https://cybertoolchain.io/tools/bloodhound New releases and features in bloodhound, tracked by The Cyber Toolchain. en Mon, 26 Oct 2026 16:56:28 GMT https://github.com/SpecterOps/BloodHound/releases/tag/v9.9.0 https://github.com/SpecterOps/BloodHound/releases/tag/v9.9.0 Mon, 26 Oct 2026 16:56:28 GMT BloodHound v9.9.0 adds CSV export from findings, bulk Priority Zone rule ingestion, graph layout controls, and DCA-migrated post-processing for 20+ AD attack paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `is_null` and `is_not_null` query parameters to API endpoints for null-aware filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `extension` as a valid scope value for the list queries endpoint, enabling retrieval of extension-based saved queries. • Adds `profiles create` endpoint (`BED-9573`) and `profiles update` endpoint (`BED-9574`) to the jobs API. • Adds secret store config for jobs (`BED-9852`). • Adds experiment storage configuration option. • Adds CSV export from the findings table. • Adds a job history table to the UI. • Surfaces extension-based saved queries in the UI, with extension-sourced saved queries made read-only (non-modifiable). • Adds graph direction and spacing controls to the Explorer view, renders non-traversable Explorer edges as dashed lines for visual distinction, and displays associated node labels in the Explore entity panel. • Adds enriched logging for extension upsert operations. Breaking changes: • The legacy ingest parser, its types, and its schemas have been removed and replaced with CHOW-based streaming validation — any integrations relying on the legacy ingest format will break. • The zone node feature flag has been removed; zone node behavior is now controlled by Enterprise entitlement only. • The `use_raw_object_id` flag now requires OpenHound (OH) version >v0.3.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://bloodhound.specterops.io/openapi.json https://bloodhound.specterops.io/openapi.json Thu, 08 Oct 2026 00:36:10 GMT API surface changed: +8 endpoints, 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v2/gpos/{object_id}/sites⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v2/sites/{object_id} • New endpoint GET /api/v2/sites/{object_id}/controllers • New endpoint GET /api/v2/sites/{object_id}/linked-gpos • New endpoint GET /api/v2/sites/{object_id}/siteservers • New endpoint GET /api/v2/sites/{object_id}/sitesubnets • New endpoint GET /api/v2/siteservers/{object_id} • New endpoint GET /api/v2/sitesubnets/{object_id} Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v9.8.0 https://github.com/SpecterOps/BloodHound/releases/tag/v9.8.0 Wed, 07 Oct 2026 17:30:52 GMT BloodHound v9.8.0 adds ZIP bundle ingestion, AD site visualization, custom deny ACE counts, alerts retry, and richer saved queries with extension and category fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `extension_id` and `category` fields to saved queries API responses, and supports extension and category assignment on query upsert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `is_cross_platform` type field to the Findings Table for cross-platform finding classification. • Supports ZIP bundle ingestion for the extension upload API. • Adds a Custom Claim Key Parameter for client authentication configuration. • Adds collection plan API client methods and collection plan schedule client methods. • Adds collector job type client support and collector job secret client APIs. • Adds alerts retry capability via the `retry` endpoint. • Adds visualisation of Active Directory site data in the graph explorer. • Adds a `custom deny aces count` property on AD objects. • Adds Extension and Category fields to Saved Queries, enabling queries to be organized and filtered by extension and category. • Restricts database management page to admin-only access. • Distinguishes duplicate node names with distinguished name in the graph UI. • Updates empty value displays for the entity panel. • Navigation sidebar now auto-expands and auto-contracts when resizing at the responsive breakpoint. • Adds icons for the findings table in the shared UI component library. • Adds `dataAnalytics` prop on MultiSelect triggers to support Pendo tracking. