bloodhound

No entries match these filters. Clear filters

1. docs update Nov 2, 2026 · issue 128

   BloodHound Enterprise adds Zone nodes and MemberOfZone relationships to represent privilege zones in the attack-path graph⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Query shortest paths from any principal to a Tier Zero zone node in the BloodHound Enterprise graph using Cypher.
   copy

   $ MATCH p=shortestPath((n)-[*1..]->(z:Zone {zone: 'Tag_Tier_Zero'})) RETURN p

   • BloodHound Enterprise now adds a Zone synthetic node for each privilege-zone asset group tag during analysis, connecting members with MemberOfZone relationships for use in Cypher queries and Findings Prioritization path measurement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Zone node properties include objectid (in the format zone:<asset_group_tag_id>), displayname, zone (the graph kind, such as Tag_Tier_Zero), and asset_group_tag_id for identifying the underlying asset group tag.
   • Zone nodes and MemberOfZone relationships are generated when Findings Prioritization is enabled, and are automatically removed on the next analysis run when the feature is disabled.

   3 details in Everything

2. docs update Nov 2, 2026 · issue 128

   BloodHound adds a Table layout for Cypher search results with CSV export, column management, and per-node context menus in the Explore graph controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Run a Cypher query that returns many nodes, then export them for offline analysis or sharing with stakeholders who don't have BloodHound access.
   📍In Explore, run a Cypher query that returns multiple nodes. The Table layout opens automatically. Click Export › Selected Columns (or All Columns) to download the results as a CSV file.
   Before sharing a graph screenshot, hide node and edge labels to avoid exposing sensitive hostnames or account names in the image.
   📍In Explore, click Hide Labels in the graph controls at the bottom of the page, then take your screenshot.
   Download the full current attack-path graph for offline review or import into another tool.
   📍In Explore, open the Export menu in the graph controls and select JSON to download the current graph data as a JSON file.
   • Adds a Table layout to the Explore page that displays Cypher search results as rows and columns with Node Type, Name, Object ID, and Tier Zero columns by default, opening automatically when a Cypher query returns multiple nodes and no edges, and lets you manage columns with options to search, add/remove, sort, reorder, reset column size, reset defaults, and pin columns.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds graph export options: export nodes from the Table layout as a CSV file via All Columns or Selected Columns in the Export option, and export the current graph as a JSON file via the Export menu control, available for all search methods and layouts when graph data is present.
   • Adds controls for the Stacked and Sequential layouts in BloodHound Enterprise, including graph direction (Down, Left, Right, or Up) and horizontal/vertical node spacing sliders ranging from Compact to Spacious.
   • Adds graph canvas controls: a bottom-bar Search control to find current graph results by node name or object ID and focus the graph without triggering a new search, a Hide Labels toggle to hide node and edge labels to reduce clutter or obscure sensitive data before sharing graph images, and a Reset Graph control to reset the graph to its default layout and zoom level.

   4 details in Everything

3. docs update Nov 2, 2026 · issue 128

   BloodHound adds extension bundles — ZIP archives that install an OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. schema, Privilege Zone rules, and saved queries together via PUT /api/v2/extensions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Upload a complete extension bundle — schema, Privilege Zone rules, and saved queries — in one atomic operation so BloodHound installs or rolls back all components together.
   copy

   $ curl -X PUT https://<bloodhound-host>/api/v2/extensions \
     -H 'Authorization: Bearer <token>' \
     -H 'Content-Type: application/zip' \
     --data-binary @my-extension-v1.0.0.zip

   Define a Privilege Zone rule that assigns matching GitHub principals to Tier Zero as part of an extension bundle.
   pz_rules.json copy

   {
     "pz_rules": [
       {
         "key": "GH_tier_zero_principals",
         "name": "GitHub: Tier Zero principals",
         "description": "Identifies GitHub principals assigned to Tier Zero.",
         "enabled": true,
         "allow_disable": true,
         "seeds": [
           {
             "type": 1,
             "value": "MATCH (n:GH_User) RETURN n"
           }
         ]
       }
     ]
   }

   Ship contextual saved queries with an extension so users can explore extension data from the Platforms and Categories filters on the Explore page.
   saved_queries.json copy

   {
     "queries": [
       {
         "query_key": "GH_github_critical_repositories",
         "name": "GitHub: Critical repositories",
         "query": "MATCH (n:GH_Repository) WHERE n.critical = true RETURN n",
         "description": "Lists repositories marked as critical.",
         "category": "Critical Assets"
       }
     ]
   }

   • Install OpenGraph extension components together via PUT /api/v2/extensions with a ZIP bundle containing schema.json, pz_rules.json, and saved_queries.json — BloodHound rolls back all changes if any component fails, leaving no partial installation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Define Privilege Zone rules in pz_rules.json under a top-level pz_rules array — each rule requires a stable key, a display name, and exactly one Cypher seed with type set to the Cypher type and the query in its value field; enabled and allow_disable both default to true.
   • Package saved queries in saved_queries.json under a top-level queries array — each entry requires a stable query_key, a display name, and a Cypher query, with optional description and category fields that drive the Platforms and Categories filters on the Explore page.
   • Name the ZIP archive <extension-name>-v<version>.zip and place all components at the archive root — BloodHound rejects nested files, duplicate component names, extra files such as checksums or docs, and any component exceeding the 10 MB decompressed size limit.
   • Migrate an existing schema-only extension by packaging its components into an extension bundle and incrementing the extension version — BloodHound continues to support schema-only extensions in the meantime.
   • Install OpenGraph extension components together via PUT /api/v2/extensions with a ZIP bundle containing schema.json, pz_rules.json, and saved_queries.json — BloodHound rolls back all changes if any component fails, leaving no partial installation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Define Privilege Zone rules in pz_rules.json under a top-level pz_rules array — each rule requires a stable key, a display name, and exactly one Cypher seed with type set to the Cypher type and the query in its value field; enabled and allow_disable both default to true.
   • Package saved queries in saved_queries.json under a top-level queries array — each entry requires a stable query_key, a display name, and a Cypher query, with optional description and category fields that drive the Platforms and Categories filters on the Explore page.
   • Name the ZIP archive <extension-name>-v<version>.zip and place all components at the archive root — BloodHound rejects nested files, duplicate component names, extra files such as checksums or docs, and any component exceeding the 10 MB decompressed size limit.

   1 more in Everything

4. docs update Nov 2, 2026 · issue 128

   BloodHound adds extension bundles, CSV findings export, and graph layout controls in v9.9.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Export all high-priority findings matching your current filters for offline triage or reporting.
   📍In the BloodHound Enterprise console, open Attack Paths › Findings Table, apply your desired filters and sort order, then select Export to download a CSV of up to 200,000 findings (includes prioritization score and rank when Findings Prioritization is enabled).
   • The Findings Table adds CSV export (up to 200,000 findings matching current filters and sort order, including prioritization score and rank when Findings Prioritization is enabled) and now marks findings added in the past 24 hours with a New badge to help identify recently surfaced results during triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • The /api/v2/search endpoint now matches objectid values exactly (including uppercase and lowercase variants) while keeping fuzzy matching for name searches, and passes the requested result limit to the graph database for ETAC-filtered domain lookups; the /api/v2/audit endpoint now applies the requested date range — including its documented 365-day default — to both returned events and the count field so pagination totals match results, and returns HTTP 400 when after is later than before.
   • OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. adds extension bundles: a single file packages an extension's schema with saved queries and Privilege Zone rules so administrators can install everything together.
   • When AzureRegistry collection is enabled, SharpHound reads the Azure guest VM ID (VmId) from domain-joined Windows computers and stores it in the Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. computer's azvmid property, correlating AD objects with their Azure VM identity.
   • The Explore page graph now draws non-traversable edges as dashed lines to distinguish them from traversable edges, and adds controls to set graph direction (left, right, up, or down) and adjust horizontal and vertical spacing.

   +2 more show less

   • Findings Prioritization now factors in proximity to Tier Zero — using a synthetic Zone node to calculate the shortest traversable path — alongside exposure, impact, and starting objects.
   • The data pipeline's Optimize stage now includes additional PostgreSQL storage optimization steps to reclaim index bloat and keep graph query performance consistent over time, and all post-processed edges now use optimized processing logic, reducing time in analysis.
   • The Findings Table adds CSV export (up to 200,000 findings matching current filters and sort order, including prioritization score and rank when Findings Prioritization is enabled) and now marks findings added in the past 24 hours with a New badge to help identify recently surfaced results during triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. adds extension bundles: a single file packages an extension's schema with saved queries and Privilege Zone rules so administrators can install everything together.
   • When AzureRegistry collection is enabled, SharpHound reads the Azure guest VM ID (VmId) from domain-joined Windows computers and stores it in the Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. computer's azvmid property, correlating AD objects with their Azure VM identity.
   • The Explore page graph now draws non-traversable edges as dashed lines to distinguish them from traversable edges, and adds controls to set graph direction (left, right, up, or down) and adjust horizontal and vertical spacing.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !BloodHound Enterprise will soon ingest collector property values exactly as collectors send them instead of normalizing them server-side; AzureHound versions before v3.1.0 and OpenHound versions before v0.3.0 will create duplicate nodes or identity mismatches — upgrade to AzureHound v3.1.0 or later and OpenHound v0.3.0 or later before this change is enabled.
   • !Post-processed edges no longer display the Last Seen by BloodHound field in Entity panels.
5. docs update Nov 2, 2026 · issue 128

   BloodHound adds a PUT /api/v2/attack-paths/findings/{finding_id}/status endpoint to update attack-path finding status programmatically⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Mark an attack-path finding as in-progress from a remediation script or ticketing integration to track remediation state without touching the UI.
   copy

   $ curl --request PUT \
     --url https://your-tenant.bloodhoundenterprise.io/api/v2/attack-paths/findings/{finding_id}/status \
     --header 'Authorization: Bearer <token>' \
     --header 'Content-Type: application/json' \
     --data '{"status": "in_progress"}'

6. v9.9.0 Oct 26, 2026 · issue 122

   BloodHound v9.9.0 adds CSV export from findings, bulk Priority Zone rule ingestion, graph layout controls, and DCA-migrated post-processing for 20+ AD attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v9.9.0 https://github.com/SpecterOps/BloodHound.git
   # already have the repo? check out this version:
   $ git checkout v9.9.0

   • Adds is_null and is_not_null query parameters to API endpoints for null-aware filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds extension as a valid scope value for the list queries endpoint, enabling retrieval of extension-based saved queries.
   • Adds profiles create endpoint (BED-9573) and profiles update endpoint (BED-9574) to the jobs API.
   • Adds secret store config for jobs (BED-9852).
   • Adds experiment storage configuration option.

   +5 more show less

   • Adds CSV export from the findings table.
   • Adds a job history table to the UI.
   • Surfaces extension-based saved queries in the UI, with extension-sourced saved queries made read-only (non-modifiable).
   • Adds graph direction and spacing controls to the Explorer view, renders non-traversable Explorer edges as dashed lines for visual distinction, and displays associated node labels in the Explore entity panel.
   • Adds enriched logging for extension upsert operations.
   • Adds is_null and is_not_null query parameters to API endpoints for null-aware filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds profiles create endpoint (BED-9573) and profiles update endpoint (BED-9574) to the jobs API.
   • Adds secret store config for jobs (BED-9852).
   • Adds experiment storage configuration option.
   • Adds CSV export from the findings table.

   +3 more show less

   • Adds a job history table to the UI.
   • Surfaces extension-based saved queries in the UI, with extension-sourced saved queries made read-only (non-modifiable).
   • Adds graph direction and spacing controls to the Explorer view, renders non-traversable Explorer edges as dashed lines for visual distinction, and displays associated node labels in the Explore entity panel.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The legacy ingest parser, its types, and its schemas have been removed and replaced with CHOW-based streaming validation — any integrations relying on the legacy ingest format will break.
   • !The zone node feature flag has been removed; zone node behavior is now controlled by Enterprise entitlement only.
   • !The use_raw_object_id flag now requires OpenHound (OH) version >v0.3.0.
7. docs update Oct 9, 2026 · issue 099
   • New integration Agent-Hound integration for AI agent Indirect Prompt Injection path mapping
8. v2 Oct 8, 2026 · issue 097

   API surface changed: +8 endpoints, 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +8 endpoints, 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + GET /api/v2/gpos/{object_id}/sites
   • + GET /api/v2/sites/{object_id}
   • + GET /api/v2/sites/{object_id}/controllers
   • + GET /api/v2/sites/{object_id}/linked-gpos
   • + GET /api/v2/sites/{object_id}/siteservers
   • + GET /api/v2/sites/{object_id}/sitesubnets
   • + GET /api/v2/siteservers/{object_id}
   • + GET /api/v2/sitesubnets/{object_id}
   • ~ GET /api/v2/saved-queries: param category (query) added; param extension_id (query) added
   • ~ POST /api/v2/clients: request body changed
   • ~ PUT /api/v2/clients/{client_id}: request body changed
   • ~ PUT /api/v2/extensions: request body changed; response schema changed
   • New endpoint GET /api/v2/gpos/{object_id}/sites⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /api/v2/sites/{object_id}
   • New endpoint GET /api/v2/sites/{object_id}/controllers
   • New endpoint GET /api/v2/sites/{object_id}/linked-gpos
   • New endpoint GET /api/v2/sites/{object_id}/siteservers

   +3 more show less

   • New endpoint GET /api/v2/sites/{object_id}/sitesubnets
   • New endpoint GET /api/v2/siteservers/{object_id}
   • New endpoint GET /api/v2/sitesubnets/{object_id}

   8 details in Everything

9. docs update Oct 8, 2026 · issue 097

   BloodHound v9.8.0 adds AD Sites ingestion with 8 new API endpoints, GA Findings Table, Early Access Findings Prioritization, and archived_at API field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Query all controllers of a specific AD Site to map Tier Zero exposure through site-linked GPO relationships.
   copy

   $ curl -s -H 'Authorization: Bearer <token>' 'https://<bloodhound-host>/api/v2/sites/<object_id>/controllers'

   Enable Findings Prioritization to surface a risk-ranked view instead of severity in the Findings Table.
   📍In BloodHound Enterprise, go to Administration › Early Access Features and enable Findings Prioritization. The Risk column will replace Severity in the Findings Table.
   • Adds archived_at response field to the List attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. findings API, returning a timestamp when a finding has been archived and omitting the field when it has not.
   • Ingests and analyzes Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Sites, SiteServer, and SiteSubnet objects — including containment, ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource., site-linked GPOs, and ServerIs relationships — requiring SharpHound v2.17.0.
   • Adds Tier Zero Computer Identified by Non-Tier Zero Site Server finding when a non-Tier Zero Site Server references a Tier Zero computer.
   • Adds two default Tier Zero zone rules in Zone Builder: Sites (classifies AD Site objects as Tier Zero) and Domain Controller Site Servers (classifies Site Server objects referencing Domain Controllers as Tier Zero).
   • Promotes the Findings Table feature to General Availability, adding cross-platform badges, distinct muted styling and status icons for accepted/remediated/deprecated/orphaned findings, and a floating action bar.

   +7 more show less

   • Adds Early Access Findings Prioritization feature, replacing the Severity column with a Risk column that ranks findings by priority; enable via Administration > Early Access Features.
   • SharpHound v2.17.0 now collects the Builtin object modeled as a Container and exposes each node's objectClass as a node property.
   • Adds optional Custom Client Identifier configuration for IWA authentication to control how BloodHound Enterprise resolves SharpHound Enterprise collector clients from Integrated Windows Authentication bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else..
   • Explore search and pathfinding results now include a node's distinguished name when multiple nodes share the same display name.
   • Entity Panel now preserves and displays empty arrays as NONE and empty strings/null values as — instead of hiding properties.
   • BloodHound now extracts string literal values from Cypher queries into bound parameters for parameterized PostgreSQL query formatting.
   • Restricts the Database Management page to administrators, preventing read-only users from discovering destructive data-wipe controls.
   • Ingests and analyzes Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Sites, SiteServer, and SiteSubnet objects — including containment, ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource., site-linked GPOs, and ServerIs relationships — requiring SharpHound v2.17.0.
   • Adds Tier Zero Computer Identified by Non-Tier Zero Site Server finding when a non-Tier Zero Site Server references a Tier Zero computer.
   • Adds two default Tier Zero zone rules in Zone Builder: Sites (classifies AD Site objects as Tier Zero) and Domain Controller Site Servers (classifies Site Server objects referencing Domain Controllers as Tier Zero).
   • Adds Early Access Findings Prioritization feature, replacing the Severity column with a Risk column that ranks findings by priority; enable via Administration > Early Access Features.
   • Adds optional Custom Client Identifier configuration for IWA authentication to control how BloodHound Enterprise resolves SharpHound Enterprise collector clients from Integrated Windows Authentication bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else..

   7 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Starting with the November 2026 release, BloodHound Enterprise will reject client and file ingest uploads from AzureHound versions older than v3.1.0 and OpenHound versions older than v0.3.0.
10. docs update Oct 8, 2026 · issue 097
    • Updated detection SharpHound data permissions — expanded object and ACL coverage
11. docs update Oct 8, 2026 · issue 097

    BloodHound v9.8.0 makes Findings Prioritization GA, adds IWA custom client identifiers, exposes archived_at in the API, and improves triage, accessibility, and collector administration.

