Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New mintlify documentation and Information Architecture refactoring #1152

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
Original file line number Diff line number Diff line change
Expand Up @@ -3,18 +3,18 @@ title: BloodHound Configuration
---

<Frame>
<img src="/hc/article_attachments/18258001080731.png"/>
<img src="/assets/18258001080731.png"/>
</Frame>

This article explains the multiple tenant-wide configurations supported by BloodHound Enterprise. The configurations can be changed by a BloodHound Administrator in ⚙️ > Administration > BloodHound Configuration.

## Reconciliation Configuration


When enabled, BloodHound Enterprise will perform data reconciliation and retention. The configuration also allows for the changing of the default retention time. See [Data reconciliation and retention](/hc/en-us/articles/Data-reconciliation-and-retention).
When enabled, BloodHound Enterprise will perform data reconciliation and retention. The configuration also allows for the changing of the default retention time. See [Data reconciliation and retention](/collect-data/enterprise-collection/data-retention).

## Citrix RDP Support

When enabled, BloodHound Enterprise will prevent false-positive CanRDP findings for Citrix VDAs.

This configuration adds to the [CanRDP edge conditions](/hc/en-us/articles/CanRDP) that a non-administrative principal must also be a member of the computer's local "Direct Access Users" group, which Citrix created to allow non-brokered access to VDAs.
This configuration adds to the [CanRDP edge conditions](/resources/edges/can-rdp) that a non-administrative principal must also be a member of the computer's local "Direct Access Users" group, which Citrix created to allow non-brokered access to VDAs.

Large diffs are not rendered by default.

Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,19 @@ title: Explore -> Search for Objects
---

<Frame>
<img src="/hc/images/image-2-1.png"/>
<img src="/assets/image-2-1.png"/>
</Frame>

In the top left of the GUI is the search bar. Start typing the name of a node, and the GUI will automatically recommend nodes that match what youve typed so far. Click one of the suggestions, and the GUI will render that node.
In the top left of the GUI is the search bar. Start typing the name of a node, and the GUI will automatically recommend nodes that match what you've typed so far. Click one of the suggestions, and the GUI will render that node.

You can also constrain your search to particular node types by prepending your search with the appropriate node label. Supported node names can be found in the [Nodes section](/hc/en-us/sections/Nodes).
You can also constrain your search to particular node types by prepending your search with the appropriate node label. Supported node names can be found in the [Nodes section](/resources/nodes/overview).

For example, you can search for group nodes containing the word admin with this search:
For example, you can search for group nodes containing the word "admin" with this search:
```
group:admin
```
The search as seen in BloodHound:

<Frame>
<img src="/hc/images/image1-27.png"/>
<img src="/assets/image1-27.png"/>
</Frame>
Original file line number Diff line number Diff line change
Expand Up @@ -3,18 +3,18 @@ title: Mute/unmute attack path finding
---

<Frame>
<img src="/hc/article_attachments/18258001080731.png"/>
<img src="/assets/18258001080731.png"/>
</Frame>

Purpose
=======

This article outlines how to mute a principal in an attack path finding so it is hidden in the principal table of the finding. It should be used by BHE users whenever a risk has been decided to be accepted or [while waiting for a change to leave its retention period](/hc/en-us/articles/Data-reconciliation-and-retention).
This article outlines how to mute a principal in an attack path finding so it is hidden in the principal table of the finding. It should be used by BHE users whenever a risk has been decided to be accepted or [while waiting for a change to leave its retention period](/collect-data/enterprise-collection/data-retention).

Prerequisites
=============

* Logged in as a user role which is authorized to mute attack path impacted principals, see [Administering users and roles](/hc/en-us/articles/Administering-users-and-roles).
* Logged in as a user role which is authorized to mute attack path impacted principals, see [Administering users and roles](/manage-bloodhound/auth/users-and-roles).