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://bloodhound.specterops.io/openapi.json https://bloodhound.specterops.io/openapi.json Sun, 13 Sep 2026 14:46:07 GMT API surface changed: +30 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v2/alert-webhooks/{alert_webhook_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v2/alerts/{alert_id} • New endpoint DELETE /api/v2/clients/{client_id}/artifacts/{artifact_id} • New endpoint GET /api/v2/alert-attempts • New endpoint GET /api/v2/alert-event-types • New endpoint GET /api/v2/alert-events • New endpoint GET /api/v2/alert-events/{alert_event_id} • New endpoint GET /api/v2/alert-webhooks • New endpoint GET /api/v2/alert-webhooks/{alert_webhook_id} • New endpoint GET /api/v2/alerts • New endpoint GET /api/v2/alerts/{alert_id} • New endpoint GET /api/v2/asset-scores/zone-protected-asset-score • New endpoint GET /api/v2/clients/management/artifacts/{artifact_id} • New endpoint GET /api/v2/clients/management/available • New endpoint GET /api/v2/clients/{client_id}/artifacts/{artifact_id} • New endpoint GET /api/v2/clients/{client_id}/artifacts/{artifact_id}/download • New endpoint PATCH /api/v2/alert-webhooks/{alert_webhook_id} • New endpoint PATCH /api/v2/alerts/{alert_id} • New endpoint POST /api/v2/alert-attempts/retry • New endpoint POST /api/v2/alert-webhooks • New endpoint POST /api/v2/alert-webhooks/{alert_webhook_id}/rotate-secret • New endpoint POST /api/v2/alert-webhooks/{alert_webhook_id}/test • New endpoint POST /api/v2/alerts • New endpoint POST /api/v2/clients/management/artifacts • New endpoint POST /api/v2/clients/management/artifacts/{artifact_id}/complete • New endpoint POST /api/v2/clients/management/artifacts/{artifact_id}/parts/{part_number} • New endpoint POST /api/v2/clients/management/end • New endpoint POST /api/v2/clients/management/start • New endpoint POST /api/v2/clients/{client_id}/artifacts/{artifact_id}/download-url • New endpoint POST /api/v2/clients/{client_id}/management • GET /api/v2/attack-paths/findings: param is_cross_platform (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://bloodhound.specterops.io/openapi.json https://bloodhound.specterops.io/openapi.json Thu, 10 Sep 2026 14:44:53 GMT API surface changed: +30 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v2/alert-webhooks/{alert_webhook_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v2/alerts/{alert_id} • New endpoint DELETE /api/v2/clients/{client_id}/artifacts/{artifact_id} • New endpoint GET /api/v2/alert-attempts • New endpoint GET /api/v2/alert-event-types • New endpoint GET /api/v2/alert-events • New endpoint GET /api/v2/alert-events/{alert_event_id} • New endpoint GET /api/v2/alert-webhooks • New endpoint GET /api/v2/alert-webhooks/{alert_webhook_id} • New endpoint GET /api/v2/alerts • New endpoint GET /api/v2/alerts/{alert_id} • New endpoint GET /api/v2/asset-scores/zone-protected-asset-score • New endpoint GET /api/v2/clients/management/artifacts/{artifact_id} • New endpoint GET /api/v2/clients/management/available • New endpoint GET /api/v2/clients/{client_id}/artifacts/{artifact_id} • New endpoint GET /api/v2/clients/{client_id}/artifacts/{artifact_id}/download • New endpoint PATCH /api/v2/alert-webhooks/{alert_webhook_id} • New endpoint PATCH /api/v2/alerts/{alert_id} • New endpoint POST /api/v2/alert-attempts/retry • New endpoint POST /api/v2/alert-webhooks • New endpoint POST /api/v2/alert-webhooks/{alert_webhook_id}/rotate-secret • New endpoint POST /api/v2/alert-webhooks/{alert_webhook_id}/test • New endpoint POST /api/v2/alerts • New endpoint POST /api/v2/clients/management/artifacts • New endpoint POST /api/v2/clients/management/artifacts/{artifact_id}/complete • New endpoint POST /api/v2/clients/management/artifacts/{artifact_id}/parts/{part_number} • New endpoint POST /api/v2/clients/management/end • New endpoint POST /api/v2/clients/management/start • New endpoint POST /api/v2/clients/{client_id}/artifacts/{artifact_id}/download-url • New endpoint POST /api/v2/clients/{client_id}/management • GET /api/v2/attack-paths/findings: param is_cross_platform (query) added Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v9.7.0 https://github.com/SpecterOps/BloodHound/releases/tag/v9.7.0 Tue, 08 Sep 2026 16:20:40 GMT BloodHound v9.7.0 adds multi-destination pathfinding, presigned artifact downloads, webhook test dialog, and snackbar alert notifications. • Adds