    • Makes Findings Prioritization generally available, enabling risk-based guidance to prioritize Attack Path findings for triage and remediation.
    • Adds support for configuring optional custom client identifiers to control how BloodHound Enterprise resolves SharpHound Enterprise collector clients for Integrated Windows Authentication (IWA).
    • Exposes archived_at field for archived Attack Path findings in the API.
    • Adds triage improvements to Attack Path findings: cross-platform indicators, clearer status, and copy actions for selected asset information.
    • Limits destructive Database Management controls to administrators via access control.

    +5 more show less

    • Always shows Entity Panel properties even when values contain empty arrays, empty strings, or null values.
    • Improves Explore search results to distinguish duplicate names and keep node-kind tooltip labels visible.
    • Speeds up SharpHound Enterprise support bundle creation by skipping recompression of existing log archives.
    • Improves collector scheduling dialogs with clearer fields, responsive layouts, and more useful time zone and option labels.
    • Improves accessibility with reflow, navigation, headings, keyboard table navigation, and high-zoom behavior.

    10 details in Everything

    • New supported platform Active Directory Sites objects
    • New supported platform Active Directory Builtin container and objectClass collection
12. v9.8.0 Oct 7, 2026 · issue 097

    BloodHound v9.8.0 adds ZIP bundle ingestion, AD site visualization, custom deny ACE counts, alerts retry, and richer saved queries with extension and category fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.8.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.8.0

    • Adds extension_id and category fields to saved queries API responses, and supports extension and category assignment on query upsert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds is_cross_platform type field to the Findings Table for cross-platform finding classification.
    • Supports ZIP bundle ingestion for the extension upload API.
    • Adds a Custom Claim Key Parameter for client authentication configuration.
    • Adds collection plan API client methods and collection plan schedule client methods.

    +11 more show less

    • Adds collector job type client support and collector job secret client APIs.
    • Adds alerts retry capability via the retry endpoint.
    • Adds visualisation of Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. site data in the graph explorer.
    • Adds a custom deny aces count property on AD objects.
    • Adds Extension and Category fields to Saved Queries, enabling queries to be organized and filtered by extension and category.
    • Restricts database management page to admin-only access.
    • Distinguishes duplicate node names with distinguished name in the graph UI.
    • Updates empty value displays for the entity panel.
    • Navigation sidebar now auto-expands and auto-contracts when resizing at the responsive breakpoint.
    • Adds icons for the findings table in the shared UI component library.
    • Adds dataAnalytics prop on MultiSelect triggers to support Pendo tracking.
    • Adds extension_id and category fields to saved queries API responses, and supports extension and category assignment on query upsert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds is_cross_platform type field to the Findings Table for cross-platform finding classification.
    • Adds a Custom Claim Key Parameter for client authentication configuration.
    • Adds collection plan API client methods and collection plan schedule client methods.
    • Adds collector job type client support and collector job secret client APIs.

    +4 more show less

    • Adds alerts retry capability via the retry endpoint.
    • Adds visualisation of Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. site data in the graph explorer.
    • Adds a custom deny aces count property on AD objects.
    • Restricts database management page to admin-only access.

    7 more in Everything

13. docs update Sep 18, 2026 · issue 078

    BloodHound v9.2.0 adds Eligible Roles panel, expands Cypher with UNWIND/ORDER BY/WITH, and tightens OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. kind validation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Inspect the first and last nodes of a traversal path to confirm source and destination principals in a multi-hop attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
    copy

    $ MATCH p=(u:User)-[*1..4]->(c:Computer) RETURN head(nodes(p)) AS source, tail(nodes(p)) AS rest LIMIT 10

    • Adds relationships(), startNode(), endNode(), and nodes() Cypher functions to inspect paths, filter by relationship data and endpoint node properties, and access the ordered list of nodes in traversal order.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds UNWIND support to Cypher, expanding a list expression into individual rows for filtering, aggregation, or sorting each value separately.
    • Adds head() and tail() Cypher functions to access the first element or all-but-first elements of a list, including node and relationship lists derived from paths.
    • Adds ORDER BY clause support to Cypher, enabling ascending (default) or descending (DESC) sorting of query results with RETURN or WITH.
    • Adds WITH clause support for multi-part Cypher queries, allowing aggregation, filtering, and aliasing of intermediate results between query parts, with improved reliability on PostgreSQL backends.

    +5 more show less

    • Adds LIMIT clause performance improvement on PostgreSQL backends, returning results near-instantaneously for variable-length path queries that previously hit memory limits.
    • Adds an Eligible Roles accordion to the Entity Panel, showing AZRoleEligible and AZRoleApprover relationships for supported Azure principals without requiring attack path inspection.
    • Adds automatic node selection in the graph and immediate Entity Panel context when clicking a Search result, eliminating the manual click step.
    • Enforces rejection of uploads that use the reserved tag_ prefix (case-insensitive) in custom node and edge kinds for both extension definition schemas and data payloads.
    • Updates the OpenGraph node JSON schema to demonstrate environmentid and collected properties, providing clearer guidance for extension developers building ingest-aligned payloads.
    • Adds relationships(), startNode(), endNode(), and nodes() Cypher functions to inspect paths, filter by relationship data and endpoint node properties, and access the ordered list of nodes in traversal order.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds UNWIND support to Cypher, expanding a list expression into individual rows for filtering, aggregation, or sorting each value separately.
    • Adds head() and tail() Cypher functions to access the first element or all-but-first elements of a list, including node and relationship lists derived from paths.
    • Adds ORDER BY clause support to Cypher, enabling ascending (default) or descending (DESC) sorting of query results with RETURN or WITH.
    • Adds WITH clause support for multi-part Cypher queries, allowing aggregation, filtering, and aliasing of intermediate results between query parts, with improved reliability on PostgreSQL backends.

    +1 more show less

    • Adds an Eligible Roles accordion to the Entity Panel, showing AZRoleEligible and AZRoleApprover relationships for supported Azure principals without requiring attack path inspection.

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !OpenGraph uploads using the reserved tag_ prefix (case-insensitive) in custom node or edge kinds — in either extension definition schemas or data payloads — are now rejected; affected kinds must be renamed before uploading.
14. docs update Sep 18, 2026 · issue 078

    BloodHound v9.3.0 adds Jamf API client auth, GitHub Enterprise SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., expanded audit logging, and full-path graph highlighting⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • The List OpenGraph Extensions Information endpoint now includes each extension's namespace key in its response body, exposing the namespace prefix used for extension-defined node types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds support for Jamf Pro API client authentication in the OpenHound Jamf collector, enabling least-privilege, non-user-account credentials that can be scoped, rotated, and revoked independently.
    • Adds support for GitHub Enterprise environments that enforce enterprise-level SSO, allowing OpenHound to access repositories through a configured GitHub App where SSO previously blocked access.
    • Audit logs now capture running Cypher queries, editing collector clients or schedules, and running on-demand collections as additional high-risk user actions.
    • BloodHound Enterprise now ships with pre-installed OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. extensions for GitHub, Jamf, and Okta, removing the need for a separate installation step.

    +7 more show less

    • Users with the Auditor role can now view the Manage Users and Manage Clients tables in read-only mode without needing permissions to create or modify those resources.
    • Read access for the User, Power User, and Read-only roles is reduced to limit exposure to sensitive user data and administrative API endpoints; these roles can use the List Users Minimal endpoint but not the broader List Users endpoint.
    • Full-path highlighting in the graph dims paths that do not traverse a selected node, covering both inbound and outbound object control to isolate how a node participates in Attack Paths; enabled by default.
    • Zone Builder now supports searching for objects across all certification statuses in a single search, eliminating the need to switch statuses and run multiple searches.
    • The Attack Paths table on the Posture page now uses Privilege Zones terminology instead of older Tier Zero naming.
    • Analysis performance is significantly improved for edges including Owns, WriteOwner, EnrollOnBehalfOf, ADCSESC1, ADCSESC3, ADCSESC4, ADCSESC6a, ADCSESC6b, ADCSESC13, SyncLAPSPassword, ReadLAPSPassword, DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers., CanRDP, AdminTo, ExecuteDcom, and CanPSRemote.
    • Data tables now provide more accessible headers, sorting, keyboard navigation, and screen reader announcements aligned with WCAG 2.1 requirements.
    • The List OpenGraph Extensions Information endpoint now includes each extension's namespace key in its response body, exposing the namespace prefix used for extension-defined node types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds support for Jamf Pro API client authentication in the OpenHound Jamf collector, enabling least-privilege, non-user-account credentials that can be scoped, rotated, and revoked independently.
    • Adds support for GitHub Enterprise environments that enforce enterprise-level SSO, allowing OpenHound to access repositories through a configured GitHub App where SSO previously blocked access.
    • Full-path highlighting in the graph dims paths that do not traverse a selected node, covering both inbound and outbound object control to isolate how a node participates in Attack Paths; enabled by default.

    8 more in Everything

15. docs update Sep 18, 2026 · issue 078

    BloodHound v9.4.0 adds OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. node/relationship lookup APIs, auditor role expansions, and Variable Analysis Mode for faster zone updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Retrieve full details for a specific OpenGraph node by its integer ID to inspect properties without navigating the UI.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' 'https://<bloodhound-host>/api/v2/nodes/42'

    Fetch relationship details by graph-assigned integer ID to trace a specific edge during an investigation.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' 'https://<bloodhound-host>/api/v2/relationships/1337'

    Enable Variable Analysis Mode in BloodHound Enterprise to see Privilege Zone changes reflected in the graph faster after zone definition updates.
    📍In BloodHound Enterprise, go to Administration › Early Access and enable Variable Analysis Mode.
    • Adds GET /api/v2/nodes/{node_id} and GET /api/v2/relationships/{relationship_id} experimental OpenGraph API endpoints to retrieve details for specific nodes and relationships by their graph-assigned integer IDs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Expands the Auditor role to include read-only access to File Ingest activity and SSO Configuration administration views.
    • Adds Variable Analysis Mode (opt-in via the Early Access page in BloodHound Enterprise) to skip post-processing after Privilege Zone changes and re-run only the analysis stages needed to update tagged objects and findings.
    • Raises memory limits for Cypher queries in BloodHound Enterprise, enabling more complex queries and larger Entity Panel result sets.
    • OpenHound now reports its deployed version to BloodHound, visible on the Manage Clients page.

    +2 more show less

    • OpenHound now uses human-readable plain-text log format by default for file and stdout output, with structured JSON available as an opt-in format.
    • Zone Builder now preserves rule state when switching between Cypher and Object ID rule types, prompts to rerun Cypher when the query changes, and warns before saving a Cypher-based rule that returns no results.
    • Adds GET /api/v2/nodes/{node_id} and GET /api/v2/relationships/{relationship_id} experimental OpenGraph API endpoints to retrieve details for specific nodes and relationships by their graph-assigned integer IDs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Variable Analysis Mode (opt-in via the Early Access page in BloodHound Enterprise) to skip post-processing after Privilege Zone changes and re-run only the analysis stages needed to update tagged objects and findings.

    5 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !BloodHound Community now uses admin@example.com instead of spam@example.com for the default_admin.email_address configuration property; existing workflows that rely on the previous address for initial login must be updated.
16. docs update Sep 18, 2026 · issue 078

    BloodHound 9.5.1 adds ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC14 attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. entity panels and data quality stats, and new API endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Retrieve a paginated list of Attack Path findings from the API to feed into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or ticketing workflow.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' 'https://<bhce-host>/api/v2/attack-paths/findings'

    Pull curated OpenGraph entity panel content for a node instead of raw properties, using the new include-info parameter.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' 'https://<bhce-host>/api/v2/nodes/<node_id>?include-info=true'

    • Adds GET /api/v2/data-quality-stats, GET /api/v2/data-quality-stats-aggregations, and GET /api/v2/available-domains endpoints to expose OpenGraph data quality statistics and environment metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds PUT /api/v2/extensions, GET /api/v2/nodes/{node_id}?include-info=true, and GET /api/v2/relationships/{relationship_id}?include-info=true endpoints so OpenGraph extension authors can define and retrieve rich, markdown-based entity panel content.
    • Exposes GET /api/v2/attack-paths/findings endpoint so API clients can retrieve a paginated list of Attack Path findings.
    • Models ADCS ESC14 Scenario A attack paths — adding WriteAltSecurityIdentities and WritePublicInformation edges — to surface explicit certificate-mapping abuse via altSecurityIdentities; requires SharpHound v2.14.0.
    • Adds OpenGraph Data Quality page (enable via Administration > Early Access Features > OpenGraph Data Quality) showing object-type breakdowns for SpecterOps-supported, community, and custom extensions.

    +3 more show less

    • Preserves case-sensitive OpenGraph objectid values while keeping Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. ingest case-insensitive, with SharpHound and AzureHound now sending AD/Entra IDs fully uppercased.
    • Separates OpenHound destination URL into destination.bloodhoundenterprise.url in config.toml (or environment variable or Helm values) while keeping token_id and token_key in secrets.toml.
    • Blocks users with the Upload-only role from accessing the Posture and Attack Paths pages.
    • Adds GET /api/v2/data-quality-stats, GET /api/v2/data-quality-stats-aggregations, and GET /api/v2/available-domains endpoints to expose OpenGraph data quality statistics and environment metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds PUT /api/v2/extensions, GET /api/v2/nodes/{node_id}?include-info=true, and GET /api/v2/relationships/{relationship_id}?include-info=true endpoints so OpenGraph extension authors can define and retrieve rich, markdown-based entity panel content.
    • Exposes GET /api/v2/attack-paths/findings endpoint so API clients can retrieve a paginated list of Attack Path findings.
    • Models ADCS ESC14 Scenario A attack paths — adding WriteAltSecurityIdentities and WritePublicInformation edges — to surface explicit certificate-mapping abuse via altSecurityIdentities; requires SharpHound v2.14.0.

    4 more in Everything

17. docs update Sep 18, 2026 · issue 078

    OpenHound gains GitHub enterprise SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management./SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. collection and broader Okta graph parity in v0.2.13⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds optional PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.-backed enterprise SSO collection for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. provider and external identity resources to the OpenHound GitHub collector, with normalized SAML and SCIM graph output for organizations, users, and groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Models GitHub environment branch policies, reviewer gates, deployments, environment-scoped secrets and variables, enterprise role capability edges, and visibility-aware organization secret access paths in the OpenHound GitHub collector.
    • Updates the OpenHound Okta collector with reworked role assignments, resource sets, hybrid authentication, and normalized SAML modeling to more closely match OktaHound behavior across graph topology, node properties, and edge generation.
    • Adds normalized SAML topology and identity evidence support to the OpenHound Okta collector, including federation providers, service providers, ACS endpoints, claim mappings, account mappings, inbound account resolution, and Org2Org SAML correlation.
    • Adds optional user factor collection and improved retry and rate-limit handling to the OpenHound Okta collector.
    • Adds optional PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.-backed enterprise SSO collection for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. provider and external identity resources to the OpenHound GitHub collector, with normalized SAML and SCIM graph output for organizations, users, and groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Models GitHub environment branch policies, reviewer gates, deployments, environment-scoped secrets and variables, enterprise role capability edges, and visibility-aware organization secret access paths in the OpenHound GitHub collector.
    • Adds normalized SAML topology and identity evidence support to the OpenHound Okta collector, including federation providers, service providers, ACS endpoints, claim mappings, account mappings, inbound account resolution, and Org2Org SAML correlation.

    2 more in Everything

18. docs update Sep 18, 2026 · issue 078

    BloodHound v9.7.0 adds Alerts webhooks, Collector Support Bundles APIs, Protection Score API, multi-destination pathfinding, and an Extension Marketplace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Retrieve Protection Scores for all Privilege Zones to identify which zones have the most objects exposed to Attack Path findings.
    copy

    $ curl -X GET https://<bloodhound-host>/api/v2/asset-scores/zone-protected-asset-score \
      -H 'Authorization: Bearer <token>'

    Point OpenHound at a GitHub Enterprise Server instance by setting separate REST and GraphQL endpoints in the collector configuration.
    ~/.dlt/config.toml copy

    rest_api_url = "https://github.example.com/api/v3"
    graphql_url  = "https://github.example.com/api/graphql"

    • Adds GET /api/v2/clients/management/available, POST /api/v2/clients/{client_id}/management, POST /api/v2/clients/management/start, POST /api/v2/clients/management/end, POST /api/v2/clients/management/artifacts, GET /api/v2/clients/management/artifacts/{artifact_id}, POST /api/v2/clients/management/artifacts/{artifact_id}/parts/{part_number}, POST /api/v2/clients/management/artifacts/{artifact_id}/complete, GET/DELETE /api/v2/clients/{client_id}/artifacts/{artifact_id}, POST /api/v2/clients/{client_id}/artifacts/{artifact_id}/download-url, and GET /api/v2/clients/{client_id}/artifacts/{artifact_id}/download endpoints to programmatically request, download, and delete SharpHound Enterprise and OpenHound diagnostic support bundles (requires SharpHound Enterprise v2.16.0 or OpenHound v0.4.0).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GET /api/v2/asset-scores/zone-protected-asset-score endpoint to programmatically retrieve the Protection Score for a specific Privilege Zone or all Privilege Zones in the current environment.
    • Adds rest_api_url and graphql_url as separate configurable values in OpenHound to collect data from GitHub Enterprise Server, with GitHub.com remaining the default for existing configurations.
    • OpenHound now reads the BloodHound Enterprise destination URL from ~/.dlt/config.toml and the browser JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. from ~/.dlt/secrets.toml for CLI authentication, separating non-sensitive destination configuration from credentials.
    • Adds Okta pagination settings to tune resource page sizes for large-environment collection resilience.

