatus.csv\` will contain a line for it with the result \`Task = ComputerAvailability\` and \`Status = Success\`. - -Next, SharpHound will start the actual collection of Sessions and/or Local Groups. - -### Local Groups - -This collection gathers two types of data points: - -1. Local group memberships -2. User Rights Assignment - -**Local group memberships** - -First, SharpHound connects via RPC with \`SamConnect\`. - -* If unsuccessful, \`compstatus.csv\` will contain a line for the system with the result \`Task = SamConnect\` and a status depending on the error type. - * \`Status = -1073610725\` means SharpHound account is not in the system's local administrators group. - * \`Status = StatusRpcServerUnavailable\` means SharpHound cannot access RPC or SMB on the system. Ensure that the system running SharpHound can reach the system checked on SMB. -* If successful, SharpHound continues with the method \`GetMembersInAlias\` as detailed below. - -Next, SharpHound connects via RPC with \`GetMembersInAlias\`. - -* If unsuccessful, \`compstatus.csv\` will contain a line for the system with the result \`Task = GetMembersInAlias\` and a status depending on the error type. -* If successful \`compstatus.csv\` will contain one line per local group in system with the result \`Task = GetMembersInAlias - <LOCAL GROUP NAME>\` and "Status = Success' - -**User Rights Assignment** - -First, SharpHound connects via RPC with \`LSAOpenPolicy\`. - -* If unsuccessful, \`compstatus.csv\` will contain a line for the system with the result \`Task = LSAOpenPolicy\` and a status depending on the error type. - * \`Status = StatusRpcServerUnavailable\` means SharpHound cannot access RPC or SMB on the system. Ensure that the system running SharpHound can reach the system via SMB. -* If successful, SharpHound continues with the method \`LSAEnumerateAccountsWithUserRight\` as detailed below. - -Next, sharpHound connects via RPC with \`LSAEnumerateAccountsWithUserRight\`. - -* If unsuccessful, \`compstatus.csv\` will contain a line for the system with the result \`Task = LSAEnumerateAccountsWithUserRight\` and a status depending on the error type. - * \`Status = StatusAccessDenied\` means SharpHound account is not in the Local Administrators group. -* If successful, \`compstatus.csv\` will contain one line per local group in system with the result \`Task = LSAEnumerateAccountsWithUserRight\` and "Status = Success' - -### Sessions - -This collection gathers logon sessions via RPC with \`NetWkstaUserEnum\`. - -* If unsuccessful, \`compstatus.csv\` will contain a line for the system with the result \`Task = NetWkstaUserEnum\` and a status depending on the error type. - * \`Status = ErrorAccessDenied\` means SharpHound account is not in the Local Administrators group. - * \`Status = 53\` means SharpHound cannot access RPC or SMB on the system. Ensure that the system running SharpHound can reach the system via SMB. -* If successful \`compstatus.csv\` will contain one line per local group with the result \`Task = NetWkstaUserEnum\` and "Status = Success' - diff --git a/docs/hc/en-us/categories/API-and-Integrations.mdx b/docs/hc/en-us/categories/API-and-Integrations.mdx deleted file mode 100644 index 2796e1395b..0000000000 --- a/docs/hc/en-us/categories/API-and-Integrations.mdx +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: API and Integrations -description: "Interacting with BloodHound through it’s REST API and integrations which uses the API." -mode: wide -sidebarTitle: Overview ---- - -## [BloodHound API](/hc/en-us/sections/BloodHound-API) - - - - - - - - - - - -## [BloodHound Integrations](/hc/en-us/sections/BloodHound-Integrations) - - - - - - - - diff --git a/docs/hc/en-us/categories/Data-Analysis.mdx b/docs/hc/en-us/categories/Data-Analysis.mdx deleted file mode 100644 index a882999032..0000000000 --- a/docs/hc/en-us/categories/Data-Analysis.mdx +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Data Analysis -description: "Analyzing ingested BloodHound data, identify and remediating attack paths/risks." -mode: wide -sidebarTitle: Overview ---- - -## [The BloodHound GUI](/hc/en-us/sections/The-BloodHound-GUI) - - - - - - - - -## [Nodes](/hc/en-us/sections/Nodes) - - - - - - - - -[See all 37 articles](/hc/en-us/sections/Nodes) - - -## [Edges](/hc/en-us/sections/Edges) - - - - - - - - - -[See all 115 articles](/hc/en-us/sections/Edges) - diff --git a/docs/hc/en-us/categories/Data-Collection.mdx b/docs/hc/en-us/categories/Data-Collection.mdx deleted file mode 100644 index 5f4ce9d1eb..0000000000 --- a/docs/hc/en-us/categories/Data-Collection.mdx +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Data Collection -sidebarTitle: Overview -mode: wide -description: "How