query parameter logging for `/api/v2` requests to improve auditability of API calls. • Adds multi-destination pathfinding with drag-and-drop reordering in the Explore graph. • Adds an attack path selector to the findings table. • Implements presigned artifact downloads. • Adds a support bundle download URL client method. • Adds a webhooks 'run test' dialog for validating webhook configurations. • Wires up notifications and event history tables in the UI. • Adds snackbar alerts for in-app notifications. • Adds `LinesWithMagnifyingGlass` icon and Floating Action Bar copy button icons to the UI icon set. • Tracks Cypher query error metrics. • Adds database support for creating Posture Zone rules via OpenGraph extension management. • Adds artifact expiration cleanup safeguards. • Conditionally creates a default admin account in the harness. • Adds Entity Panel templating support. • Adds `KindInfo` Markdown template validation. • Updates the JS client to support the Zone Protected Asset score endpoint. • Adds keyboard navigation functionality to the UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://bloodhound.specterops.io/openapi.json https://bloodhound.specterops.io/openapi.json Thu, 20 Aug 2026 14:07:15 GMT API surface changed: +3 endpoints, −2 endpoints, 2 modified • New endpoint GET /api/v2/attack-paths/finding-types • New endpoint GET /api/v2/node-kinds/{node_kind_id} • New endpoint GET /api/v2/relationship-kinds/{relationship_kind_id} • PUT /api/v2/custom-nodes/{kind_name}: response schema changed Breaking changes: • Removed endpoint POST /api/v2/clients/management/end • Removed endpoint POST /api/v2/clients/management/start • GET /api/v2/attack-paths/findings: param zone_id (query) removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v9.6.0 https://github.com/SpecterOps/BloodHound/releases/tag/v9.6.0 Tue, 18 Aug 2026 14:56:37 GMT BloodHound v9.6.0 adds management-operation APIs, client artifact endpoints, S3 configuration, a findings severity filter, and webhook table wiring. • Adds `api/v2/relationship-kinds/{relationship_kind_id}` endpoint to retrieve a specific relationship kind by ID. • Adds a new GET node kind endpoint (`BED-8756`) for querying individual node kinds via the API. • Adds queue management operation endpoints for submitting and managing background operations via the API. • Adds a get-available management operation endpoint to discover which operations can be queued. • Adds a download client artifact endpoint (`BED-8091`) for retrieving collector client artifacts via the API. • Adds a delete client artifact endpoint (`BED-8129`) for removing collector client artifacts via the API. • Adds `part_number` support to the artifact upload API for multipart upload handling. • Adds S3 configuration support (`BED-9174`) to enable object-storage-backed artifact handling. • Exposes artifact metadata on management operation responses. • Adds a download client support bundle capability (API endpoint and UI) for pulling diagnostic bundles from managed clients. • Adds a delete client support bundle UI action for removing previously downloaded diagnostic bundles. • Adds a findings table severity filter, enabling practitioners to narrow the Findings Table by severity level. • Adds a new Finding Types endpoint for the Findings Table to retrieve available finding type classifications. • Enables the `opengraph_extension_management` feature flag by default, making OpenGraph extension management available to all users. • Optimizes PostgreSQL graph database wipes for faster data-clearing operations in DB Management. • Optimizes PostgreSQL `source_kind` and relation deletion using database indices for improved performance. • Wires up the webhooks table in the UI, surfacing configured webhook endpoints. • Adds an alert event publisher (`BED-7948`) for emitting events when alert conditions are triggered. • Adds a Findings Prioritization feature flag (`BED-9035`) to gate prioritization workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://bloodhound.specterops.io/openapi.json https://bloodhound.specterops.io/openapi.json Tue, 04 Aug 2026 11:17:56 GMT API surface changed: 22 deprecated Breaking changes: • Deprecated endpoint DELETE /api/v2/custom-nodes/{kind_name} (still works) • Deprecated endpoint DELETE /api/v2/saml/providers/{saml_provider_id} (still