    +11 more show less

    • Adds a new Alerts feature (Early Access, reverted in v9.7.1) supporting reusable generic HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. webhooks connected to configurable rules, with the Collector Offline event type and Webhook delivery method available at initial release.
    • Adds Collector Support Bundles to the Manage Clients page, allowing operators to request, download, and delete diagnostic bundles from SharpHound Enterprise and OpenHound collector clients.
    • Adds a Marketplace page (accessible via the icon in the left navigation panel) to discover supported OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. extensions, community extensions, and integrations, with search and filtering.
    • Adds a Protection Score to the Posture page showing the percentage of objects in a selected Privilege Zone that have no Attack Path findings.
    • Adds Dynamic Entity Panel Content to OpenGraph, enabling Go templates in extension definition schemas to render selected-entity node and relationship properties, conditional content, and helper functions, with template syntax validated on schema upload.
    • Adds multi-destination pathfinding in Explore, supporting up to three destination nodes (four total: one source, three destinations) with reordering and combined graph results.
    • Adds an action bar to the Findings Table (Early Access) for opening a finding's remediation plan or pivoting to Explore, plus a new Attack Path filter, a findings count display, and the ability to open a finding from the Graph view with its status, environment, and Privilege Zone context carried into the table.
    • OpenHound adds external_group_id and external_group_name properties to GH_Team nodes in GitHub Enterprise Managed User organizations and emits a SCIM_Provisioned relationship to the matching SCIM_Group when SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. data is available.
    • OpenHound adds GH_User -[:GH_HasRole]-> GH_EnterpriseRole relationships using enterprise or organization-backed collection paths to populate accurate membership data for synthetic GH_EnterpriseRole owners and members roles.
    • Adds collector lifecycle log fields (collector name and version, OpenHound version, and job ID) to OpenHound logs to aid troubleshooting.
    • BloodHound Enterprise can now provide optional export actions in the Explore Export menu while retaining JSON as the default export format.
    • Adds GET /api/v2/clients/management/available, POST /api/v2/clients/{client_id}/management, POST /api/v2/clients/management/start, POST /api/v2/clients/management/end, POST /api/v2/clients/management/artifacts, GET /api/v2/clients/management/artifacts/{artifact_id}, POST /api/v2/clients/management/artifacts/{artifact_id}/parts/{part_number}, POST /api/v2/clients/management/artifacts/{artifact_id}/complete, GET/DELETE /api/v2/clients/{client_id}/artifacts/{artifact_id}, POST /api/v2/clients/{client_id}/artifacts/{artifact_id}/download-url, and GET /api/v2/clients/{client_id}/artifacts/{artifact_id}/download endpoints to programmatically request, download, and delete SharpHound Enterprise and OpenHound diagnostic support bundles (requires SharpHound Enterprise v2.16.0 or OpenHound v0.4.0).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GET /api/v2/asset-scores/zone-protected-asset-score endpoint to programmatically retrieve the Protection Score for a specific Privilege Zone or all Privilege Zones in the current environment.
    • Adds rest_api_url and graphql_url as separate configurable values in OpenHound to collect data from GitHub Enterprise Server, with GitHub.com remaining the default for existing configurations.
    • Adds a new Alerts feature (Early Access, reverted in v9.7.1) supporting reusable generic HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. webhooks connected to configurable rules, with the Collector Offline event type and Webhook delivery method available at initial release.
    • Adds Collector Support Bundles to the Manage Clients page, allowing operators to request, download, and delete diagnostic bundles from SharpHound Enterprise and OpenHound collector clients.

    +4 more show less

    • Adds a Marketplace page (accessible via the icon in the left navigation panel) to discover supported OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. extensions, community extensions, and integrations, with search and filtering.
    • Adds a Protection Score to the Posture page showing the percentage of objects in a selected Privilege Zone that have no Attack Path findings.
    • Adds Dynamic Entity Panel Content to OpenGraph, enabling Go templates in extension definition schemas to render selected-entity node and relationship properties, conditional content, and helper functions, with template syntax validated on schema upload.
    • OpenHound adds external_group_id and external_group_name properties to GH_Team nodes in GitHub Enterprise Managed User organizations and emits a SCIM_Provisioned relationship to the matching SCIM_Group when SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. data is available.

    7 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Starting with the November 2026 release, BloodHound Enterprise will reject client and file ingest uploads from AzureHound versions earlier than v3.1.0 and OpenHound versions earlier than v0.3.0.
19. docs update Sep 18, 2026 · issue 078

    BloodHound v9.7.1 adds GitHub workflow runner, credential, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. attack-path modeling plus Okta SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. issuer and telemetry improvements⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds GH_RunsOn to associate GitHub workflow jobs with eligible self-hosted runners using statically defined group and label selectors; dynamic selectors are identified but not resolved.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds effective_github_token_permissions calculation using repository defaults and workflow- and job-level overrides, represented in scope:access form for query use.
    • Adds traversable GH_CanInterceptJob relationships for persistent self-hosted runners capable of intercepting workflow jobs, with new saved searches highlighting interceptable jobs.
    • Adds GH_CanAccessSecret relationships identifying repository, organization, and environment secrets available to a job's execution context.
    • Adds traversable GH_CanRequestOIDCTokenFor relationships when a job deploys to an environment with effective id-token:write permission.

    +8 more show less

    • Adds GH_DeployKey nodes with repository containment/access edges and GH_AddedDeployKey attribution, capturing key status, public key material, read-only/read-write access, and last-use metadata.
    • Detects GitHub.com versus GitHub Enterprise Server at startup and records github_deployment_type and ghes_version on collected organization and enterprise nodes.
    • Persists numeric organization, repository, and repository-owner database IDs to correlate immutable GitHub OIDC subjects, resolving issues with GH_CanAssumeIdentity edges.
    • Repository nodes now report branch_count and environment_count; GraphQL counts are used to skip environment REST requests for repositories with no environments.
    • Normalizes app installation, fine-grained PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., PAT request, and workflow permission properties to arrays of scope:access values instead of JSON strings; PAT requests now include requested organization and repository permissions.
    • Trusted inbound SAML_Issuer nodes are now identified by byte-exact SAML entity ID and collecting Okta tenant rather than by individual Okta Identity Provider, converging multiple IdPs that trust the same entity onto one node.
    • Graph output now distinguishes native Okta nodes (receiving the Okta kind) from normalized SAML_* nodes (receiving the SAML kind) using per-node source kinds; requires openhound>=0.4.0.
    • Adds disabled-by-default Okta collection performance telemetry configurable under [sources.source.okta.telemetry] in config.toml, recording endpoint latency, HTTP outcomes, retries, quota observations, concurrency, paging, and row counts as bounded JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. diagnostics.
    • Adds GH_RunsOn to associate GitHub workflow jobs with eligible self-hosted runners using statically defined group and label selectors; dynamic selectors are identified but not resolved.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds effective_github_token_permissions calculation using repository defaults and workflow- and job-level overrides, represented in scope:access form for query use.
    • Adds traversable GH_CanInterceptJob relationships for persistent self-hosted runners capable of intercepting workflow jobs, with new saved searches highlighting interceptable jobs.
    • Adds GH_CanAccessSecret relationships identifying repository, organization, and environment secrets available to a job's execution context.
    • Adds traversable GH_CanRequestOIDCTokenFor relationships when a job deploys to an environment with effective id-token:write permission.

    +3 more show less

    • Adds GH_DeployKey nodes with repository containment/access edges and GH_AddedDeployKey attribution, capturing key status, public key material, read-only/read-write access, and last-use metadata.
    • Detects GitHub.com versus GitHub Enterprise Server at startup and records github_deployment_type and ghes_version on collected organization and enterprise nodes.
    • Adds disabled-by-default Okta collection performance telemetry configurable under [sources.source.okta.telemetry] in config.toml, recording endpoint latency, HTTP outcomes, retries, quota observations, concurrency, paging, and row counts as bounded JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. diagnostics.

    5 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Okta SAML_Issuer node IDs changed from per-IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. keys to byte-exact entity ID plus tenant; existing IdP-keyed issuer nodes and trust edges will age out per BloodHound retention policy — purge the graph before testing if an immediately clean result is required.
    • !The previous graph-wide source-kind assignment for Okta was removed in favor of per-node source kinds; openhound>=0.4.0 is now a runtime dependency.
    • !Per-IdP ownership properties were removed from shared SAML_Issuer nodes.
    • !Starting with the November 2026 release, BloodHound Enterprise will reject ingest uploads from AzureHound versions older than v3.1.0 and OpenHound versions older than v0.3.0.
20. docs update Sep 18, 2026 · issue 078

    BloodHound Enterprise adds a Microsoft Sentinel integration to surface Attack Path findings as Sentinel incidents and workbooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢
    • Adds a Microsoft Sentinel integration that fetches Attack Path findings from BloodHound Enterprise and creates a corresponding Sentinel incident for each finding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Ingests and visualizes posture statistics, audit logs, and Tier Zero assets in Microsoft Sentinel dashboards via Sentinel Workbooks.
    • Automatically converts custom logs into Sentinel Incidents based on BloodHound Enterprise findings data.

    3 details in Everything

21. docs update Sep 18, 2026 · issue 078

    bloodhound: Adds workflow and runner visibility: model eligible self-hosted runners, effective workflow permissions, job interception paths, secret access, and environment OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. capabilities for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds optional, disabled-by-default collection performance telemetry for Okta to diagnose and tune collection runs while preserving tenant isolation and trust provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build..
    • Adds collection of repository deploy-key metadata alongside normalized credential permissions for GitHub.
    • Improves GitHub identity correlation by persisting immutable database IDs and improving source filtering.
    • Improves Okta SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. identity correlation by sharing trusted SAML issuers across identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. while preserving tenant isolation and trust provenance.
    • Adds optional, disabled-by-default collection performance telemetry for Okta to diagnose and tune collection runs while preserving tenant isolation and trust provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build..

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Starting with the November 2026 release, BloodHound Enterprise will reject client and file ingest uploads from deprecated AzureHound versions older than v3.1.0 and OpenHound versions older than v0.3.0.
22. docs update Sep 18, 2026 · issue 078

    BloodHound v9.6.0 adds a beta Findings Table on Attack Paths, new kind metadata APIs, GitHub self-hosted runner modeling, and OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. improvements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable the Findings Table beta to triage attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. findings across environments and Privilege Zones with severity and status filters.
    📍In BloodHound, go to Administration › Early Access Features and enable Findings Table, then open Attack Paths › Findings Table to filter by severity, platform, environment, zone, and status.
    • Exposes experimental GET endpoints for node kind and relationship kind metadata, returning kind names, descriptions, extension metadata, display properties, and markdown-backed Entity Panel information for OpenGraph automation and integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a beta Findings Table view on the Attack Paths page — enable it via Administration > Early Access Features — supporting multi-select filters for severity, platform, environment, zone, and status across Privilege Zones.
    • Adds collection and graph modeling for enterprise- and organization-scoped GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. self-hosted runners and runner groups, with new relationships for membership, delegation, inheritance, organization visibility, and repository access.
    • Enables the OpenGraph Management page by default, removing the requirement to opt in via the Early Access Features page before managing OpenGraph extensions.
    • Adds Markdown validation on extension definition schema uploads, rejecting content with unsafe HTML or links before it can appear in the Entity Panel.

    +3 more show less

    • Runs PostgreSQL graph storage optimization automatically after key ingest and analysis workflows, recording timing details in logs to keep large PostgreSQL-backed environments responsive.
    • Uses optimized deletion paths in Database Management for full graph wipes and targeted deletions by source kind or relationship type, reducing deletion time for large datasets.
    • Updates collector compatibility so BloodHound ingests object IDs, names, and other properties exactly as collector output supplies them, with AzureHound v3.1.0 and OpenHound v0.3.0 now uppercasing object IDs before output and GitHub object IDs remaining case-sensitive.
    • Exposes experimental GET endpoints for node kind and relationship kind metadata, returning kind names, descriptions, extension metadata, display properties, and markdown-backed Entity Panel information for OpenGraph automation and integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a beta Findings Table view on the Attack Paths page — enable it via Administration > Early Access Features — supporting multi-select filters for severity, platform, environment, zone, and status across Privilege Zones.
    • Adds collection and graph modeling for enterprise- and organization-scoped GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. self-hosted runners and runner groups, with new relationships for membership, delegation, inheritance, organization visibility, and repository access.

    5 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !BloodHound Enterprise will reject client and file ingest uploads from AzureHound versions older than v3.1.0 and OpenHound versions older than v0.3.0 starting with the November 2026 release, once server-side normalization is removed from ingest.
    • !After the case-sensitive ingest change is enabled, submitting the same object ID with different casing creates a separate node rather than merging with the existing one.
23. 2026-09-17 Sep 17, 2026 · release notes

    OpenHound adds GitHub runner visibility and optional Okta telemetry

    • Adds workflow, runner, and oidc collection capabilities to the OpenHound GitHub Collector to model effective permissions and job interception paths
    • Enables deploy-key metadata collection in the OpenHound GitHub Collector for repository identity correlation
    • Adds optional performance telemetry configuration key in the OpenHound Okta Collector to diagnose collection bounds while preserving tenant isolation

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Alerts early access feature released in v9.7.0 is reverted; existing setups relying on it must disable or remove alerts configuration
24. v2 Sep 13, 2026 · issue 073

    API surface changed: +30 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: +30 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + DELETE /api/v2/alert-webhooks/{alert_webhook_id}
    • + DELETE /api/v2/alerts/{alert_id}
    • + DELETE /api/v2/clients/{client_id}/artifacts/{artifact_id}
    • + GET /api/v2/alert-attempts
    • + GET /api/v2/alert-event-types
    • + GET /api/v2/alert-events
    • + GET /api/v2/alert-events/{alert_event_id}
    • + GET /api/v2/alert-webhooks
    • + GET /api/v2/alert-webhooks/{alert_webhook_id}
    • + GET /api/v2/alerts
    • + GET /api/v2/alerts/{alert_id}
    • + GET /api/v2/asset-scores/zone-protected-asset-score
    • + GET /api/v2/clients/management/artifacts/{artifact_id}
    • + GET /api/v2/clients/management/available
    • + GET /api/v2/clients/{client_id}/artifacts/{artifact_id}
    • + GET /api/v2/clients/{client_id}/artifacts/{artifact_id}/download
    • + PATCH /api/v2/alert-webhooks/{alert_webhook_id}
    • + PATCH /api/v2/alerts/{alert_id}
    • + POST /api/v2/alert-attempts/retry
    • + POST /api/v2/alert-webhooks
    • + POST /api/v2/alert-webhooks/{alert_webhook_id}/rotate-secret
    • + POST /api/v2/alert-webhooks/{alert_webhook_id}/test
    • + POST /api/v2/alerts
    • + POST /api/v2/clients/management/artifacts
    • + POST /api/v2/clients/management/artifacts/{artifact_id}/complete
    • + POST /api/v2/clients/management/artifacts/{artifact_id}/parts/{part_number}
    • + POST /api/v2/clients/management/end
    • + POST /api/v2/clients/management/start
    • + POST /api/v2/clients/{client_id}/artifacts/{artifact_id}/download-url
    • + POST /api/v2/clients/{client_id}/management
    • ~ GET /api/v2/asset-group-tags/{asset_group_tag_id}/selectors/{asset_group_tag_selector_id}: response schema changed
    • ~ GET /api/v2/attack-paths/findings: param is_cross_platform (query) added
    • ~ GET /api/v2/datapipe/status: response schema changed
    • ~ PATCH /api/v2/asset-group-tags/{asset_group_tag_id}/selectors/{asset_group_tag_selector_id}: response schema changed
    • ~ POST /api/v2/asset-group-tags/search: response schema changed
    • ~ POST /api/v2/asset-group-tags/{asset_group_tag_id}/selectors: response schema changed
    • New endpoint DELETE /api/v2/alert-webhooks/{alert_webhook_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • New endpoint DELETE /api/v2/alerts/{alert_id}
    • New endpoint DELETE /api/v2/clients/{client_id}/artifacts/{artifact_id}
    • New endpoint GET /api/v2/alert-attempts
    • New endpoint GET /api/v2/alert-event-types