Process
=======
Expand All @@ -25,13 +25,13 @@ Mute a principal[](#heading-1)
1. Navigate to the Attack Paths page.
2. Expand the attack path finding and click the menu to the left of the principal's name (three vertical dots), then click \`Mute\`.
<Frame>
<img src="/hc/images/image1-19.png"/>
<img src="/assets/image1-19.png"/>
</Frame>
3. In the pop-up window \`Mute Attack Path\`, set the number of days the finding's principal should be muted and click the button \`MUTE\`.
* If muting permanently: set the duration for a long duration.
* If muting while while waiting for a change to leave it's retention period: set the duration depending on the retention scenario, for example when muting a principal from \`Logons from Tier Zero Users\` the duration should be 7 days. See [Data reconciliation and retention in BloodHound Enterprise](/hc/en-us/articles/Data-reconciliation-and-retention).
* If muting while while waiting for a change to leave it's retention period: set the duration depending on the retention scenario, for example when muting a principal from \`Logons from Tier Zero Users\` the duration should be 7 days. See [Data reconciliation and retention in BloodHound Enterprise](/collect-data/enterprise-collection/data-retention).
<Frame>
<img src="/hc/images/image1-20.png"/>
<img src="/assets/image1-20.png"/>
</Frame>

Unmute a principal[](#heading-2)
Expand All @@ -40,15 +40,15 @@ Unmute a principal[](#heading-2)
1. Navigate to the Attack Paths page.
2. Expand the attack path finding and toggle the setting \`Show Muted\`.
<Frame>
<img src="/hc/images/image1-21.png"/>
<img src="/assets/image1-21.png"/>
</Frame>
3. In the menu to the left of the muted principal's name (three vertical dots), click \`Unmute\`.
<Frame>
<img src="/hc/images/image1-22.png"/>
<img src="/assets/image1-22.png"/>
</Frame>
4. In the pop-up window \`Unmute Attack Path\` click the button \`UNMUTE\`.
<Frame>
<img src="/hc/images/image1-23.png"/>
<img src="/assets/image1-23.png"/>
</Frame>

Outcome
Expand All @@ -57,5 +57,5 @@ Outcome
When a principal is muted, it is hidden from the principal table in the attack path until you toggle the setting \`Show Muted\`. The principal and it's edges will still visible in the Explore and Posture page.

<Frame>
<img src="/hc/images/image1-24.png"/>
<img src="/assets/image1-24.png"/>
</Frame>
14 changes: 14 additions & 0 deletions docs/analyze-data/bloodhound-gui/overview.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
---
title: The BloodHound GUI
description: "Learn about the graphical user interface of BloodHound."
mode: wide
sidebarTitle: Overview
---

<CardGroup cols={2}>
<Card title="Posture Page" icon="shield-halved" href="/analyze-data/bloodhound-gui/posture-page" horizontal iconType="solid"/>
<Card title="BloodHound Configuration" icon="shield" href="/analyze-data/bloodhound-gui/configuration" horizontal iconType="solid"/>
<Card title="Mute/unmute attack path finding" icon="volume-xmark" href="/analyze-data/bloodhound-gui/mute-paths" horizontal iconType="solid"/>
<Card title="Searching with Cypher" icon="magnifying-glass" href="/analyze-data/bloodhound-gui/cypher-search" horizontal iconType="solid"/>
<Card title="Explore -> Search for Objects" icon="compass" href="/analyze-data/bloodhound-gui/explore-objects" horizontal iconType="solid"/>
</CardGroup>
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Posture Page
---

<Frame>
<img src="/hc/article_attachments/18258001080731.png"/>
<img src="/assets/18258001080731.png"/>
</Frame>

## Summary
Expand All @@ -13,7 +13,7 @@ The Posture page is a simplified reporting dashboard that helps users understand
This page allows users to select an environment and a duration over which to view the overall risk to the selected environment.

