API and Integrations

BloodHound API

BloodHound Enterprise includes a REST API that allows you to programmatically interact with your BloodHound data and automate various tasks.

BloodHound JSON Formats

Work With the BloodHound API

BloodHound Python SDK

BloodHound Integrations

SpecterOps is built on community. Our strategic integrations enable BloodHound Enterprise customers to extend identity to proactively secure and manage their Active Directory, Entra ID, and hybrid environments and respond faster to threats. The sections below describe officially supported integrations, third-party integrations, and community-developed integrations.

Supported integrations

The following integrations are officially supported by SpecterOps.

Axonius

The Axonius integration enables Axonius users to fetch and catalog users and devices from BloodHound Enterprise, providing visibility into identity relationships and potential Attack Paths.


Supported actions	Fetch BloodHound Enterprise Attack Path Details: All Tier Zero Assets All Computer Admin Users All Users with RDP Access Assets by Attack Path Only Enabled Users
Common use cases	Identify which identities hold administrative or privileged access rights within the environment. Discover users who hold administrative or privileged access rights within the environment, and any associated devices where that user has admin rights. Identify devices and assets that are within an Attack Path.
Integration instructions	Configure the Axonius adapter for BloodHound

CrowdStrike Falcon for IT

The BloodHound Enterprise CrowdStrike Falcon Foundry Application is a native, serverless integration that automatically collects Sessions, Local Groups, User Rights Assignment (LSA), and Registry Keys data from CrowdStrike Falcon agents installed on endpoint hosts.The app then ingests that data into BloodHound Enterprise (BHE). This integration enables security teams to enrich their Active Directory and Azure Attack Path analysis with real-time endpoint telemetry gathered directly from their existing CrowdStrike Falcon deployment.


Supported actions	Install directly from the CrowdStrike Marketplace with a guided setup wizard. Securely configure BHE API credentials via the Foundry Secret Store. Automate provisioning and scheduling of Falcon for IT (FFIT) queries for Sessions, Local Groups, LSA, and Registry data. Scope collection to specific Falcon Host Groups. Route collected data into Falcon Next-Gen SIEM (LogScale) in real time. Use Foundry Functions to fetch, transform, and ingest data into BHE. Track host reporting state via a Daily Status Table in Foundry Collections / KV Store. Retry and reconcile incomplete collection runs to ensure 100% host data coverage.
Common use cases	Enrich BHE attack path analysis with live endpoint session and privilege data. Ensure continuous, hands-off data collection across the entire endpoint fleet. Automatically track and reconcile which hosts reported data within a 24-hour cycle. Extend BHE coverage to hosts as soon as they come online, with no manual intervention. Reduce manual configuration effort with pre-built, auto-provisioned FFIT query workflows. Maintain data freshness in BHE without relying on manual data pipelines or external storage.
Integration instructions	Configure the CrowdStrike Falcon for IT integration

Palo Alto XSOAR

The BloodHound Enterprise integration for Cortex XSOAR lets you ingest and manage BloodHound Enterprise Attack Path findings in Cortex XSOAR as incidents.


Supported actions	Automatically convert BloodHound Enterprise Attack Path findings into Cortex XSOAR incidents. Attach remediation guidance and posture context to incidents. Run playbooks and custom commands to analyze, triage, and remediate findings.
Common use cases	Automated incident creation with titles, descriptions, remediation guidance, impact/exposure metrics, severity, and domain/environment context. Playbook linking per incident to run custom analysis commands.
Custom commands	Object ID lookup by name. Asset information by object ID. Path analysis between two nodes in the BloodHound graph.
Integration instructions	Configure the Cortex XSOAR integration

Google SecOps

The BloodHound Enterprise Google Security Operations (SecOps) is an integration that automatically syncs Bloodhound Enterprise (BHE) Attack Path findings to SecOps cases for remediation tracking. This integration enables security teams to manage and track the remediation of Active Directory and Azure Attack Paths directly within their existing SecOps workflows.


Supported actions	Automatic creation of cases from BHE findings. Playbooks created to manage BHE-generated cases. Customizable SecOps collections schedules. Group related alerts under a single case. Ability to investigate relevant asset information from BHE. Verify Attack Paths exist between any two assets.
Common use cases	Enrich security cases with identity attack path context. Prioritize alerts involving high-value identity assets. Investigate whether an alerted asset is on a critical Attack Path. Verify Attack Paths between two assets during incident response. Consolidate related identity risk findings into a single investigation. Improve coordination between SOC and Identity teams.
Integration instructions	Configure the Google SecOps integration

Splunk SIEM

The BHE Splunk SIEM App enables customers to ingest Path, Posture, and Impacted Principals data into Splunk. The app also includes pre-built dashboards and alerts for Exposure, Path Details, and Impacted Principals.


Supported actions	Ability to ingest Attack Path Finding Details. Pull information related to an asset from the API. Use BloodHound Enterprise data to examine a path between two objects.
Common use cases	Use the dashboards to track and report on Active Directory and Azure Attack Paths in your environment and exposure over time. Create alerts to detect when new Attack Paths emerge, or your exposure increases. Enrich your SIEM with BloodHound Enterprise’s Attack Path details.
Integration instructions	Integrate BloodHound Enterprise with Splunk

Splunk SOAR

The BloodHound Enterprise Splunk SOAR integration includes the ability to pull findings into a SplunkSOAR environment, as well as to enrich alerts from other platforms via data from BloodHound Enterprise.