    +26 more show less

    • New endpoint GET /api/v2/alert-events
    • New endpoint GET /api/v2/alert-events/{alert_event_id}
    • New endpoint GET /api/v2/alert-webhooks
    • New endpoint GET /api/v2/alert-webhooks/{alert_webhook_id}
    • New endpoint GET /api/v2/alerts
    • New endpoint GET /api/v2/alerts/{alert_id}
    • New endpoint GET /api/v2/asset-scores/zone-protected-asset-score
    • New endpoint GET /api/v2/clients/management/artifacts/{artifact_id}
    • New endpoint GET /api/v2/clients/management/available
    • New endpoint GET /api/v2/clients/{client_id}/artifacts/{artifact_id}
    • New endpoint GET /api/v2/clients/{client_id}/artifacts/{artifact_id}/download
    • New endpoint PATCH /api/v2/alert-webhooks/{alert_webhook_id}
    • New endpoint PATCH /api/v2/alerts/{alert_id}
    • New endpoint POST /api/v2/alert-attempts/retry
    • New endpoint POST /api/v2/alert-webhooks
    • New endpoint POST /api/v2/alert-webhooks/{alert_webhook_id}/rotate-secret
    • New endpoint POST /api/v2/alert-webhooks/{alert_webhook_id}/test
    • New endpoint POST /api/v2/alerts
    • New endpoint POST /api/v2/clients/management/artifacts
    • New endpoint POST /api/v2/clients/management/artifacts/{artifact_id}/complete
    • New endpoint POST /api/v2/clients/management/artifacts/{artifact_id}/parts/{part_number}
    • New endpoint POST /api/v2/clients/management/end
    • New endpoint POST /api/v2/clients/management/start
    • New endpoint POST /api/v2/clients/{client_id}/artifacts/{artifact_id}/download-url
    • New endpoint POST /api/v2/clients/{client_id}/management
    • GET /api/v2/attack-paths/findings: param is_cross_platform (query) added

    31 details in Everything

25. v2 Sep 10, 2026 · issue 070

    API surface changed: +30 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: +30 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + DELETE /api/v2/alert-webhooks/{alert_webhook_id}
    • + DELETE /api/v2/alerts/{alert_id}
    • + DELETE /api/v2/clients/{client_id}/artifacts/{artifact_id}
    • + GET /api/v2/alert-attempts
    • + GET /api/v2/alert-event-types
    • + GET /api/v2/alert-events
    • + GET /api/v2/alert-events/{alert_event_id}
    • + GET /api/v2/alert-webhooks
    • + GET /api/v2/alert-webhooks/{alert_webhook_id}
    • + GET /api/v2/alerts
    • + GET /api/v2/alerts/{alert_id}
    • + GET /api/v2/asset-scores/zone-protected-asset-score
    • + GET /api/v2/clients/management/artifacts/{artifact_id}
    • + GET /api/v2/clients/management/available
    • + GET /api/v2/clients/{client_id}/artifacts/{artifact_id}
    • + GET /api/v2/clients/{client_id}/artifacts/{artifact_id}/download
    • + PATCH /api/v2/alert-webhooks/{alert_webhook_id}
    • + PATCH /api/v2/alerts/{alert_id}
    • + POST /api/v2/alert-attempts/retry
    • + POST /api/v2/alert-webhooks
    • + POST /api/v2/alert-webhooks/{alert_webhook_id}/rotate-secret
    • + POST /api/v2/alert-webhooks/{alert_webhook_id}/test
    • + POST /api/v2/alerts
    • + POST /api/v2/clients/management/artifacts
    • + POST /api/v2/clients/management/artifacts/{artifact_id}/complete
    • + POST /api/v2/clients/management/artifacts/{artifact_id}/parts/{part_number}
    • + POST /api/v2/clients/management/end
    • + POST /api/v2/clients/management/start
    • + POST /api/v2/clients/{client_id}/artifacts/{artifact_id}/download-url
    • + POST /api/v2/clients/{client_id}/management
    • ~ GET /api/v2/asset-group-tags/{asset_group_tag_id}/selectors/{asset_group_tag_selector_id}: response schema changed
    • ~ GET /api/v2/attack-paths/findings: param is_cross_platform (query) added
    • ~ GET /api/v2/datapipe/status: response schema changed
    • ~ PATCH /api/v2/asset-group-tags/{asset_group_tag_id}/selectors/{asset_group_tag_selector_id}: response schema changed
    • ~ POST /api/v2/asset-group-tags/search: response schema changed
    • ~ POST /api/v2/asset-group-tags/{asset_group_tag_id}/selectors: response schema changed
    • New endpoint DELETE /api/v2/alert-webhooks/{alert_webhook_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • New endpoint DELETE /api/v2/alerts/{alert_id}
    • New endpoint DELETE /api/v2/clients/{client_id}/artifacts/{artifact_id}
    • New endpoint GET /api/v2/alert-attempts
    • New endpoint GET /api/v2/alert-event-types

    +26 more show less

    • New endpoint GET /api/v2/alert-events
    • New endpoint GET /api/v2/alert-events/{alert_event_id}
    • New endpoint GET /api/v2/alert-webhooks
    • New endpoint GET /api/v2/alert-webhooks/{alert_webhook_id}
    • New endpoint GET /api/v2/alerts
    • New endpoint GET /api/v2/alerts/{alert_id}
    • New endpoint GET /api/v2/asset-scores/zone-protected-asset-score
    • New endpoint GET /api/v2/clients/management/artifacts/{artifact_id}
    • New endpoint GET /api/v2/clients/management/available
    • New endpoint GET /api/v2/clients/{client_id}/artifacts/{artifact_id}
    • New endpoint GET /api/v2/clients/{client_id}/artifacts/{artifact_id}/download
    • New endpoint PATCH /api/v2/alert-webhooks/{alert_webhook_id}
    • New endpoint PATCH /api/v2/alerts/{alert_id}
    • New endpoint POST /api/v2/alert-attempts/retry
    • New endpoint POST /api/v2/alert-webhooks
    • New endpoint POST /api/v2/alert-webhooks/{alert_webhook_id}/rotate-secret
    • New endpoint POST /api/v2/alert-webhooks/{alert_webhook_id}/test
    • New endpoint POST /api/v2/alerts
    • New endpoint POST /api/v2/clients/management/artifacts
    • New endpoint POST /api/v2/clients/management/artifacts/{artifact_id}/complete
    • New endpoint POST /api/v2/clients/management/artifacts/{artifact_id}/parts/{part_number}
    • New endpoint POST /api/v2/clients/management/end
    • New endpoint POST /api/v2/clients/management/start
    • New endpoint POST /api/v2/clients/{client_id}/artifacts/{artifact_id}/download-url
    • New endpoint POST /api/v2/clients/{client_id}/management
    • GET /api/v2/attack-paths/findings: param is_cross_platform (query) added

    31 details in Everything

26. docs update Sep 9, 2026 · issue 069

    BloodHound pathfinding now supports up to two additional waypoint nodes via Add Destination

    └──▷ HOW TO FIND IT
    When you need to trace a constrained attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. through a specific intermediate host or group before reaching the final target.
    📍In the BloodHound pathfinding view, set your source and target nodes, then select Add Destination to insert up to two intermediate waypoint nodes in the order you want BloodHound to traverse them.
    • Adds Add Destination control in the pathfinding UI to route attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. through up to two additional intermediate destination nodes in a user-specified traversal order.

    1 more in Everything

27. docs update Sep 9, 2026 · issue 069

    BloodHound v9.7.0 adds multi-destination pathfinding, webhook alerts, Marketplace discovery, and expanded GitHub/Okta collection.

    └──▷ USE IT
    Keep OpenHound destination URLs separate from secrets so credentials are never co-located with config in version control.
    config.toml copy

    # config.toml — destination URL (non-sensitive)
    [destination]
    url = "https://bloodhound.example.com"
    
    # secrets.toml — sensitive credentials only
    [destination]
    token = "<your-api-token>"

    Find the shortest attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. that passes through up to three high-value targets in one query, rather than running separate queries per destination.
    📍In Explore, open the Pathfinding panel, add your source node, then add up to three destination nodes using the + Destination control and click Find Paths.
    • Adds config.toml for OpenHound destination URLs and secrets.toml for sensitive credentials used in extension asset uploads.
    • Adds Collector Offline signed webhook alerts to monitor collector availability.
    • Supports separate REST and GraphQL endpoints for GitHub Enterprise Server collection via new configuration.
    • Adds multi-destination pathfinding to build routes through up to three destination nodes in a single query.
    • Adds a Marketplace to discover supported OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. extensions, community extensions, and integrations with search and filtering.

    +8 more show less

    • Adds collector support bundle workflows — request, download, and delete SharpHound Enterprise and OpenHound support bundles directly from the UI.
    • Adds Dynamic Entity Panel Content to render selected entity data in custom OpenGraph Entity Panel Markdown.
    • Adds Protection Score to evaluate the protection of assets in each Privilege Zone.
    • Adds filtering of findings by cross-platform status and Attack Path type, with result context and pivot to remediation or Explore.
    • Adds owners and members role memberships in GitHub enterprise data via GitHub Enterprise Role Memberships.
    • Models normal GitHub teams connected to matching SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. groups in Enterprise Managed User organizations via GitHub EMU External Group Modeling.
    • Collects reliable group-to-application assignments from Okta's application endpoints via Authoritative Okta Application-Group Assignments.
    • Adds collector name, version, OpenHound version, and job ID to collector lifecycle logs via OpenHound Logs.
    • Adds config.toml for OpenHound destination URLs and secrets.toml for sensitive credentials used in extension asset uploads.
    • Adds Collector Offline signed webhook alerts to monitor collector availability.
    • Supports separate REST and GraphQL endpoints for GitHub Enterprise Server collection via new configuration.
    • Adds a Marketplace to discover supported OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. extensions, community extensions, and integrations with search and filtering.
    • Adds collector support bundle workflows — request, download, and delete SharpHound Enterprise and OpenHound support bundles directly from the UI.

    +3 more show less

    • Adds Dynamic Entity Panel Content to render selected entity data in custom OpenGraph Entity Panel Markdown.
    • Adds Protection Score to evaluate the protection of assets in each Privilege Zone.
    • Models normal GitHub teams connected to matching SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. groups in Enterprise Managed User organizations via GitHub EMU External Group Modeling.

    5 more in Everything

28. v9.7.0 Sep 8, 2026 · issue 069

    BloodHound v9.7.0 adds multi-destination pathfinding, presigned artifact downloads, webhook test dialog, and snackbar alert notifications.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.7.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.7.0

    • Adds query parameter logging for /api/v2 requests to improve auditability of API calls.
    • Adds multi-destination pathfinding with drag-and-drop reordering in the Explore graph.
    • Adds an attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. selector to the findings table.
    • Implements presigned artifact downloads.
    • Adds a support bundle download URL client method.

    +12 more show less

    • Adds a webhooks run test dialog for validating webhook configurations.
    • Wires up notifications and event history tables in the UI.
    • Adds snackbar alerts for in-app notifications.
    • Adds LinesWithMagnifyingGlass icon and Floating Action Bar copy button icons to the UI icon set.
    • Tracks Cypher query error metrics.
    • Adds database support for creating Posture Zone rules via OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. extension management.
    • Adds artifact expiration cleanup safeguards.
    • Conditionally creates a default admin account in the harness.
    • Adds Entity Panel templating support.
    • Adds KindInfo Markdown template validation.
    • Updates the JS client to support the Zone Protected Asset score endpoint.
    • Adds keyboard navigation functionality to the UI.
    • Adds query parameter logging for /api/v2 requests to improve auditability of API calls.
    • Adds multi-destination pathfinding with drag-and-drop reordering in the Explore graph.
    • Implements presigned artifact downloads.
    • Adds a support bundle download URL client method.
    • Adds a webhooks run test dialog for validating webhook configurations.

    +9 more show less

    • Wires up notifications and event history tables in the UI.
    • Adds snackbar alerts for in-app notifications.
    • Tracks Cypher query error metrics.
    • Adds database support for creating Posture Zone rules via OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. extension management.
    • Adds artifact expiration cleanup safeguards.
    • Adds Entity Panel templating support.
    • Adds KindInfo Markdown template validation.
    • Updates the JS client to support the Zone Protected Asset score endpoint.
    • Adds keyboard navigation functionality to the UI.

    3 more in Everything

29. 2026-09-08 Sep 8, 2026 · release notes

    BloodHound 2026-09-08 adds multi-destination pathfinding, marketplace discovery, support bundle management and GitHub Enterprise Server support

    └──▷ HOW TO FIND IT
    Diagnose collector issues by downloading support bundles for SharpHound Enterprise or OpenHound.
    📍Go to Manage Clients › Data Collection, then use the Collector Support Bundles section to request and download diagnostics
    Configure GitHub Enterprise Server collection with distinct REST and GraphQL endpoints.
    📍In Data Collection settings, specify separate URLs for the REST and GraphQL endpoints for GitHub Enterprise Server
    • Adds up to three destination nodes support for pathfinding queries in the Explore UI
    • Adds signed Collector Offline webhook alerts to monitor collector availability in Administration Alerts
    • Adds separate REST and GraphQL endpoint configuration for GitHub Enterprise Server collection via Data Collection settings
    • Adds support for connecting normal GitHub teams to matching SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. groups in Enterprise Managed User (EMU) organizations

    4 details in Everything

30. docs update Aug 26, 2026 · issue 057

    npmHound collector maps npm maintainer compromise blast radius through the full downstream dependency graph in BloodHound

    ⤢ ⤢ ⤢ ⤢
    • Adds npmHound, a BloodHound OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. collector that maps npm maintainers, their publish rights, and downstream dependent packages to enable path-finding through a maintainer account compromise's full blast radius.
    • Emits optional bridge edges into the GitHub OpenGraph subgraph (documented as unverified) to connect npm and GitHub attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
    • Ships with six Cypher starter queries, custom node icons, and node/edge documentation for immediate use after collection.
    • Includes a schema validator to verify collected data against the OpenGraph schema.
    • Requires no account, token, or authentication — pulls entirely from the public npm registry with no third-party dependencies.

    5 details in Everything

31. v2 Aug 20, 2026 · issue 051

    API surface changed: +3 endpoints, −2 endpoints, 2 modified

    API change

    API surface changed: +3 endpoints, −2 endpoints, 2 modified

    • + GET /api/v2/attack-paths/finding-types
    • + GET /api/v2/node-kinds/{node_kind_id}
    • + GET /api/v2/relationship-kinds/{relationship_kind_id}
    • ~ GET /api/v2/attack-paths/findings: param zone_id (query) removed
    • ~ PUT /api/v2/custom-nodes/{kind_name}: response schema changed
    • − POST /api/v2/clients/management/end (breaking)
    • − POST /api/v2/clients/management/start (breaking)
    • New endpoint GET /api/v2/attack-paths/finding-types
    • New endpoint GET /api/v2/node-kinds/{node_kind_id}
    • New endpoint GET /api/v2/relationship-kinds/{relationship_kind_id}
    • PUT /api/v2/custom-nodes/{kind_name}: response schema changed

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed endpoint POST /api/v2/clients/management/end
    • !Removed endpoint POST /api/v2/clients/management/start
    • !GET /api/v2/attack-paths/findings: param zone_id (query) removed
32. docs update Aug 19, 2026 · issue 050

    BloodHound v9.6.0 adds GitHub self-hosted runner attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. modeling, Kind Metadata APIs, PostgreSQL storage optimization, and OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. improvements.

    • Adds Kind Metadata APIs to retrieve node and relationship kind details by graph-assigned kind ID, enabling OpenGraph automation and integrations.
    • Adds GitHub Self-Hosted Runner Modeling to identify membership, delegation, and access paths for enterprise and organization-scoped GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. self-hosted runners and runner groups.
    • Extension Management is now enabled by default — OpenGraph extensions can be managed without manually enabling the feature first.
    • Adds OpenGraph Markdown Validation so extension definition schemas are checked for safe rendering of custom Markdown content before upload.
    • PostgreSQL Graph Storage Optimization runs after ingest and analysis to improve reliability and performance of PostgreSQL-backed graph databases.

    +2 more show less

    • Faster graph data deletion for PostgreSQL-backed environments.
    • Adds collector compatibility guidance for case-sensitive OpenGraph Object ID ingest.

    7 details in Everything

33. v9.6.0 Aug 18, 2026 · issue 050

    BloodHound v9.6.0 adds management-operation APIs, client artifact endpoints, S3 configuration, a findings severity filter, and webhook table wiring.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.6.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.6.0

    • Adds api/v2/relationship-kinds/{relationship_kind_id} endpoint to retrieve a specific relationship kind by ID.
    • Adds a new GET node kind endpoint (BED-8756) for querying individual node kinds via the API.
    • Adds queue management operation endpoints for submitting and managing background operations via the API.
    • Adds a get-available management operation endpoint to discover which operations can be queued.
    • Adds a download client artifact endpoint (BED-8091) for retrieving collector client artifacts via the API.

    +14 more show less

    • Adds a delete client artifact endpoint (BED-8129) for removing collector client artifacts via the API.
    • Adds part_number support to the artifact upload API for multipart upload handling.
    • Adds S3 configuration support (BED-9174) to enable object-storage-backed artifact handling.
    • Exposes artifact metadata on management operation responses.
    • Adds a download client support bundle capability (API endpoint and UI) for pulling diagnostic bundles from managed clients.
    • Adds a delete client support bundle UI action for removing previously downloaded diagnostic bundles.
    • Adds a findings table severity filter, enabling practitioners to narrow the Findings Table by severity level.
    • Adds a new Finding Types endpoint for the Findings Table to retrieve available finding type classifications.
    • Enables the opengraph_extension_management feature flag by default, making OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. extension management available to all users.
    • Optimizes PostgreSQL graph database wipes for faster data-clearing operations in DB Management.
    • Optimizes PostgreSQL source_kind and relation deletion using database indices for improved performance.
    • Wires up the webhooks table in the UI, surfacing configured webhook endpoints.
    • Adds an alert event publisher (BED-7948) for emitting events when alert conditions are triggered.
    • Adds a Findings Prioritization feature flag (BED-9035) to gate prioritization workflows.