works) • Deprecated endpoint GET /api/v2/asset-groups/{asset_group_id}/combo-node (still works) • Deprecated endpoint GET /api/v2/asset-groups/{asset_group_id}/members (still works) • Deprecated endpoint GET /api/v2/clients/{client_id}/completed-tasks (still works) • Deprecated endpoint GET /api/v2/domains/{domain_id}/attack-path-findings (still works) • Deprecated endpoint GET /api/v2/pathfinding (still works) • Deprecated endpoint GET /api/v2/saml (still works) • Deprecated endpoint GET /api/v2/saml/providers/{saml_provider_id} (still works) • Deprecated endpoint GET /api/v2/saml/sso (still works) • Deprecated endpoint GET /api/v2/tasks (still works) • Deprecated endpoint GET /api/v2/tasks/available (still works) • Deprecated endpoint GET /api/v2/tasks/current (still works) • Deprecated endpoint GET /api/v2/tasks/finished (still works) • Deprecated endpoint GET /api/v2/tasks/{task_id} (still works) • Deprecated endpoint GET /api/v2/tasks/{task_id}/log (still works) • Deprecated endpoint POST /api/v2/asset-groups/{asset_group_id}/selectors (still works) • Deprecated endpoint POST /api/v2/clients/{client_id}/tasks (still works) • Deprecated endpoint POST /api/v2/saml/providers (still works) • Deprecated endpoint POST /api/v2/tasks/end (still works) • Deprecated endpoint POST /api/v2/tasks/start (still works) • Deprecated endpoint PUT /api/v2/tasks/{task_id}/cancel (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v9.5.0 https://github.com/SpecterOps/BloodHound/releases/tag/v9.5.0 Tue, 28 Jul 2026 15:05:48 GMT BloodHound v9.5.0 adds OpenGraph data quality stats, webhooks UI, markdown-rich entity panels, and new management operation endpoints. • Adds `/data-quality-stats` endpoint and aggregations endpoint for querying OpenGraph node and relationship counts by environment. • Adds `environment_kind_id` and `environment_kind_display_name` fields to the available-domains API response. • New Webhooks table and webhook details modal on the Delivery Page for managing webhook configurations. • Renders markdown-based KindInfo for OpenGraph extensions directly in the entity panel. • Adds `KindInfo` to the `api/v2/nodes/{node_id}` response and to extension upsert operations. • Adds `?include-info` query parameter to the v2 relationships API to return KindInfo alongside relationship data. • Introduces start and end management operation API endpoints. • Adds `use_raw_object_id` feature flag to control raw Object ID handling and case-sensitive search behavior. • Restricts the UPLOAD_ONLY role from accessing certain views, tightening role-based access control. • Adds `read providers` permission for finer-grained API access control. • OpenGraph Data Quality page now lists aggregations and environments and renders stats and a node-count table. • Rejects older AzureHound collector versions when the `use_raw_object_id` flag is enabled. • Improved focus styling across the UI for accessibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v9.4.0 https://github.com/SpecterOps/BloodHound/releases/tag/v9.4.0 Tue, 07 Jul 2026 14:27:00 GMT BloodHound v9.4.0 adds ADCS ESC14 detection, new graph/relationship APIs, webhook creation, auditor role expansions, and ingest metrics. • Adds ADCS ESC14 Scenario A attack path coverage for certificate-based privilege escalation detection. • New GET `api/v2/relationships/{relationship_id}` endpoint for retrieving individual graph relationship details. • New GET node endpoint (`api/v2/...`) for retrieving individual graph node details. • Introduces webhook creation capability for event-driven alerting integrations. • Adds `data_quality_stats` table and supporting APIs for tracking data quality statistics. • Adds `data_quality_aggregations` table migration to support aggregated data quality reporting. • Expands Auditor role permissions to include SSO configuration page access. • Expands Auditor role permissions to include file ingest visibility. • Adds explicit permissions for managing and reading ingest files. • New queue latency metric for ingest tasks, enabling observability into ingest pipeline delays. • New ingest task counter metric for tracking volume of ingest operations. • Alerts page scaffolding introduced as a new UI surface for future alerting workflows. • Disallows creation of new custom Cypher rules