Supported actions	Pull findings from BloodHound Enterprise Attack Paths.
Common use cases	Enrich existing alerts with BloodHound Enterprise Attack Path findings and object descriptions. Receive alerts for increases to Attack Paths, tier zero assets, and domain exposure. Enable defenders to see all Attack Path findings from BloodHound as Splunk SOAR events. Leverage BloodHound Enterprise findings to remediate and remove Attack Paths.
Integration instructions	Integrate BloodHound Enterprise with Splunk SOAR
FedRAMP	Yes

ServiceNow (SIR)

The BloodHound Enterprise ServiceNow integration provides the ability to generate tickets to track and monitor vulnerabilities within environments, as identified by BloodHound Enterprise.


Supported actions	Integration with ServiceNow’s Security Incident Response (SIR) module. Ability to generate tickets to track and monitor vulnerabilities within their environments, as identified by BloodHound Enterprise.
Common use cases	Create ticketing workflows for Attack Path resolution. Monitor identity vulnerabilities over time. Allow integration of BloodHound Enterprise findings and remediation tasks into existing ServiceNow SIR workflows.
Integration instructions	ServiceNow integration instructions
FedRAMP	Yes
Supplemental information	YouTube video

ServiceNow (VR)

The Vulnerability Response (VR) integration for BloodHound Enterprise enables organizations to seamlessly connect their BloodHound Enterprise tenant with ServiceNow’s Vulnerability Response capabilities, providing automated vulnerable item creation and management based on Attack Path findings.


Supported actions	Automatically import BloodHound Enterprise Attack Path findings. Integrate with ServiceNow’s Vulnerability Response (VR) framework. Use a guided setup wizard for streamlined configuration. Support multiple environments with configurable filtering. Synchronize data with the BloodHound API in real time. Visualize findings in ServiceNow’s Vulnerability Manager Workspace. Run scheduled and on-demand data imports.
Common use cases	Reduce attack surface by identifying critical Active Directory vulnerabilities. Prioritize remediation based on exploitability. Centralize security management within ServiceNow. Automate vulnerability tracking and reporting. Use Attack Path analysis to support remediation decisions.
Integration instructions	ServiceNow VR integration instructions

Third-party integrations

The following integrations are developed by third-party vendors and are not officially supported by SpecterOps.

Cisco Duo

Add two-factor authentication and flexible security policies to BloodHound Enterprise SAML 2.0 logins with Duo Single Sign-On. Our cloud-hosted SSO identity provider offers inline user enrollment, self-service device management, and support for a variety of authentication methods — such as passkeys and security keys, Duo Push, or Verified Duo Push — in the Universal Prompt.


Supported actions	Duo SSO prompts users for two-factor authentication and performs endpoint assessment and verification before permitting access to BloodHound Enterprise. Define policies that enforce unique controls for accessing BloodHound Enterprise.
Common use cases	Provides an additional layer of security for users accessing the BloodHound Enterprise platform.
Integration instructions	Configure single sign-on
FedRAMP	Yes

Quest On Demand Audit

Integrating with SpecterOps BloodHound Enterprise helps you reduce the risk of attacks by enabling you to easily identify, prioritize, and eliminate the most vital avenues that attackers can exploit.


Supported actions	Quest OnDemand Audit ingests BloodHound Enterprise’s defined Tier Zero assets. Quest OnDemand Audit ingests BloodHound Enterprise’s Attack Path edge data.
Common use cases	Identify all critical Tier Zero assets via BloodHound Enterprise and automatically monitor them for suspicious activity through integration with OnDemand Audit. Leverage OnDemand Audit’s detailed user activity history to inspect BloodHound Enterprise’s Attack Path edges before removing access to a path, ensuring there are no unexpected consequences to remediation. Create alert-enabled searches for historical changes to Tier Zero objects to ensure real-time monitoring of critical assets.
Integration instructions	To integrate BloodHound Enterprise with Quest OnDemand Audit, use the link below. Quest OnDemand Audit integration instructions
FedRAMP	No
Supplemental information	Built-in BloodHound Tier Zero asset searches. Monitoring audit health status.

Community integrations

The following integrations are developed by the BloodHound community and are not officially supported by SpecterOps.

wineventhound

by @RantaSec

FalconHound

by @falconforceteam

ServiceHound

by @Eli4m

Please share your integrations with us in the BloodHound Gang community Slack.

Get Started with BloodHound

Install a Data Collector

Collect Data

OpenGraph

OpenHound

Analyze Attack Path Data

Manage BloodHound

API & Integrations

On-premises BloodHound Enterprise

Resources

API and Integrations

BloodHound API

BloodHound JSON Formats

Work With the BloodHound API

BloodHound Python SDK

BloodHound Integrations

Supported integrations

Axonius

CrowdStrike Falcon for IT

Palo Alto XSOAR

Google SecOps

Splunk SIEM

Splunk SOAR

ServiceNow (SIR)

ServiceNow (VR)

Third-party integrations

Cisco Duo

Quest On Demand Audit

Community integrations

wineventhound

FalconHound

ServiceHound

​ BloodHound API

BloodHound JSON Formats

Work With the BloodHound API

BloodHound Python SDK

​ BloodHound Integrations

​Supported integrations

Axonius

CrowdStrike Falcon for IT

Palo Alto XSOAR

Google SecOps

Splunk SIEM

Splunk SOAR

ServiceNow (SIR)

ServiceNow (VR)

​Third-party integrations

Cisco Duo

Quest On Demand Audit

​Community integrations

wineventhound

FalconHound

ServiceHound

BloodHound API

BloodHound Integrations

Supported integrations

Third-party integrations

Community integrations