    19 details in Everything

34. 2026-08-18 Aug 18, 2026 · release notes

    BloodHound 9.6 adds Findings Table (beta), OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. kind metadata APIs, and GitHub runner modeling in OpenHound

    • Adds Findings Table (beta) to the Attack Paths page for triaging attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. findings at scale
    • Enables OpenGraph extension management by default, removing the need to manually enable the feature
    • Strengthens OpenGraph Markdown validation to safely render custom content in uploaded extension schemas
    • Adds API Kind Metadata APIs to retrieve node and relationship kind details by graph-assigned kind ID for automation
    • Optimizes PostgreSQL graph database performance with storage optimization that runs after ingest and analysis

    +1 more show less

    • Adds faster graph data deletion via the Database Management UI in PostgreSQL-backed environments

    6 details in Everything

35. v2 Aug 4, 2026 · issue 035

    API surface changed: 22 deprecated

    API change

    API surface changed: 22 deprecated

    • ⚠ DELETE /api/v2/custom-nodes/{kind_name}
    • ⚠ DELETE /api/v2/saml/providers/{saml_provider_id}
    • ⚠ GET /api/v2/asset-groups/{asset_group_id}/combo-node
    • ⚠ GET /api/v2/asset-groups/{asset_group_id}/members
    • ⚠ GET /api/v2/clients/{client_id}/completed-tasks
    • ⚠ GET /api/v2/domains/{domain_id}/attack-path-findings
    • ⚠ GET /api/v2/pathfinding
    • ⚠ GET /api/v2/saml
    • ⚠ GET /api/v2/saml/providers/{saml_provider_id}
    • ⚠ GET /api/v2/saml/sso
    • ⚠ GET /api/v2/tasks
    • ⚠ GET /api/v2/tasks/available
    • ⚠ GET /api/v2/tasks/current
    • ⚠ GET /api/v2/tasks/finished
    • ⚠ GET /api/v2/tasks/{task_id}
    • ⚠ GET /api/v2/tasks/{task_id}/log
    • ⚠ POST /api/v2/asset-groups/{asset_group_id}/selectors
    • ⚠ POST /api/v2/clients/{client_id}/tasks
    • ⚠ POST /api/v2/saml/providers
    • ⚠ POST /api/v2/tasks/end
    • ⚠ POST /api/v2/tasks/start
    • ⚠ PUT /api/v2/tasks/{task_id}/cancel
    └──▷ BREAKING ON UPGRADE

    • !Deprecated endpoint DELETE /api/v2/custom-nodes/{kind_name} (still works)
    • !Deprecated endpoint DELETE /api/v2/saml/providers/{saml_provider_id} (still works)
    • !Deprecated endpoint GET /api/v2/asset-groups/{asset_group_id}/combo-node (still works)
    • !Deprecated endpoint GET /api/v2/asset-groups/{asset_group_id}/members (still works)
    • !Deprecated endpoint GET /api/v2/clients/{client_id}/completed-tasks (still works)
    • !Deprecated endpoint GET /api/v2/domains/{domain_id}/attack-path-findings (still works)
    • !Deprecated endpoint GET /api/v2/pathfinding (still works)
    • !Deprecated endpoint GET /api/v2/saml (still works)
    • !Deprecated endpoint GET /api/v2/saml/providers/{saml_provider_id} (still works)
    • !Deprecated endpoint GET /api/v2/saml/sso (still works)
    • !Deprecated endpoint GET /api/v2/tasks (still works)
    • !Deprecated endpoint GET /api/v2/tasks/available (still works)
    • !Deprecated endpoint GET /api/v2/tasks/current (still works)
    • !Deprecated endpoint GET /api/v2/tasks/finished (still works)
    • !Deprecated endpoint GET /api/v2/tasks/{task_id} (still works)
    • !Deprecated endpoint GET /api/v2/tasks/{task_id}/log (still works)
    • !Deprecated endpoint POST /api/v2/asset-groups/{asset_group_id}/selectors (still works)
    • !Deprecated endpoint POST /api/v2/clients/{client_id}/tasks (still works)
    • !Deprecated endpoint POST /api/v2/saml/providers (still works)
    • !Deprecated endpoint POST /api/v2/tasks/end (still works)
    • !Deprecated endpoint POST /api/v2/tasks/start (still works)
    • !Deprecated endpoint PUT /api/v2/tasks/{task_id}/cancel (still works)
36. 2026-08-04 Aug 4, 2026 · release notes

    OpenHound expands GitHub SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management./SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. coverage and Okta role/resource set modeling

    • Expands OpenHound GitHub collector to support GitHub Enterprise SSO, SCIM, and environment data collection
    • Reworks OpenHound Okta collector role assignments and resource sets for better parity with OktaHound

    2 details in Everything

37. docs update Jul 30, 2026 · issue 030

    BloodHound adds a Data Quality page with object count trends, privileged collection completeness charts, and OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. ingest validation.

    • New Data Quality page (Administration > Data Quality) lets practitioners validate ingested data with aggregate object counts, source-specific breakdowns, and historical count trends after each collection run.
    • Local Group Completeness Over Time and Session Completeness Over Time charts show SharpHound privileged-collection coverage across active computers.
    • Structured OpenGraph object counts and historical trends (v9.5.1+, early access) allow validation of OpenGraph ingest by extension and source_kind without writing custom Cypher queries.

    3 details in Everything

38. docs update Jul 30, 2026 · issue 030

    BloodHound v9.5.1 adds ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC14 Scenario A attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. entity panels, and a new Attack Path Findings API.

    • Adds ADCS ESC14 Scenario A attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. coverage: identifies certificate-mapping takeover paths via write access to altSecurityIdentities or the Public-Information property set (WriteAltSecurityIdentities, WritePublicInformation).
    • Adds OpenGraph Entity Info: extension-defined context for OpenGraph nodes and relationships displayed directly in the Entity Panel as custom accordions and markdown content.
    • Adds OpenGraph Data Quality Statistics: node-count statistics for OpenGraph environments and aggregate counts across extension kinds.
    • Supports case-sensitive OpenGraph object IDs, preserving distinct objects whose objectid values differ only by case while keeping AD and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. ingest behavior case-insensitive.
    • New Attack Path Findings API provides unified, paginated retrieval of Attack Path findings.

    +4 more show less

    • Separates OpenHound collector configuration from secrets: BloodHound Enterprise destination URL is now defined as configuration while credentials remain in secrets files.
    • Adds Auditor SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Configuration Access: auditors can now review SSO provider configuration without provider management permissions.
    • Adds Upload-Only Role Access Enforcement: upload-only users are blocked from accessing analysis pages outside their role permissions.
    • Improves Privilege Zone Review with clearer table behavior, more usable layouts, and better validation feedback.

    9 details in Everything

39. docs update Jul 30, 2026 · issue 030

    BloodHound adds new attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. edges, data quality APIs, and client management operation notifications.

    • New WriteAltSecurityIdentities edge documents the attack path from principals with write access to the altSecurityIdentities attribute.
    • New WritePublicInformation edge captures abuse of write access to public information attributes as an attack path.
    • New API endpoints to notify BloodHound of client management operation start and end, enabling better orchestration of data collection sessions.
    • New API to list attack path findings programmatically, supporting integration with external workflows and reporting.
    • New data quality APIs: retrieve aggregations by environment kind and environment-specific stats to assess collection completeness.

    +1 more show less

    • New Data Quality review surface in the product to inspect collected data coverage.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Delete Custom Node API endpoint is now deprecated.
40. v9.5.1 Jul 29, 2026 · release notes

    Adds BED-9078 feature flag to write data quality checks in batches.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.5.1 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.5.1

    └──▷ USE IT
    Enable batched data quality processing to improve throughput for large datasets.
    env copy

    # Enable via environment variable
    export BED-9078=true
    # Start BloodHound service

41. 2026-07-29 Jul 29, 2026 · release notes

    BloodHound v9.5.1 adds ESC14 detection, OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. Entity Panel, and paginated API for attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. findings

    └──▷ HOW TO FIND IT
    View rich context for OpenGraph nodes directly in the Entity Panel using extension-defined accordions.
    📍In the BloodHound UI, navigate to an OpenGraph node › Entity Panel to view extension-defined accordions and markdown content.
    • Adds ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC14 Scenario A attack path identification for certificate-mapping takeover via altSecurityIdentities and Public-Information
    • Adds extension-defined Entity Panel accordions with markdown content in the OpenGraph Entity Info view for rich contextual node data
    • Adds OpenGraph Data Quality statistics and aggregate counts across extension kinds in the UI

    3 details in Everything

42. v9.5.0 Jul 28, 2026 · issue 028

    BloodHound v9.5.0 adds OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. data quality stats, webhooks UI, markdown-rich entity panels, and new management operation endpoints.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.5.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.5.0

    • Adds /data-quality-stats endpoint and aggregations endpoint for querying OpenGraph node and relationship counts by environment.
    • Adds environment_kind_id and environment_kind_display_name fields to the available-domains API response.
    • New Webhooks table and webhook details modal on the Delivery Page for managing webhook configurations.
    • Renders markdown-based KindInfo for OpenGraph extensions directly in the entity panel.
    • Adds KindInfo to the api/v2/nodes/{node_id} response and to extension upsert operations.

    +8 more show less

    • Adds ?include-info query parameter to the v2 relationships API to return KindInfo alongside relationship data.
    • Introduces start and end management operation API endpoints.
    • Adds use_raw_object_id feature flag to control raw Object ID handling and case-sensitive search behavior.
    • Restricts the UPLOAD_ONLY role from accessing certain views, tightening role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..
    • Adds read providers permission for finer-grained API access control.
    • OpenGraph Data Quality page now lists aggregations and environments and renders stats and a node-count table.
    • Rejects older AzureHound collector versions when the use_raw_object_id flag is enabled.
    • Improved focus styling across the UI for accessibility.

    13 details in Everything

43. docs update Jul 24, 2026 · issue 024

    BloodHound Enterprise gains a native Jira Cloud integration to sync Attack Path findings directly into Jira issues for remediation tracking.

    ▶ ⤢
    • New Jira Cloud app (built on Atlassian Forge) automatically synchronizes BloodHound Enterprise Attack Path findings to Jira Software and Jira Service Management issues.
    • Maps BloodHound Enterprise zones to Jira priorities and sets due dates based on finding priority.
    • Filters synchronization by BloodHound Enterprise domains and zones.
    • Embeds direct Graph View links in every Jira ticket for in-context investigation.
    • Automatically closes Jira tickets when BloodHound Enterprise findings are remediated.

    +1 more show less

    • Supports Jira Service Management request types and incidents for SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments.-based remediation tracking.

    6 details in Everything

44. docs update Jul 24, 2026 · docs issue 004

    BloodHound Enterprise gains a native Jira Cloud integration to sync Attack Path findings directly into Jira issues for remediation tracking.

    ▶ ⤢
    • New Jira Cloud app (built on Atlassian Forge) automatically synchronizes BloodHound Enterprise Attack Path findings to Jira Software and Jira Service Management issues.
    • Maps BloodHound Enterprise zones to Jira priorities and sets due dates based on finding priority.
    • Filters synchronization by BloodHound Enterprise domains and zones.
    • Embeds direct Graph View links in every Jira ticket for in-context investigation.
    • Automatically closes Jira tickets when BloodHound Enterprise findings are remediated.

    +1 more show less

    • Supports Jira Service Management request types and incidents for SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments.-based remediation tracking.

    6 details in Everything

45. docs update Jul 24, 2026 · issue 024

    BloodHound Enterprise adds native Jira integration for attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. remediation ticketing

46. docs update Jul 24, 2026 · docs issue 004

    BloodHound Enterprise adds native Jira integration for attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. remediation ticketing

47. v9.4.0 Jul 7, 2026 · issue 009

    BloodHound v9.4.0 adds ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC14 detection, new graph/relationship APIs, webhook creation, auditor role expansions, and ingest metrics.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.4.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.4.0

    • Adds ADCS ESC14 Scenario A attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. coverage for certificate-based privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. detection.
    • New GET api/v2/relationships/{relationship_id} endpoint for retrieving individual graph relationship details.
    • New GET node endpoint (api/v2/...) for retrieving individual graph node details.
    • Introduces webhook creation capability for event-driven alerting integrations.
    • Adds data_quality_stats table and supporting APIs for tracking data quality statistics.

    +12 more show less

    • Adds data_quality_aggregations table migration to support aggregated data quality reporting.
    • Expands Auditor role permissions to include SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration page access.
    • Expands Auditor role permissions to include file ingest visibility.
    • Adds explicit permissions for managing and reading ingest files.
    • New queue latency metric for ingest tasks, enabling observability into ingest pipeline delays.
    • New ingest task counter metric for tracking volume of ingest operations.
    • Alerts page scaffolding introduced as a new UI surface for future alerting workflows.
    • Disallows creation of new custom Cypher rules when the query yields no results, preventing misconfigured detections.
    • Adds a support request bundle button for easier diagnostics submission.
    • Introduces Variable Analysis Mode pipeline steps for more flexible analysis configurations.
    • Adds collector file service for downloading collector binaries directly from the platform.
    • Adds screen reader and accessibility (a11y) support across graph controls and admin pages.

    17 details in Everything

48. 2026-07-07 Jul 7, 2026 · release notes

    BloodHound 2026-07-07 adds Graph ID Lookup APIs, OpenHound resilience, and auditor read-only access

    └──▷ TRY IT
    Retrieve specific nodes by ID via the new API for targeted investigation.
    copy

    $ GET /api/v1/nodes?ids=12345,67890

    Enable variable analysis mode in the Zone Builder to speed up graph updates.
    📍In the Zone Builder UI, switch to Variable Analysis mode and save the rule to skip post-processing.
    • api graph ID lookup endpoints allow targeting automation and investigation by retrieving nodes and relationships via their integer IDs.
    • admin.auditor role gains read-only access to File Ingest activity and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Configuration details.
    • OpenHound jobs now keep alive longer, surface installed versions in BloodHound, and include clearer logs for troubleshooting failures.
    • BloodHound Enterprise Cypher queries can now handle higher memory limits.
    • Zone Builder preserves rule state across types and warns before saving Cypher-based rules returning no results.

    5 details in Everything

49. v9.3.0 Jun 17, 2026 · release notes

    BloodHound v9.3.0 adds Privilege Zone metrics, richer findings endpoints, full-path highlighting, and JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. Teleport configuration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.3.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.3.0

    • Adds Privilege Zone tag-count metrics to surface coverage data for zone management.
    • Enriches the unified findings endpoint with zone_name, source_principal_name, target_principal_name, environment name, and zone display title fields.
    • Adds audit log entries for alert webhook activity, improving traceability of alert actions.
    • Adds an alerts feature flag and dedicated alerts permissions for granular access control.
    • Includes Extension Namespace in the Extension Object and exposes namespace column in the Object Group management page table.

    +9 more show less

    • Introduces JIT Teleport configuration support.
    • Adds full-path highlight in the graph explorer, visually emphasizing entire attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
    • Adds toggle for label truncation in the graph UI, letting analysts show or hide full node labels.
    • Introduces a new Findings Table view for reviewing security findings.
    • Adds a collector_support_bundle feature flag for collector diagnostics.
    • Creates a new read auth permission and implements it for manage pages, enabling finer-grained role control.
    • Adds a new alerts OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec, documenting the alerts API surface.
    • Prepares BloodHound CE for Embedded Extensions.
    • Adds HTTP request and labeled response size metrics for API observability.

    14 details in Everything

50. v9.3.0 Jun 17, 2026 · issue 001

    BloodHound v9.3.0 adds richer findings data, full path highlighting, alerts permissions, JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. Teleport config, and graph label controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.3.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.3.0

    • Adds zone_name, source_principal_name, and target_principal_name fields to the findings endpoint for richer attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. context.
    • Adds Environment Name and Zone Display Title fields to the Unified Findings endpoint and schema findings table.
    • New Findings Table UI surface for reviewing security findings directly in the product.
    • Full Path Highlight feature in the graph explorer visually highlights entire attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
    • Toggle Label Truncation control lets users expand or collapse truncated node labels in graph views.

    +8 more show less

    • Introduces an alerts feature flag and dedicated alerts permissions role for controlling access to the alerting subsystem.
    • Adds audit log entries for alert webhook events, enabling traceability of alert delivery.
    • New collector_support_bundle feature flag to enable support bundle collection from collectors.
    • JIT Teleport Configuration support added, enabling just-in-time access integration via Teleport.
    • Includes Extension Namespace in Extension Objects and surfaces the namespace column on the Object Group management page.
    • New read_auth permission created and implemented for manage pages, enabling finer-grained RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..
    • Adds HTTP request and labeled response size metrics for improved observability.
    • Privilege Zone metrics now include tag count data.