when the query yields no results, preventing misconfigured detections. • Adds a support request bundle button for easier diagnostics submission. • Introduces Variable Analysis Mode pipeline steps for more flexible analysis configurations. • Adds collector file service for downloading collector binaries directly from the platform. • Adds screen reader and accessibility (a11y) support across graph controls and admin pages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v9.3.0 https://github.com/SpecterOps/BloodHound/releases/tag/v9.3.0 Wed, 17 Jun 2026 13:45:01 GMT BloodHound v9.3.0 adds Privilege Zone metrics, richer findings endpoints, full-path highlighting, and JIT Teleport configuration. • Adds Privilege Zone tag-count metrics to surface coverage data for zone management. • Enriches the unified findings endpoint with `zone_name`, `source_principal_name`, `target_principal_name`, environment name, and zone display title fields. • Adds audit log entries for alert webhook activity, improving traceability of alert actions. • Adds an alerts feature flag and dedicated alerts permissions for granular access control. • Includes Extension Namespace in the Extension Object and exposes namespace column in the Object Group management page table. • Introduces JIT Teleport configuration support. • Adds full-path highlight in the graph explorer, visually emphasizing entire attack paths. • Adds toggle for label truncation in the graph UI, letting analysts show or hide full node labels. • Introduces a new Findings Table view for reviewing security findings. • Adds a `collector_support_bundle` feature flag for collector diagnostics. • Creates a new `read auth` permission and implements it for manage pages, enabling finer-grained role control. • Adds a new `alerts` OpenAPI spec, documenting the alerts API surface. • Prepares BloodHound CE for Embedded Extensions. • Adds HTTP request and labeled response size metrics for API observability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v9.3.0 https://github.com/SpecterOps/BloodHound/releases/tag/v9.3.0 Wed, 17 Jun 2026 13:45:01 GMT BloodHound v9.3.0 adds richer findings data, full path highlighting, alerts permissions, JIT Teleport config, and graph label controls. • Adds `zone_name`, `source_principal_name`, and `target_principal_name` fields to the findings endpoint for richer attack path context. • Adds Environment Name and Zone Display Title fields to the Unified Findings endpoint and schema findings table. • New Findings Table UI surface for reviewing security findings directly in the product. • Full Path Highlight feature in the graph explorer visually highlights entire attack paths. • Toggle Label Truncation control lets users expand or collapse truncated node labels in graph views. • Introduces an alerts feature flag and dedicated alerts permissions role for controlling access to the alerting subsystem. • Adds audit log entries for alert webhook events, enabling traceability of alert delivery. • New `collector_support_bundle` feature flag to enable support bundle collection from collectors. • JIT Teleport Configuration support added, enabling just-in-time access integration via Teleport. • Includes Extension Namespace in Extension Objects and surfaces the namespace column on the Object Group management page. • New `read_auth` permission created and implemented for manage pages, enabling finer-grained RBAC. • Adds HTTP request and labeled response size metrics for improved observability. • Privilege Zone metrics now include tag count data. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v9.2.0 https://github.com/SpecterOps/BloodHound/releases/tag/v9.2.0 Thu, 28 May 2026 15:47:46 GMT BloodHound v9.2.0 adds Prometheus metrics, a Findings API, graph DB metrics exposure, and explore page UX improvements. • Adds Prometheus metrics endpoint to the BloodHound CE API for operational monitoring. • Exposes database metrics via a new API endpoint. • Introduces a new Findings API endpoint for programmatic access to security findings. • Adds a type filter parameter to the GET /kinds endpoint for more targeted kind queries. • Adds an eligible roles accordion in the UI for clearer role visibility. • Explore page search results now return and select the matched node directly. • Adds default views and layout