On-premises deployments of BloodHound Enterprise give you full control over your deployment infrastructure while maintaining the same powerful identity security capabilities as the SaaS version.
Deployment architecture
On-premises deployments of BloodHound Enterprise consist of two primary parts:- BloodHound Enterprise host - Runs the BloodHound application, database, and supporting infrastructure
- Collector hosts - Run lightweight collector services (SharpHound, AzureHound, or OpenHound) to gather data from your identity infrastructure
Core components
All on-premises deployments include the following core application components:Deployment-specific components
Embedded cluster deployments include the following infrastructure and management components:Data collectors
Collectors run separately from the BloodHound Enterprise host and gather configuration data from your identity infrastructure:Data flow
Data flows through the system in the following sequence:- Collection - Collectors gather configuration data from Active Directory, Entra ID, or other identity sources
- Transmission - Data is transmitted over encrypted HTTPS/TLS to the BloodHound Enterprise API
- Processing - The BloodHound Enterprise API processes and stores data in PostgreSQL
- Analysis - Graph analysis identifies privilege relationships and Attack Paths
- Visualization - Results are displayed in the BloodHound Enterprise UI
Collectors have zero local storage of collected data. All data is transmitted directly to the BloodHound Enterprise host and stored in PostgreSQL.