    13 details in Everything

51. 2026-06-17 Jun 17, 2026 · release notes

    BloodHound 2026-06-17 adds OpenHound Jamf client auth, expanded audit logging, role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., and full-path highlighting in Explore

    • Adds OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. namespace visibility in the extension information API response.
    • Expands audit logging to capture Cypher execution and collector operations for high-risk user actions.
    • Limits sensitive data and administration API access via role-based access control for User, Power User, and Read-only roles.
    • Allows Auditor users to review Manage Users and Manage Clients tables without modification permissions.
    • Adds full-path highlighting in the Explore graph view to isolate how a selected node participates in longer attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..

    +3 more show less

    • Pre-installs GitHub, Jamf, and Okta OpenGraph extensions in BloodHound Enterprise.
    • Enables API client authentication for the OpenHound Jamf collector.
    • Adds GitHub Enterprise SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support for OpenHound data collection.

    8 details in Everything

52. v9.2.0 May 28, 2026 · release notes

    BloodHound v9.2.0 adds Prometheus metrics, a Findings API, graph DB metrics exposure, and explore page UX improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.2.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.2.0

    • Adds Prometheus metrics endpoint to the BloodHound CE API for operational monitoring.
    • Exposes database metrics via a new API endpoint.
    • Introduces a new Findings API endpoint for programmatic access to security findings.
    • Adds a type filter parameter to the GET /kinds endpoint for more targeted kind queries.
    • Adds an eligible roles accordion in the UI for clearer role visibility.

    +7 more show less

    • Explore page search results now return and select the matched node directly.
    • Adds default views and layout option de-selection on the explore page.
    • Reserves the tag_ prefix for node and edge kind names.
    • Upserts to the kinds table, enabling dynamic kind registration.
    • Swaps to a new database migration system.
    • Allows direct access to the pgx connection pool for advanced integrations.
    • Bumps SharpHound collector version.

    12 details in Everything

53. 2026-05-28 May 28, 2026 · release notes

    BloodHound 9.2.0 adds Eligible Roles in Entity Panel and expands Cypher query capabilities for PostgreSQL backends.

    └──▷ TRY IT
    Expand a list of privileges into individual rows for further processing in Cypher.
    copy

    $ MATCH (n) UNWIND n.Privileges AS p RETURN n.name, p

    Filter paths by specific node types and relationship directions using new Cypher clauses.
    copy

    $ MATCH p=paths() WHERE nodes(p)[0].type = 'User' AND relationships(p)[0].type = 'MemberOf' RETURN p

    Navigate list results in the Entity Panel to identify eligible roles for Azure principals.
    📍In the Explore view, select a search result to open the Entity Panel automatically. Click the Eligible Roles tab to review permissions.
    • Adds Eligible Roles display and automatic node selection from search results to the Explore workflow via the Entity Panel
    • Adds nodes(), relationships(), startNode(), and endNode clauses to Cypher queries for relationship and node filtering
    • Adds UNWIND support to expand list values into rows in Cypher expressions
    • Adds head() and tail() functions for navigating list values returned by Cypher
    • Adds sorting capabilities for Cypher query results in RETURN and WITH clauses

    +3 more show less

    • Supports chaining multiple query parts in a single Cypher multi-part query
    • Optimizes LIMIT clause evaluation on PostgreSQL backends to be near-instantaneous
    • Updates the node JSON schema structure for environmentid and collected properties

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Custom OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. kinds using the tag_ prefix will now fail validation; rename them to avoid errors.
54. 2026-05-06 May 6, 2026 · release notes

    BloodHound v9.1.0 adds incremental edge updates and custom OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. icons via node_kinds schema field.

    • Added is_display_kind field support in OpenGraph extension schemas to set default node icons and colors per node_kinds entry
    • Added granular API permissions for OpenGraph extension management (administration and schema data access)
    • Added incremental edge updates during post-processing to reduce unnecessary writes for selected edge types

    3 details in Everything

55. v9.1.0 May 5, 2026 · release notes

    BloodHound v9.1.0 adds PDF attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. exports, AZAddOwner detection, JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. auth token login, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. RDS auth, and API doc search.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.1.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.1.0

    • Implements AZAddOwner relationship detection for Azure attack path analysis.
    • Adds auth token login support for Just-in-Time (JIT) access workflows.
    • Supports IAM RDS authentication in database connection pooling.
    • Enables searching the API docs by resource path.
    • Adds createdBy field to auth tokens for improved auditability.

    +7 more show less

    • Exports selected columns from the Explore table for targeted data extraction.
    • Cleans up Cypher saved queries with category and subcategory organization.
    • Minimizes displayed elements in the UI when multiple nodes are returned by a Cypher query.
    • Adds node count metric for environment monitoring.
    • Migrates Owns/WriteOwner and AZ App Role post-processing to the Distributed Computation Architecture (DCA).
    • Adds Role-Based Filtering Badge on Principal Zone pages to surface access scope at a glance.
    • Updates accordion collapse and close behavior in the entity panel for improved navigation.

    12 details in Everything

56. v9.0.2 Apr 21, 2026 · release notes

    BloodHound v9.0.2 adds an OpenHound collector download link to the Downloads page.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.0.2 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.0.2

57. 2026-04-21 Apr 21, 2026 · release notes

    BloodHound v9.0.2 expands TLS cipher support and fixes Azure post-processing for PostgreSQL

    • Expanded the set of supported TLS cipher suites when BloodHound serves HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. directly to resolve SharpHound connectivity issues
    • Added an OpenHound download link to the Download Collectors page

    2 details in Everything

58. v9.0.0 Apr 13, 2026 · release notes

    BloodHound v9.0.0 adds API key expiration, JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. opt-out, auditor role expansion, Azure contributor ingestion, and graph UI improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v9.0.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v9.0.0

    • Adds API key expiration support, including expiration parameters and table columns showing expiry status for all keys.
    • Adds a JIT (Just-in-Time) support account opt-out option so organizations can disable automatic support account provisioning.
    • Adds a configurable redirect URL for JIT provisioning flows.
    • Expands the Auditor role with additional access permissions.
    • Adds ingestion support for AZContributor relationships on Management Groups, Resource Groups, and Subscriptions.

    +14 more show less

    • Adds a Delete HasSession edges action to the Database Management interface.
    • New timeout limit checkbox in the Explore UI to remove query result limits for large graph queries.
    • Adds drag-and-drop column reordering in the Explore table.
    • Increases edge and arrow visibility in the graph explorer.
    • Updates node labels display in the graph.
    • Generates timestamped filenames for graph exports.
    • Adds SharpHound collection metrics reporting.
    • Adds OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. Extension Finding Schemas API endpoint (marked experimental).
    • Adds OpenGraph Collector Platform (OpenHound) as a recognized client type in the UI and Collector Downloads page.
    • Ceases creation of Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. stub users during Azure ingest post-processing, reducing graph noise.
    • Adds posture rounding clarity improvements to the Posture page.
    • Adds support account display filtering in the Users management UI.
    • Updates the sub-navigation menu in the main navigation.
    • Improves ingest file naming conventions.

    19 details in Everything

59. 2026-04-13 Apr 13, 2026 · release notes

    BloodHound v9.0.1 adds OpenHound collectors, env-scoped access control, and HasSession edge deletion

    └──▷ HOW TO FIND IT
    Use the new Administration page to manage OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. extensions like GitHub or Okta.
    📍In the UI, navigate to Administration › OpenGraph Extensions to view and configure your collectors.
    Refresh time-sensitive session data without deleting the entire graph by removing only HasSession edges.
    📍In the Administration panel, use the Delete HasSession edges action to clear stale session links while preserving other graph data.
    Filter search results in Explore by specific OpenGraph node types (e.g., GitHub, Okta) to find relevant data faster.
    📍In the Explore search bar, apply the Node Type filter and select your desired extension type to narrow the results.
    • Adds OpenHound data collector framework with support for GitHub, Jamf, and Okta OpenGraph extensions
    • Adds Administration page to manage OpenGraph extensions
    • Adds Environment Targeted Access Control to scope User and Read-only access by environment
    • Adds HasSession edge deletion to refresh session data without clearing the graph
    • Adds OpenGraph node type filtering in search results

    5 details in Everything

60. v8.9.0 Mar 23, 2026 · release notes

    BloodHound v8.9.0 adds federated identity credential support, audit-log stdout streaming, standalone nodes, API token expiration, and an OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. schema API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.9.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v8.9.0

    • Adds support for Federated Identity Credentials as a new Azure node/relationship type.
    • New option to stream audit logs to stdout, enabling log-pipeline integrations without file access.
    • New GetGraphSchemaDisplayKinds API endpoint for querying OpenGraph schema display kinds.
    • Supports standalone (unconnected) nodes in ingestion — nodes no longer require edges to be persisted.
    • Supports arbitrary endpoint matching for edge ingest, enabling more flexible OpenGraph data ingestion.

    +5 more show less

    • Adds an Expiration column to the API Tokens management UI.
    • Updates the Explore page Table View with a new ScrollArea component for improved large-dataset navigation.
    • Container image base updated to Debian 12.
    • Adds a new reusable payload validator and CLI interface for ingest pipelines.
    • Updated SimpleEnvironmentSelector to support OpenGraph environments.

    10 details in Everything

61. 2026-03-23 Mar 23, 2026 · release notes

    BloodHound v8.9.0 adds FIC data collection, property-based edge matching and flexible OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. ingestion

    • Adds AZFederatedIdentityCredential node type and AZAuthenticatesTo edge to represent Azure Federated Identity Credentials collected by SharpHound/AzureHound.
    • Adds property-based edge matching for OpenGraph, enabling hybrid edge creation using cross-system attributes like email, username, or hostname.
    • Enables uploading nodes and edges in separate OpenGraph data payloads without losing disconnected nodes after ingestion.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The format of OpenGraph data payloads has changed and must be updated to work with this release.
62. v8.7.0 Mar 4, 2026 · release notes

    BloodHound v8.7.0 adds OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. extension management UI, cancelable analysis runs, column resizing, and API key controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.7.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v8.7.0

    • Adds OpenGraph extension upload dialog in the UI, allowing users to upload custom graph schema extensions directly from the interface.
    • Adds delete extension UI flow in OpenGraph Management, enabling removal of custom extensions from within the product.
    • Adds Upsert Extension endpoint for programmatically creating or updating OpenGraph schema extensions via the API.
    • Adds Delete Extension endpoint for removing OpenGraph schema extensions via the API.
    • Adds new validation checks on the Upsert Schema Extension endpoint to enforce correctness of extension definitions.

    +11 more show less

    • Adds SourceKind to the DAWGS Kinds table, expanding OpenGraph schema metadata.
    • Adds Source Kind Deactivation support in the Schema Service.
    • Adds a migration for the OpenGraph Findings list findings table.
    • Enables table view column resizing in the UI for more flexible data exploration.
    • Enables cancellation of a queued analysis run from the Scheduled Analysis interface.
    • Allows the analysis.scheduled parameter to be updated directly from the UI, removing the need for manual config changes.
    • Adds a new scheduled_analysis_configuration feature flag to gate scheduled analysis configuration controls.
    • Adds a new opengraph_collector_platform_support feature flag for OpenGraph collector platform support.
    • Adds API key disablement support in the auth middleware, allowing API keys to be disabled without deletion.
    • Adds an API-level check enforcing constraints on removal of API keys.
    • Deletes all auth tokens on startup to enforce clean session state.

    16 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !All existing auth tokens are deleted on startup; any sessions or integrations relying on persisted auth tokens will be invalidated after upgrading.
63. 2026-03-04 Mar 4, 2026 · release notes

    BloodHound 2026-03-04 adds resizable table columns, Meta node details, valid_edges.json schema for Azure edge guidance

    • Enables resizing of table columns in the Explore graph view to review data comfortably on smaller screens without changing window size.
    • Adds Meta node details display in the Entity Panel, allowing users to review metadata without encountering errors.

    2 details in Everything

64. v8.6.0 Feb 11, 2026 · release notes

    BloodHound v8.6.0 adds OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. management, Integrated Windows Auth, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. last-logon data, and scheduled analysis improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.6.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v8.6.0

    • Adds OpenGraph Management admin page for managing OpenGraph nodes, relationships, and extensions via the UI.
    • Adds OpenGraph nodes to the shortest-path endpoint, enabling cross-graph pathfinding.
    • Adds OpenGraph edge filtering in the UI to control which relationship types are displayed.
    • Supports OpenGraph remediations, surfacing remediation guidance for OpenGraph findings.
    • Adds a Get Extension Information endpoint for querying schema extension details.

    +13 more show less

    • Adds namespace support to schema extensions via the API.
    • Generates AD and Azure extension schemas automatically and applies them on startup.
    • Adds a new app configuration field to disable API keys globally.
    • Adds support for bypassing query limits when the prefer:wait=-1 header is provided.
    • Adds Integrated Windows Authentication (IWA) support in the frontend.
    • Adds Last Logon Timestamp as a property on Entra ID (AzureAD) User nodes.
    • Displays zone information in the object info panel for graph nodes.
    • Adds file ingest warnings directly to the file ingest table.
    • Supports an Analyze Now trigger for scheduled analysis.
    • Adds scheduled analysis as a user-updatable parameter.
    • Adds a finding resource and type to the API client.
    • Adds literal values to unified graph responses.
    • Reworks Local Group post-processing logic.

    18 details in Everything

65. 2026-02-11 Feb 11, 2026 · release notes

    BloodHound 2026-02-11 adds AzureHound User-Agent flag, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. last sign-in data, and Zone Builder rule testing

    └──▷ USE IT
    Customize the User-Agent string sent by AzureHound to avoid filtering or identify requests
    shell copy

    azurehound collect -d example.com -u MyCollector/1.0

    Test a Cypher query logic in Zone Builder before saving it as a permanent rule
    📍In the Zone Builder, type your Cypher query and click Run to validate results.
    • Adds -u flag to azurehound for customizing the HTTP User-Agent header
    • Adds a Run button in Zone Builder to verify Cypher queries before creating rules
    • Allows User and Power User roles to edit shared Cypher queries

    3 details in Everything

66. v8.5.1 Jan 27, 2026 · release notes

    BloodHound v8.5.1 reworks Local Group post-processing for more accurate AD attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.5.1 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v8.5.1

67. v8.5.0 Jan 22, 2026 · release notes

    BloodHound v8.5.0 adds OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. node/edge searchability, schema extension CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. APIs, kind filtering, and new Privilege Zones UI improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.5.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v8.5.0

    • OpenGraph nodes are now searchable on the Explore page.
    • Explore search results now return custom node icon data for OpenGraph nodes.
    • New API endpoint to retrieve OpenGraph edge kinds.
    • Full CRUD database methods for OpenGraph schema extensions (extensions, node kinds, edge kinds, and properties).
    • OpenGraph schema extension migrations added.

    +17 more show less

    • Kind filtering added to the asset-group-tags/{id}/selectors/{id}/members API endpoint.
    • Asset group tag ID filtering added to the Global Search API.
    • Filter support added to the GET /asset-group-tag/:id/members endpoint.
    • Selector type counts added to GET /api/v2/asset-group-tags.
    • Kind count breakdown added to the Selectors API.
    • Adds hygiene_attack_paths count to the domains endpoint.
    • New DisableTimeoutLimit property added to application configuration.
    • Source Kind now supports deactivation and re-activation instead of hard deletion.
    • Far-reaching accessibility improvements across the UI.
    • Table view sort arrows are now always visible.
    • Processing indicator added to the UI for in-progress operations.
    • Run button now shows a visual running status while a query is executing.
    • Complete schema environments CRUD implemented.
    • Basic schema relationship findings CRUD implemented.
    • Objects Accordion and Details Rules display redesigned in the details panel.
    • Privilege Zones selected details tabs added.
    • Citrix RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. support enabled via analysis.citrix_rdp_support configuration.

    22 details in Everything

68. 2026-01-22 Jan 22, 2026 · release notes

    BloodHound v8.5.0 adds keyboard shortcuts, API member counts/counts by kind, Zone Builder UI updates, and AzureHound logging improvements.

    • Adds application-wide keyboard shortcuts to navigate and act without a mouse
    • Adds GET endpoint to retrieve selector member counts grouped by primary kind
    • Adds API filter on Asset Group Tag Members for primary kind, name, or object ID
    • Adds API support to limit global search to a specific tag
    • Adds API field returning total, custom, default, and disabled selector counts per tag

    +9 more show less

    • Adds running state indicator on the Explore Run button to track Cypher query execution
    • Adds improved OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. node search functionality
    • Adds time picker for custom date ranges in Posture views
    • Renames Zone Builder to Privilege Zone Management with new rule/object tabs
    • Enables enable/disable toggles for rules in the Privilege Zone Management forms
    • Separates direct vs expanded sample results in Privilege Zone Management rule forms
    • Improves layout, quotas messaging, and protected Tier Zero cues in zone/label forms
    • Updates AzureHound region options to remove deprecated Azure Germany
    • Adds computer status logs capturing CARegistry collection progress for Certificate Abuse

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Zone Builder UI has been renamed to Privilege Zone Management
69. v8.4.0 Dec 2, 2025 · release notes

    BloodHound v8.4.0 adds an Auditor role, exposure values in Domain Selectors, Prometheus ingest metrics, and reworked Citrix CanRDP analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.4.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v8.4.0

    • Adds a new Auditor role for read-only audit access to the platform.
    • Adds exposure values to Domain Selectors for at-a-glance risk visibility.
    • Adds icons to the object count panel in Attack Graph Tool for faster object-type identification.
    • Adds Prometheus metrics for ingest throughput, enabling observability of data pipeline performance.
    • Exposes product edition in the VersionResponse API endpoint.