attack path data collection and ingestion works, and how to run attack path data collection." ---- - -## BloodHound Enterprise Collection - - Promoted article Promoted article - - - -## BloodHound CE Collection - - - - - - - diff --git a/docs/hc/en-us/categories/Deployment.mdx b/docs/hc/en-us/categories/Deployment.mdx deleted file mode 100644 index 50145bd68a..0000000000 --- a/docs/hc/en-us/categories/Deployment.mdx +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Deployment -mode: wide -sidebarTitle: Overview ---- - -Deploying a BloodHound instance (database and GUI) and the Enterprise collectors; SharpHound Enterprise and AzureHound Enterprise. - -## Deploying BloodHound Enterprise - - Explore the security features of BloodHound Enterprise - -## Deploying SharpHound Enterprise - - System requirements and deployment process for SharpHound Enterprise Guide for installing and upgrading SharpHound Enterprise Learn about tiered collector strategy deployment Instructions for creating a group Managed Service Account Configure SharpHound Enterprise locally How to change the service account for SharpHound Enterprise - - -[See all 8 articles](/hc/en-us/sections/Deploying-SharpHound-Enterprise) - -## Deploying AzureHound Enterprise - - System requirements and deployment process for AzureHound Enterprise Configure AzureHound Enterprise for Azure Steps to create an AzureHound configuration Guide for installing and upgrading AzureHound on various platforms How to run multiple AzureHound Enterprise collectors using Scheduled Tasks - -## Deploying BloodHound CE - - Learn how to install BloodHound Community Edition using Docker Compose - diff --git a/docs/hc/en-us/categories/General.mdx b/docs/hc/en-us/categories/General.mdx deleted file mode 100644 index ecf14734e5..0000000000 --- a/docs/hc/en-us/categories/General.mdx +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: General -description: "Welcome to BloodHound, what is it and its terminology? Find FAQ, release notes, community, support." -mode: wide -sidebarTitle: Overview ---- - -## [BloodHound and Security Boundaries](/hc/en-us/sections/BloodHound-and-Security-Boundaries) - - - - - - - -## [Community and Support](/hc/en-us/sections/Community-and-Support) - - -## [BloodHound Release Notes](/hc/en-us/sections/BloodHound-Release-Notes) - - - - - - - - - diff --git a/docs/hc/en-us/categories/resources.mdx b/docs/hc/en-us/categories/resources.mdx deleted file mode 100644 index 6262136148..0000000000 --- a/docs/hc/en-us/categories/resources.mdx +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: Resources ---- - - - - - - - - \ No newline at end of file diff --git a/docs/hc/en-us/sections/BloodHound-API.mdx b/docs/hc/en-us/sections/BloodHound-API.mdx deleted file mode 100644 index c39e0cd012..0000000000 --- a/docs/hc/en-us/sections/BloodHound-API.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -title: BloodHound API -description: "Interacting with BloodHound through REST API." -mode: wide -sidebarTitle: Overview ---- - - - - - - - - - diff --git a/docs/hc/en-us/sections/BloodHound-CE-Collection.mdx b/docs/hc/en-us/sections/BloodHound-CE-Collection.mdx deleted file mode 100644 index 2e844462de..0000000000 --- a/docs/hc/en-us/sections/BloodHound-CE-Collection.mdx +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: BloodHound CE Collection -sidebarTitle: Overview -mode: wide ---- - -Learn about attack path data collection in BloodHound Community Edition. - -FollowFollow Section - - diff --git a/docs/hc/en-us/sections/BloodHound-Enterprise-Collection.mdx b/docs/hc/en-us/sections/BloodHound-Enterprise-Collection.mdx deleted file mode 100644 index 282763bb1b..0000000000 --- a/docs/hc/en-us/sections/BloodHound-Enterprise-Collection.mdx +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: BloodHound Enterprise Collection -sidebarTitle: Overview -description: "Learn about attack path data collection in BloodHound Enterprise." ---- - - - - Promoted article Promoted article - - diff --git a/docs/hc/en-us/sections/BloodHound-Integrations.mdx b/docs/hc/en-us/sections/BloodHound-Integrations.mdx deleted file mode 100644 index 313a469cb4..0000000000 --- a/docs/hc/en-us/sections/BloodHound-Integrations.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -title: BloodHound Integrations -description: "BloodHound Integrations." -mode: wide -sidebarTitle: Overview ---- - - - - - - - - - diff --git a/docs/hc/en-us/sections/BloodHound-Release-Notes.mdx b/docs/hc/en-us/sections/BloodHound-Release-Notes.mdx deleted file mode 100644 index 3239e82e3a..0000000000 --- a/docs/hc/en-us/sections/BloodHound-Release-Notes.