<Frame>
<img src="/hc/images/image1-18.png"/>
<img src="/assets/image1-18.png"/>
</Frame>

## Attack Paths
Expand Down Expand Up @@ -44,4 +44,4 @@ The graph in the middle right of the page has multiple paginated graphs that sho

For Active Directory environments, the **Group Completeness** and **Session Completeness** graphs in the bottom right of the page provide a view of how complete of a perspective BloodHound Enterprise has within the environment to indicate how accurately the assessed risk is communicated.

The total collection completeness significantly impacts the accuracy of the graph available for analysis within BloodHound Enterprise. See [Why perform privileged collection in SharpHound](/hc/en-us/articles/Why-perform-privileged-collection-in-SharpHound) for more details.
The total collection completeness significantly impacts the accuracy of the graph available for analysis within BloodHound Enterprise. See [Why perform privileged collection in SharpHound](/collect-data/enterprise-collection/privileged-collection) for more details.
40 changes: 40 additions & 0 deletions docs/analyze-data/overview.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
---
title: Data Analysis
description: "Analyzing ingested BloodHound data, identify and remediating attack paths/risks."
mode: wide
sidebarTitle: Overview
---

## <Icon icon="desktop" iconType="solid" /> [The BloodHound GUI](/analyze-data/bloodhound-gui/overview)
<CardGroup cols={2}>
<Card title="Posture Page" icon="shield-halved" href="/analyze-data/bloodhound-gui/posture-page" horizontal iconType="solid"/>
<Card title="BloodHound Configuration" icon="shield" href="/analyze-data/bloodhound-gui/configuration" horizontal iconType="solid"/>
<Card title="Mute/unmute attack path finding" icon="volume-xmark" href="/analyze-data/bloodhound-gui/mute-paths" horizontal iconType="solid"/>
<Card title="Searching with Cypher" icon="magnifying-glass" href="/analyze-data/bloodhound-gui/cypher-search" horizontal iconType="solid"/>
<Card title="Explore -> Search for Objects" icon="compass" href="/analyze-data/bloodhound-gui/explore-objects" horizontal iconType="solid"/>
</CardGroup>

## <Icon icon="circle-nodes" iconType="solid" /> [Nodes](/resources/nodes/overview)

<CardGroup cols={2}>
<Card title="About BloodHound Nodes" icon="circle-info" href="/resources/nodes/overview" horizontal iconType="solid"/>
<Card title="ADLocalGroup" icon="users" href="/resources/nodes/ad-local-group" horizontal iconType="solid"/>
<Card title="ADLocalUser" icon="user" href="/resources/nodes/ad-local-user" horizontal iconType="solid"/>
<Card title="AIACA" icon="certificate" href="/resources/nodes/aiaca" horizontal iconType="solid"/>
<Card title="AZApp" icon="window-restore" href="/resources/nodes/az-app" horizontal iconType="solid"/>
<Card title="AZAutomationAccount" icon="robot" href="/resources/nodes/az-automation-account" horizontal iconType="solid"/>
[See all 37 articles](/resources/nodes/overview)
</CardGroup>

## <Icon icon="share-nodes" iconType="solid" /> [Edges](/resources/edges/overview)

<CardGroup cols={2}>

<Card title="About BloodHound Edges" icon="star" href="/resources/edges/overview" horizontal iconType="solid"/>
<Card title="Traversable and Non-Traversable Edge Types" icon="star" href="/resources/edges/traversable-edges" horizontal iconType="solid"/>
<Card title="ADCSESC1" icon="certificate" href="/resources/edges/adcs-esc1" horizontal iconType="solid"/>
<Card title="ADCSESC10a" icon="certificate" href="/resources/edges/adcs-esc10a" horizontal iconType="solid"/>
<Card title="ADCSESC10b" icon="certificate" href="/resources/edges/adcs-esc10b" horizontal iconType="solid"/>
<Card title="ADCSESC13" icon="certificate" href="/resources/edges/adcs-esc13" horizontal iconType="solid"/>
[See all 115 articles](/resources/edges/overview)
</CardGroup>
Binary file added docs/assets/11427976083355.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
File renamed without changes
File renamed without changes
Loading
Loading