    +7 more show less

    • Allows SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. admins to disable MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for individual users.
    • Adds environment filter capability to selector views.
    • Adds support for OR behavior across multi-filter conditions in selectors.
    • Reworks Citrix CanRDP analysis logic for more accurate privilege path detection.
    • Sets initial only as the default certification when using Quick Add to create a selector.
    • Enables analysis descriptions to be displayed in the UI.
    • Adds vulnerability scanning to the CI/CD pipeline.

    12 details in Everything

70. v8.3.0 Oct 30, 2025 · release notes

    BloodHound v8.3.0 adds Privilege Zone history, ingest file retention controls, ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC6 improvements, and new AD/Azure graph properties.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.3.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v8.3.0

    • Adds a History View for Privilege Zones, letting analysts track how zone membership has changed over time.
    • Adds a rolling asset group history window for tracking asset group changes over a configurable time range.
    • Adds API controls for retaining ingest files after processing, with a configurable default retention setting.
    • Adds a zone glyph selector for visually distinguishing Privilege Zones in the UI.
    • Adds a certification zone filter to GET certified members, scoping results to only certification-required zones.

    +10 more show less

    • Adds a File Ingest details panel and filter modal for inspecting and filtering ingested data files.
    • Adds the netlogon DC property to Domain Controller nodes for richer AD enumeration data.
    • Adds the GPO Status property with human-readable resolution to Group Policy Object nodes.
    • Adds service principals as supported principals in the AZAddMembers edge, expanding Azure attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. coverage.
    • Improves ADCSESC6 post-processing for more accurate ESC6 attack path detection.
    • Expands the AdminSDHolderProtected property into ProtectAdminGroups graph relationships for richer AdminSDHolder visibility.
    • Replaces ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. display text with ACEs terminology in the Data Quality view for accuracy.
    • Adds a Summary Page to BloodHound Community Edition (BHCE).
    • Adds scroll support to the simple domain selector for environments with many domains.
    • Bumps SharpHound and AzureHound collector versions.

    15 details in Everything

71. v8.2.0 Sep 23, 2025 · release notes

    BloodHound v8.2.0 adds ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. pathfinding, saved query sharing, audit logging, job filtering, and new asset group tag capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.2.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v8.2.0

    • Adds History Search API endpoint for querying past search activity.
    • Adds accordion detail panels for ADCS nodes in the graph explorer.
    • Updates built-in ADCS saved searches with improved coverage.
    • Adds DCFor edge type to the pathfinding relationship filter.
    • Makes ManageCA and ManageCertificate edges traversable in pathfinding.

    +24 more show less

    • Adds a kinds array to graph node API responses for richer type information.
    • Adds environment filter support to the /selectors/:selectorId/members API endpoint.
    • Adds member filtering per environment in the Priority Zone details page.
    • Adds filter dialog to the Finished Jobs log for narrowing ingestion history.
    • Adds Status and DataCollected filters to the Finished Jobs table.
    • Adds date range picker inputs to the Finished Jobs table for time-scoped filtering.
    • Adds tag glyph indicators on asset group tag items in the UI.
    • Adds new config option to enable or disable user analytics collection.
    • Adds Certify/Revoke Certification API for objects.
    • Adds List Certifications API endpoint.
    • Adds client type field to the Client API.
    • Adds a new Get Users Minimal API endpoint for lightweight user lookups.
    • Introduces a dynamic Content Security PolicyContent Security PolicyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. (CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks.) via API configuration.
    • Introduces force_download_embedded_collectors configuration option to force collector downloads.
    • Adds sort_by and environment filtering support to the /asset-group-tags/:assetGroupTagId/selectors endpoint and selectors list UI.
    • Adds saved query sharing: queries can be set to public and shared with specific users.
    • Persists saved query filters across sessions.
    • Adds delete confirmation modal for saved queries.
    • Adds a stale clients parameter for client management.
    • Bumps SharpHound bundled collector to v2.7.2.
    • Hides the manual upload button for users who lack upload permissions.
    • Refreshes BloodHound application icon and logos.
    • Adds Release Audit proof-of-concept feature for tracking release events.
    • Adds comma-separated number formatting to large numeric displays in the UI.

    29 details in Everything

72. v8.1.1 Sep 2, 2025 · release notes

    BloodHound v8.1.1 adds file logging support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.1.1 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v8.1.1

73. v8.1.0 Aug 26, 2025 · release notes

    BloodHound v8.1.0 adds new saved-query APIs, AGT history filtering, ingest error details, and .deb packaging for Kali-style installs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.1.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v8.1.0

    • New Get SavedQuery API endpoint for retrieving individual saved Cypher queries.
    • New GetSavedQueryPermissions API endpoint for inspecting sharing/permissions on saved queries.
    • New GetAllAttackPathFindings API endpoint now accepts an Asset Group parameter for scoped attack-path results.
    • New API endpoint for file-level ingest error details, enabling per-file troubleshooting of ingestion failures.
    • Adds infinite-scrolling pagination to selectors and members lists on the Zone Management details page.

    +15 more show less

    • Adds an Analyze Now button for on-demand graph analysis.
    • Adds a history filter dialog to the AGT (Asset Group Tagging) view for filtering tagging history entries.
    • AGT now records a history entry for auto-certification events during node tagging.
    • Adds denormalized property fields to the AGT selector nodes table.
    • Adds custom icon support for Asset Group Tags (AGTs).
    • Adds an X button to the entity panel header to dismiss the selected item.
    • Adds an environment parameter to Privilege Zone member endpoints for environment-scoped queries.
    • Abuse info and GoldenCert attack guidance updated to Certify 2.0 commands.
    • Allows nullable NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. registry values ingested from SharpHound.
    • Explore table now supports column sort state persistence.
    • Reworked Finished Jobs Log table UI.
    • Debian (.deb) package added for direct installation on distributions such as Kali Linux.
    • Bundles AzureHound 2.7.1.
    • Adds disabled-tier icons to the Privilege Zones UI.
    • AD special identities updated with expanded coverage.

    20 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The timezone setting has been removed from the configuration file because the container image no longer supports it; any existing configuration referencing this setting will need to be updated.
74. v8.0.0 Jul 29, 2025 · release notes

    BloodHound v8.0.0 adds ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. inheritance pathfinding, Explore table view, forest trust selectors, and database deletion by source kind.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v8.0.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v8.0.0

    • Adds ACL inheritance pathfinding and a dropdown UI for visualizing ACL inheritance chains.
    • Adds an Explore graph data table with column management, row selection, JSON download, and copy-cell-to-clipboard support.
    • Adds an Incoming Forest Trust Builders selector for cross-forest trust analysis.
    • Adds a Search Asset Group Tags API endpoint.
    • Adds a Single Findings API endpoint.

    +10 more show less

    • Adds an ACL inheritance API endpoint.
    • Adds deletion by source kind in Database Management.
    • Adds source_kind field to the OpenGraphOpenGraphA web metadata protocol, created by Facebook, that lets a webpage declare structured properties—title, image, description, type—so link previews render consistently across social platforms and messaging apps. schema.
    • Adds IsReadOnlyDC computer attribute ingestion.
    • Supports HasSIDHistory on Group objects.
    • AGT Selectors endpoint now supports pagination.
    • AGT history now records analysis enabled/disabled actions.
    • Tiering list now records history entries.
    • Adds visual icon indicator for disabled tiers in the Explore UI.
    • Bundles SharpHound v2.7.0.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The AGT history endpoint has been renamed (see BED-6280); existing integrations or bookmarks using the old endpoint path will break.
    • !Power users no longer have app config permissions; any workflow relying on power users reading or writing app config will stop working.
75. v7.6.0 Jul 9, 2025 · release notes

    BloodHound v7.6.0 adds multi-tier analysis, Azure PIMPIMProtocol Independent Multicast, an IETF routing protocol that distributes IP multicast traffic across networks without depending on a specific unicast routing protocol, letting tools monitor or manipulate multicast group traffic./role coverage, a table view in Explore, and custom query import/export.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.6.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v7.6.0

    • Adds multi-tier analysis support for Asset Group Tags (AGT), enabling tiered attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis beyond Tier Zero.
    • Adds AZRoleApprover edge to model Azure PIM role approval relationships for post-processing.
    • Adds AZRoleEligible edge expansion for Tier Zero tagging, capturing eligible Azure role principals.
    • Adds KindAZRoleEligibilityScheduleInstance to Azure converters for richer PIM data ingestion.
    • Adds a table view in the Explore tab for browsing nodes and edges in a structured, sortable format.

    +5 more show less

    • Adds a summary view in the Explore tab for quick environmental overviews.
    • Adds an analysis_enabled flag to asset group tags, allowing per-tag analysis toggling.
    • Adds a Zone Management default view for managing security zones.
    • Retires the 'Automatically add parent OUs and containers of Tier Zero AD objects to Tier Zero' Early Access setting, with Tier Zero expansion now handled by the Asset Group Tag engine.
    • Requires AzureHound collector v2.6.0 for full Azure data collection compatibility.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The 'Automatically add parent OUs and containers of Tier Zero AD objects to Tier Zero' Early Access setting is retired and no longer functional; Tier Zero OU/container expansion is now handled exclusively by the Asset Group Tag engine.
    • !This release requires AzureHound v2.6.0; older collector versions will not be fully supported.
76. v7.5.0 Jun 17, 2025 · release notes

    BloodHound v7.5.0 adds HasTrustKeys edge, Azure role ingest, custom node icons, zone-based tier management, and search highlight/zoom.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.5.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v7.5.0

    • Adds new HasTrustKeys edge type for modeling Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. trust key relationships in the graph.
    • Ingests AZRoleManagementPolicyAssignment objects from Azure, expanding Azure attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. coverage.
    • Supports custom node icons in the UI for Generic Ingest custom node types.
    • Adds Create, Update, and Delete Tier/Zone APIs and UI controls for zone-based tier management.
    • Adds analysis.tiering parameter to application configuration for controlling tiering analysis behavior.

    +7 more show less

    • Highlights and zooms the graph view when using Search Current Nodes on the Explore page.
    • Displays node type in the Entity Panel for clearer node identification.
    • Adds in-product help text for the AZRoleApprover edge.
    • Updates Generic Ingest API with finalized JSON schema and Swagger documentation.
    • Bundles latest AzureHound release.
    • Adds Created_by / Updated_by fields using email instead of user ID for better auditability.
    • Adds a hounds (collectors) downloads API spec.

    12 details in Everything

77. v7.4.0 May 27, 2025 · release notes

    BloodHound v7.4.0 adds tiering/selector engine, custom node kinds for generic ingest, Azure role eligibility, and new tiering management APIs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.4.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v7.4.0

    • Adds selector engine for Asset Group Tiering (AGT), enabling automated membership calculation via configurable selectors.
    • Adds create/edit selector page in the UI for defining tier membership selectors.
    • Adds disabled selector badges in the tiering UI to visually indicate inactive selectors.
    • Adds tabs for tier management in the UI.
    • Adds /selector-preview endpoint to preview selector results before committing.

    +14 more show less

    • Adds GET /selector/:selectorId endpoint to retrieve a specific selector's details.
    • Adds API endpoint to list all objects from a tier/label.
    • Adds API endpoint to list all objects from a specific selector.
    • Adds counts query parameter to tier/label membership endpoints to return member counts.
    • Adds GET tier/label list endpoint for programmatic enumeration of tiers and labels.
    • Adds member info retrieval with selectors list.
    • Adds email column to AssetGroupHistory for improved audit tracking.
    • Adds custom node kinds support in the Generic Ingest pipeline.
    • Adds schema validation for the generic ingest pipeline.
    • Adds ingest support for AzureRoleEligibilityScheduleInstance objects.
    • Adds edge panels for AZRoleEligible edges in the UI.
    • Enables deep linking as a generally available feature.
    • Updates permissions required to interact with the database management component.
    • Replaces the TrustedBy relationship with a reworked implementation affecting common searches and AGT queries.

    19 details in Everything

78. v7.3.0 Apr 22, 2025 · release notes

    BloodHound v7.3.0 adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. relay attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., GPOLocalGroup ingestion, new tiering selectors, and a list-kinds API endpoint.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.3.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v7.3.0

    • Adds CoerceAndRelayNTLMtoADCS relay target detection, surfacing NTLM coercion-to-ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. attack paths in the graph.
    • Promotes NTLM attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis to general availability (GA).
    • Adds ingestion of GPOLocalGroup data, enabling BloodHound to map local group membership configured via Group Policy.
    • New list kinds API endpoint (/api/v2/graph/kinds or similar) exposes all known node and edge kinds programmatically.
    • New asset management page in the UI for managing tiered assets.

    +7 more show less

    • Adds create and update selector workflows for tier management, including a Cypher-based selector component.
    • New API endpoint to retrieve member counts per asset group tag (/member/counts).
    • Adds API contract for tier/label details.
    • Clicking a node in the Edge Composition or Relay Targets panel now performs a single-node search directly in Explore.
    • Attack Path Findings now include a direct link to the Explore view for investigated paths.
    • Sets sequential layout as the default graph layout in Explore.
    • Adds help text for OwnsRaw and WriteOwnerRaw edges in the entity panel.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !FileUploadJob is renamed to IngestJob — any integration or tooling referencing FileUploadJob by name will break.
79. v7.2.1 Apr 3, 2025 · release notes

    Adds HTTPEnrollmentEndpoints ingestion and 64-bit support for edge relay and composition queries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.2.1 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v7.2.1

    • HTTPEnrollmentEndpoints are now ingested as new node types
    • GetEdgeRelayTargets returns results using 64-bit integers
    • GetEdgeComposition parses node IDs into 64-bit integers

    3 details in Everything

80. v7.2.0 Mar 25, 2025 · release notes

    BloodHound v7.2.0 adds deep linking across all search modes, new ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise./NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. relay attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., and bidirectional shortest-path for PostgreSQL.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.2.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v7.2.0

    • Adds deep linking for node search, pathfinding search, Cypher search, composition/relationship queries, and node context menu — shareable URLs now encode full graph exploration state.
    • Supports selectedItem and expandedPanelSections URL query parameters so specific nodes and open panel sections are preserved in shared links.
    • Supports deep linking for the selected environment, keeping domain/tenant context in the URL.
    • Supports Export Graph data functionality via deep linking.
    • Adds back_button_support feature flag, letting users enable or disable browser back-button navigation within the graph UI.

    +5 more show less

    • Adds plumbing for CA Enrollment Endpoints (CoerceToADCS) attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. edges.
    • Adds CoerceAndRelayNTLMToSMB composition-to-relay-targets attack path, showing SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. relay chains in pathfinding.
    • Adds LimitedRights edges to the pathfinding filter options.
    • Implements bidirectional BFS for shortest-path (SP/ASP) queries on PostgreSQL backends, improving performance for large environments.
    • Removes self-relay from SMB and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.(S) relay attack path logic, reducing false-positive paths.

    10 details in Everything

81. v7.1.0 Mar 7, 2025 · release notes

    BloodHound v7.1.0 adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. relay attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., reworked Owns/WriteOwner edges, and new ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. coercion post-processing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.1.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v7.1.0

    • Adds post-processing for CoerceAndRelayNTLMtoADCS attack paths, surfacing NTLM relay routes to AD CS targets.
    • Adds post-processing for CoerceAndRelayNTLMToLDAP(S) attack paths, with abuse details and relay-target composition.
    • Adds pre-built saved queries for NTLM relay attack paths.
    • Reworks Owns/WriteOwner edge logic (BED-4965), replacing OwnsRaw and WriteOwnerRaw with updated ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. relationship model.
    • Adds ingestion support for NTLM relay data to populate new NTLM relay edges.

    +6 more show less

    • Adds the back_button_support feature flag for browser back-button navigation within the UI.
    • Adds the tier_management_engine feature flag gating the new tier management engine.
    • Enforces SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. role-provisioning changes on every login, not just the first.
    • Enables recreating the default admin user via environment variable.
    • Adds client-side UI controls disabling for read-only users.
    • Includes the Direct Access Users group in collection and post-processing.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The highvalue property is removed from the graph schema; any queries or workflows relying on the highvalue field will break.
    • !OwnsRaw and WriteOwnerRaw are removed from ACLRelationships; tooling or queries referencing these relationship types will break.
82. v7.0.0 Feb 5, 2025 · release notes

    BloodHound v7.0.0 adds CoerceAndRelayNTLMToSMB detection, a new vertical nav, Cypher shortcuts, and expanded posture/findings APIs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v7.0.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v7.0.0

    • Adds post-processing and exploitation information for the CoerceAndRelayNTLMToSMB attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. edge.
    • Introduces Cypher query shortcut helpers in the UI to speed up graph query authoring.
    • Redesigns navigation with a new vertical nav bar, including collapsible state and integrated collector downloads.
    • Adds a No Data alert to surface missing collection data directly in the UI.
    • Adds display_title and display_type fields to the finding-trends API endpoint.

    +3 more show less

    • Introduces aggregated risk and posture data view on the Posture page.
    • Adds impact/exposure data to findings on the Posture page.
    • Applies consistent Kerberoastable exclusions across relevant attack path queries.