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -title: BloodHound Release Notes -description: Stay up to date with the latest features, enhancements, bug fixes, and known issues in each release of BloodHound. -mode: wide -sidebarTitle: Overview ---- - - - - - - - - - diff --git a/docs/hc/en-us/sections/BloodHound-and-Security-Boundaries.mdx b/docs/hc/en-us/sections/BloodHound-and-Security-Boundaries.mdx deleted file mode 100644 index 44919e7e92..0000000000 --- a/docs/hc/en-us/sections/BloodHound-and-Security-Boundaries.mdx +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: BloodHound and Security Boundaries -description: Understand how BloodHound relates to and works with secured privileged access; Active Directory Tiering and Enterprise Access Model. -mode: wide -sidebarTitle: Overview ---- - - - - - diff --git a/docs/hc/en-us/sections/Bloodhound-Enterprise-Compliance-Framework.mdx b/docs/hc/en-us/sections/Bloodhound-Enterprise-Compliance-Framework.mdx deleted file mode 100644 index c28702ef5a..0000000000 --- a/docs/hc/en-us/sections/Bloodhound-Enterprise-Compliance-Framework.mdx +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Bloodhound Enterprise Compliance Framework -mode: wide -sidebarTitle: Overview ---- - - - - - - - - - diff --git a/docs/hc/en-us/sections/Deploying-AzureHound-Enterprise.mdx b/docs/hc/en-us/sections/Deploying-AzureHound-Enterprise.mdx deleted file mode 100644 index c222c6484c..0000000000 --- a/docs/hc/en-us/sections/Deploying-AzureHound-Enterprise.mdx +++ /dev/null @@ -1,10 +0,0 @@ ---- -title: Deploying AzureHound Enterprise -sidebarTitle: Overview -mode: wide ---- - -Deploy and maintain AzureHound Enterprise for continuous automatic collection of Entra ID (formerly Azure AD) attack path data. - - Promoted article - diff --git a/docs/hc/en-us/sections/Deploying-BloodHound-CE.mdx b/docs/hc/en-us/sections/Deploying-BloodHound-CE.mdx deleted file mode 100644 index c4a5559cf8..0000000000 --- a/docs/hc/en-us/sections/Deploying-BloodHound-CE.mdx +++ /dev/null @@ -1,8 +0,0 @@ ---- -title: Deploying BloodHound CE -sidebarTitle: Overview -description: "The red team focused self-managed software for Attack Path analysis. Tested and loved by the community." ---- - - - diff --git a/docs/hc/en-us/sections/Deploying-BloodHound-Enterprise.mdx b/docs/hc/en-us/sections/Deploying-BloodHound-Enterprise.mdx deleted file mode 100644 index 9f6952688c..0000000000 --- a/docs/hc/en-us/sections/Deploying-BloodHound-Enterprise.mdx +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: Deploying BloodHound Enterprise -sidebarTitle: Overview -description: "The blue team focused fully featured SaaS for Attack Path Management. Automatically and securely deployed, hosted, and maintained by SpecterOps." ---- - - -Follow - - - diff --git a/docs/hc/en-us/sections/Deploying-SharpHound-Enterprise.mdx b/docs/hc/en-us/sections/Deploying-SharpHound-Enterprise.mdx deleted file mode 100644 index 56fa4a4308..0000000000 --- a/docs/hc/en-us/sections/Deploying-SharpHound-Enterprise.mdx +++ /dev/null @@ -1,8 +0,0 @@ ---- -title: Deploying SharpHound Enterprise -description: "Deploy and maintain SharpHound Enterprise for continuous automatic collection of Active Directory attack path data." ---- - -FollowFollow Section - - Promoted article diff --git a/docs/hc/en-us/sections/Edges.mdx b/docs/hc/en-us/sections/Edges.mdx deleted file mode 100644 index 5589c84b4a..0000000000 --- a/docs/hc/en-us/sections/Edges.mdx +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Edges -description: Edges are part of the graph construct, and are represented as links/relationships that connect one node to another node. -sidebarTitle: Overview -mode: wide ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/hc/en-us/sections/Nodes.mdx b/docs/hc/en-us/sections/Nodes.mdx deleted file mode 100644 index 459b24f550..0000000000 --- a/docs/hc/en-us/sections/Nodes.mdx +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Nodes -description: "Nodes are part of the graph construct and represent principals and other objects." -mode: wide -sidebarTitle: Overview ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/hc/en-us/sections/The-BloodHound-GUI.mdx b/docs/hc/en-us/sections/The-BloodHound-GUI.mdx deleted file mode 100644 index f80598e999..0000000000 --- a/docs/hc/en-us/sections/The-BloodHound-GUI.mdx +++ /dev/null @@ -1,14 +0,0 @@ ---- -title: The BloodHound GUI -description: "Learn about the graphical user interface of BloodHound." -mode: wide -sidebarTitle: Overview ---- - - - - - - - - diff --git a/docs/home.mdx b/docs/home.mdx index 90c9d1ebcb..f2455832cf 100644 --- a/docs/home.mdx +++ b/docs/home.mdx @@ -11,8 +11,8 @@ export function openSearch() { }
-
- (b:BloodHoundUsers) - [h:Think_In] -> (e:Graphs) + (b:BloodHoundUsers) - [h:Think_In] -> (e:Graphs)