    8 details in Everything

83. v6.4.0 Jan 14, 2025 · release notes

    BloodHound v6.4.0 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. auto-provisioning with role mapping and multi-sort support for the /details API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.4.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v6.4.0

    • Adds auto-provisioning support to the SSO auth flow, allowing users to be automatically created on first SSO login.
    • Adds role provisioning support for SSO providers, enabling automatic role assignment based on SSO identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. attributes.
    • Adds configurable SSO provider options, giving administrators more control over SSO provider configuration.
    • Enables the GET /details API to accept multiple sort_by query parameters simultaneously.
    • Updates default Tier Zero asset group membership (removes DnsAdmins from default Tier Zero).

    +1 more show less

    • Adds backend redirect logic to send users back to the UI with a meaningful error when SSO login fails.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Create SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Endpoint API is deprecated in this release.
    • !Requires SharpHound v2.5.13; earlier collector versions are not supported with this release.
84. v6.3.0 Dec 11, 2024 · release notes

    BloodHound v6.3.0 adds CoerceToTGT edge, a revamped Posture page, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support, graph label toggling, and more default Tier Zero nodes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.3.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v6.3.0

    • Adds new CoerceToTGT attack edge for modeling KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. TGT coercion paths in Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. graphs.
    • Enables the updated Posture page with a new date-range selector and supporting API implementation for tracking security posture over time.
    • Enables OIDC as a supported SSO provider type, including callback URI display in OIDC provider details.
    • Adds a PATCH endpoint to update existing SSO providers, plus UI support for editing SSO provider configurations.
    • Adds ability to download the SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. signing certificate directly from the UI.

    +4 more show less

    • Expands the default set of Tier Zero (T0) nodes for more comprehensive high-value asset coverage.
    • Adds toggle labels option to show or hide node/edge labels in the graph explorer.
    • Publishes OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specs for Add, Create, List, and Update SSO provider endpoints, and for the Posture and Findings APIs.
    • Updates bundled SharpHound collector to v2.5.9.

    9 details in Everything

85. v6.2.0 Nov 14, 2024 · release notes

    BloodHound v6.2.0 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication support, a unified SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. admin UI, and more accurate Kerberoastable detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.2.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v6.2.0

    • Adds OIDC provider support with login and callback handlers, enabling OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. as an authentication method alongside SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider..
    • New API endpoint to list OIDC providers, with backward-compatible unified ListAuthProviders endpoint covering both SAML and OIDC.
    • New SSO provider delete API endpoint for programmatic removal of SSO configurations.
    • Adds instant redirect to the identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. when only one SSO provider is configured, streamlining the login flow.
    • Refactors the SAML admin UI into a unified SSO admin UI supporting both SAML and OIDC providers.

    +5 more show less

    • Adds audit logging for SAML authentication attempts.
    • New permission scope for RoleUploadOnly to restrict upload-only role access more granularly.
    • GMSA and MSA accounts are now correctly excluded from Kerberoastable detections, reducing false positives.
    • Adds a Posture page (behind a feature flag), surfacing new attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. visibility capabilities.
    • Adds API endpoint structure for the Posture page in the JS client.

    10 details in Everything

86. v6.1.0 Oct 22, 2024 · release notes

    BloodHound v6.1.0 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. provider registration and scheduled analysis runs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.1.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v6.1.0

    • New OIDC Provider endpoint and API registration support, enabling external identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. integration.
    • New Scheduled Analysis feature, allowing graph analysis to be triggered automatically on a schedule.
    • Updated impact table for the Butterfly attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. view.

    3 details in Everything

87. v6.0.0 Sep 30, 2024 · release notes

    BloodHound v6.0.0 adds Citrix RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. analysis, expanded ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. abuse info, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. feature flag, dark mode on by default, and prune TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v6.0.0

    • Adds Citrix CanRDP post-processing and a Citrix RDP Configuration UI for analyzing Citrix-based remote access paths.
    • Adds abuse info for generic ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. edges against ADCS nodes, improving ADCS attack-path guidance.
    • Expands ESC9b and ESC10b abuse info with improved detail for certificate-based attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
    • Adds more general abuse info entries for additional edge types.
    • Introduces SchannelAuthenticationEnabled property support, enabling detection of Schannel-based authentication configurations.

    +6 more show less

    • Adds support for prune TTLs and moves the reconciliation feature flag to parameters, enabling data lifecycle management.
    • Adds preMigrationDaemons support for running pre-migration tasks during startup.
    • Introduces a feature flag for the OIDC initiative, laying groundwork for OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication.
    • Enables dark mode by default and removes the dark mode feature flag toggle.
    • Grants SavedQueriesRead permission to the ReadOnly role, allowing read-only users to access saved queries.
    • Normalizes files to UTF-8 when extracting ZIP files during ingest, broadening compatibility with non-ASCII data sources.

    11 details in Everything

88. v5.15.0 Sep 10, 2024 · release notes

    BloodHound v5.15.0 adds owned-object visuals, auto-T0 tagging, Write gPLink abuse detection, and new saved-query sharing APIs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.15.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.15.0

    • Adds visual representation of owned objects directly in the graph UI.
    • Automatically tags Tier 0 parent objects, reducing manual classification work.
    • Detects Write gPLink abuse as a new attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. edge.
    • Introduces the LoginURL Azure AD property for app objects.
    • Collects additional Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. properties for richer node data.

    +5 more show less

    • Removes CanAbuse edges, replacing them with more specific relationships.
    • Adds a saved-query update endpoint (PUT/PATCH for existing saved queries).
    • Adds a saved-query share endpoint to share queries with other users.
    • Adds a saved-query unshare endpoint to revoke sharing.
    • Adds a ~eq case-insensitive string equality predicate for API filtering.

    10 details in Everything

89. v5.14.0 Aug 20, 2024 · release notes

    BloodHound v5.14.0 expands OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec coverage, adds AIACA nodes in CA chains, and improves Saved Cypher with description fields.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.14.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.14.0

    • Adds AIACA nodes to the certificate authority chain graph, improving PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. visibility.
    • Adds a description field to Saved Cypher queries for better organization and documentation.
    • Expands OpenAPI spec to cover auth/user, grapher, cypher, search, data, analysis, and group entity endpoints.
    • Adds UI permission gating for asset group edits, restricting modifications to authorized users.
    • Adds audit log entries for failed auth token deletion events.

    +3 more show less

    • Adds support for Entra devices with unsupported operating systems as graph nodes.
    • Adds default query result limits to all graph queries to improve stability at scale.
    • Introduces Cypher-to-PgSQL generic translation layer, enabling broader PostgreSQL backend support.

    8 details in Everything

90. v5.13.0 Aug 1, 2024 · release notes

    BloodHound v5.13.0 adds dark mode, hybrid path analysis, DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. group shortcutting, and live datapipe status exposure.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.13.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.13.0

    • Adds dark mode UI theme across the application, including updated Copy menu palette support.
    • Introduces hybrid path edge post-processing and edge panels for cross-environment attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis.
    • Adds DCSync group shortcutting to accelerate DCSync-related attack path calculations.
    • Exposes live datapipe status via the tool API, enabling real-time ingest pipeline monitoring.
    • Returns partial failure details when ingesting zip files, so practitioners can see which entries failed without losing the whole ingest.

    +4 more show less

    • Displays server version on the profile page.
    • Supports negative numbers in Cypher queries.
    • Expands OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. (OAPI) spec coverage to include entity path endpoints for User, Computer, Domain, GPO, OU, Base, Azure, and Meta entities.
    • Bumps SharpHound to v2.5.4.

    9 details in Everything

91. v5.12.0 Jul 17, 2024 · release notes

    BloodHound v5.12.0 enforces unique Asset Group name tags and adds group shortcutting for SyncLAPSPassword post-processing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.12.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.12.0

    • Enforces uniqueness of Asset Group name tags, preventing duplicate AG names across the environment.
    • Adds group shortcutting to SyncLAPSPassword post-processing, expanding attack-path coverage for LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet.-related edges.
    • Adds entity query responses and bh-graph models to the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specification, broadening API documentation coverage.

    3 details in Everything

92. v5.11.0 Jun 17, 2024 · release notes

    BloodHound v5.11.0 adds FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. EULA flag, API timeout removal, asset group members view, and password update requirement.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.11.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.11.0

    • feat: require current password to update password enforces the existing password during updates.
    • Display members of custom asset groups on Group Management screen
    • Add FedRAMP EULA feature flag by BED-4391

    3 details in Everything

93. v5.10.0 May 28, 2024 · release notes

    Bloodhound v5.10.0 adds configurable Cypher controls, audit logs for mutations, and parameter parsing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.10.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.10.0

    • Adds support for configuring CypherControls via configuration to control query execution limits.
    • Adds the MERGE clause to supported Cypher queries for graph mutation operations.
    • Adds a new complexity measurement system for Cypher graph mutations to help evaluate query cost before execution.
    • Adds audit logs that record all graph mutation attempts by users for security tracking.
    • Adds parameter parsing support in the Cypher frontend, enabling dynamic values in Cypher queries.

    +1 more show less

    • Enables obtaining object information even if the type is not in the schema by funneling localgroups and localusers through the Base entity endpoint.

    6 details in Everything

94. v5.9.0 May 9, 2024 · release notes

    BloodHound v5.9.0 adds ESC2 pre-defined query, OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. schema updates, RoleSeparationEnabled property, and Issuance Policy Entity Panel

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.9.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.9.0

    • feat: add ESC2 pre-defined query enables a new built-in query for ESC2 attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
    • feat: add RoleSeparationEnabled property adds a new capability/property related to role separation logic.
    • feat: post process AZAddSecret edges from roles instead of principals changes the source of AZAddSecret edge composition to roles, unlocking role-based Azure attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis.

    3 details in Everything

95. v5.8.1 Apr 15, 2024 · release notes

    BloodHound v5.8.1 adds --risk-exposure-calc flag for risk exposure calculations and default ESC.13 schema support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.8.1 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.8.1

    • Adds ESC.13 attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. edges to AD schema, enabled by default in pathfinding
    • Adds IssuancePolicy nodes and edge information to the data ingest pipeline and UI

    2 details in Everything

96. v5.8.0 Mar 27, 2024 · release notes

    BloodHound v5.8.0 adds ingest disabling flag, Zip uploads, ESC4 post-processing and a usePermissions hook.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.8.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.8.0

    └──▷ USE IT
    Start the service without ingesting new data, useful for server maintenance or configuration-only updates.
    shell copy

    bloodhound --disable-ingest

    • Adds the --disable-ingest config flag to prevent data ingestion during startup
    • Adds Zip file upload support for import workflows
    • Enhances RemoteContent component to render tables directly within UI views
    • Creates the usePermissions React hook for client-side permission management

    4 details in Everything

97. v5.7.0 Mar 4, 2024 · release notes

    Adds /count and /accepted-types API endpoints, JSON streaming ingest, ESC10b composition, and self-referencing edge rendering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.7.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.7.0

    • Adds GET /asset-group/:assetGroupId/members/count endpoint to return member counts for an asset group
    • Adds GET /file-uploads/accepted-types endpoint to retrieve accepted file upload MIME types
    • Enables JSON streaming for large file uploads to avoid memory limits during ingest
    • Adds ESC10b edge composition logic for attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis
    • Enables rendering of self-referencing edges (node-to-self) in the graph view

    +1 more show less

    • Improves accuracy on saved queries for tags and Cypher searches

    6 details in Everything

98. v5.6.0 Feb 14, 2024 · release notes

    PostgreSQL support and configurable auth session TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. in BloodHound v5.6.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.6.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.6.0

    • PostgreSQL is now a supported database backend alongside the previous options
    • Add new role Power User for granular access control
    • Introduce permissions ClientsRead and middleware RequireAtLeastOnePermission
    • feat: configurable auth session TTL allows administrators to set custom authentication session lifetimes via configuration
    • Support export logging for tracking data extraction events

    5 details in Everything

99. v5.5.0 Jan 23, 2024 · release notes

    BloodHound v5.5.0 adds Group Management page, tag/untag UI, Helm chart, new ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. edges and selectors API changes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v5.5.0 https://github.com/SpecterOps/BloodHound.git
    # already have the repo? check out this version:
    $ git checkout v5.5.0

    └──▷ TRY IT
    Deploy BloodHound to a Kubernetes cluster using the newly provided Helm chart
    copy

    $ helm install bloodhound ./charts/bloodhound --namespace bloodhound --create-namespace

    Manage groups directly via the UI's new Group Management page without external scripts
    📍Open the Group Management page from the main sidebar in the BloodHound web interface.
    Tag or untag specific AD objects directly from the visualization canvas for quick filtering or notes
    📍Right-click a node in the BloodHound graph view and select Tag or Untag from the context menu.
    • Adds Helm chart for Kubernetes deployment in charts/bloodhound
    • Adds Group Management page for managing groups directly in the application
    • Enables tagging and untagging nodes from the context menu in the UI
    • Adds partnertier2support and members properties to tier-zero/high-value dynamic update rules (DURs)
    • Adds CanAbuseUPNCert edge type for ADCS exploitation paths

    +4 more show less

    • Adds CanAbuseWeakCertBinding edge type specifically for ADCS ESC6 attacks
    • Adds canAbuseUPNCert edge to post-processed relationships
    • Adds new audit log fields for enhanced logging capabilities
    • Adds asset group mock endpoint for testing and development

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The selectors endpoint has been updated, potentially breaking existing integrations relying on the previous API structure
100. v5.4.0 Jan 4, 2024 · release notes

     Bloodhound v5.4.0 adds ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. node ingestion, owned node API, container panel and context menus.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v5.4.0 https://github.com/SpecterOps/BloodHound.git
     # already have the repo? check out this version:
     $ git checkout v5.4.0

     └──▷ TRY IT
     Retrieve the Cypher queries a user has saved for future analysis.
     copy

     $ curl -X GET http://localhost:8080/api/v1/users/{userId}/saved-cypher-queries

     Trigger a context menu action on a selected node to automate remediation or further enumeration.
     copy

     $ curl -X POST http://localhost:8080/api/nodes/{id}/actions -d '{"action": "disable_mfa"}'

     Update an asset group's selectors via the API to dynamically change which objects belong to the group.
     copy

     $ curl -X POST http://localhost:8080/api/asset-group-selectors/update -d '{"groupId": "1", "selectors": [...]}'

     • /api/v1/users/{userId}/saved-cypher-queries endpoint for user-saved Cypher queries
     • GET /api/asset-group-selectors/update endpoint to update asset group selectors
     • POST /api/nodes/:id/actions context menu entry to execute actions on selected graph nodes
     • container entity panel in the UI showing expanded details for node types
     • ingestion and identification of ADCS (Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Certificate Services) nodes and edges in the cyber tool

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Gorm AutoMigrate is removed; schema changes must now be handled by stepwise migrations
101. v5.3.0 Dec 5, 2023 · release notes

     Bloodhound v5.3.0 adds Update Asset Group Selectors API endpoint, node context menu actions, and the owned entity property.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v5.3.0 https://github.com/SpecterOps/BloodHound.git
     # already have the repo? check out this version:
     $ git checkout v5.3.0

     └──▷ USE IT
     Programmatically update the selectors for an existing asset group using the new endpoint.
     shell copy

     curl -X PUT https://<bloodhound-url>/api/asset-groups/<id>/selectors \
       -H 'Authorization: Bearer <token>' \
       -H 'Content-Type: application/json' \
       -d '[{"name": "New Selector", "type": "domain"}]'

     • Adds node context menu for quick access to node-specific actions in the UI
     • Adds owned property to nodes via the API for tracking compromised entities

     2 details in Everything

102. v5.1.0 Oct 16, 2023 · release notes

     BloodHound v5.1.0 adds JSON graph export, persistent saved Cypher queries via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., and auth for feature flags

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v5.1.0 https://github.com/SpecterOps/BloodHound.git
     # already have the repo? check out this version:
     $ git checkout v5.1.0

     • GET and POST /saved-queries endpoints let you persist and retrieve user Cypher queries server-side.
     • DELETE /saved-queries/<id> allows removal of stored Cypher queries.
     • Graph export now supports the JSON format, enabling programmatic graph consumption.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The feature-flag endpoint now requires authentication.
103. v5.0.10 Sep 19, 2023 · release notes

     Adds BLOODHOUND_TAG environment variable for Docker Compose version swapping

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v5.0.10 https://github.com/SpecterOps/BloodHound.git
     # already have the repo? check out this version:
     $ git checkout v5.0.10

     • Updates the posture statistics JS client, available as a BHE-only endpoint.

     1 detail in Everything

104. v5.0.9 Sep 19, 2023 · release notes

     Adds API key management to user profile, gzip compression support, and memory-exit for Cypher queries in BloodHound v5.0.9

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v5.0.9 https://github.com/SpecterOps/BloodHound.git
     # already have the repo? check out this version:
     $ git checkout v5.0.9

     • Adds feat: add api key mgmt to user profile to allow users to manage their API keys directly from the My Profile page.
     • Adds feat: add gzip compression support to reduce bandwidth usage for API responses.
     • Adds memory threshold monitoring that exits Cypher queries exceeding the configured memory limit.

     3 details in Everything