option de-selection on the explore page. • Reserves the `tag_` prefix for node and edge kind names. • Upserts to the kinds table, enabling dynamic kind registration. • Swaps to a new database migration system. • Allows direct access to the pgx connection pool for advanced integrations. • Bumps SharpHound collector version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v9.1.0 https://github.com/SpecterOps/BloodHound/releases/tag/v9.1.0 Tue, 05 May 2026 19:46:10 GMT BloodHound v9.1.0 adds PDF attack path exports, AZAddOwner detection, JIT auth token login, IAM RDS auth, and API doc search. • Implements AZAddOwner relationship detection for Azure attack path analysis. • Adds auth token login support for Just-in-Time (JIT) access workflows. • Supports IAM RDS authentication in database connection pooling. • Enables searching the API docs by resource path. • Adds `createdBy` field to auth tokens for improved auditability. • Exports selected columns from the Explore table for targeted data extraction. • Cleans up Cypher saved queries with category and subcategory organization. • Minimizes displayed elements in the UI when multiple nodes are returned by a Cypher query. • Adds node count metric for environment monitoring. • Migrates Owns/WriteOwner and AZ App Role post-processing to the Distributed Computation Architecture (DCA). • Adds Role-Based Filtering Badge on Principal Zone pages to surface access scope at a glance. • Updates accordion collapse and close behavior in the entity panel for improved navigation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v9.0.2 https://github.com/SpecterOps/BloodHound/releases/tag/v9.0.2 Tue, 21 Apr 2026 17:05:46 GMT BloodHound v9.0.2 adds an OpenHound collector download link to the Downloads page. • Adds a link to the OpenHound collector on the Downloads page for easier access to the community collector. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://bloodhound.specterops.io/resources/release-notes/summary#2026-04-21 https://bloodhound.specterops.io/resources/release-notes/summary#2026-04-21 Tue, 21 Apr 2026 00:00:00 GMT BloodHound v9.0.2 expands TLS cipher support and fixes Azure post-processing for PostgreSQL • Expanded the set of supported TLS cipher suites when BloodHound serves HTTPS directly to resolve SharpHound connectivity issues • Added an OpenHound download link to the Download Collectors page Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v9.0.0 https://github.com/SpecterOps/BloodHound/releases/tag/v9.0.0 Mon, 13 Apr 2026 15:47:35 GMT BloodHound v9.0.0 adds API key expiration, JIT opt-out, auditor role expansion, Azure contributor ingestion, and graph UI improvements. • Adds API key expiration support, including expiration parameters and table columns showing expiry status for all keys. • Adds a JIT (Just-in-Time) support account opt-out option so organizations can disable automatic support account provisioning. • Adds a configurable redirect URL for JIT provisioning flows. • Expands the Auditor role with additional access permissions. • Adds ingestion support for AZContributor relationships on Management Groups, Resource Groups, and Subscriptions. • Adds a 'Delete HasSession edges' action to the Database Management interface. • New timeout limit checkbox in the Explore UI to remove query result limits for large graph queries. • Adds drag-and-drop column reordering in the Explore table. • Increases edge and arrow visibility in the graph explorer. • Updates node labels display in the graph. • Generates timestamped filenames for graph exports. • Adds SharpHound collection metrics reporting. • Adds OpenGraph Extension Finding Schemas API endpoint (marked experimental). • Adds OpenGraph Collector Platform (OpenHound) as a recognized client type in the UI and Collector Downloads page. • Ceases creation of Active Directory stub users during Azure ingest post-processing, reducing graph noise. • Adds posture rounding clarity improvements to the Posture page. • Adds support account display filtering in the Users management UI. • Updates the sub-navigation menu in the main navigation. • Improves ingest file naming conventions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v8.9.0 https://github.com/SpecterOps/BloodHound/releases/tag/v8.9.0 Mon, 23 Mar 2026 15:44:59 GMT BloodHound v8.9.0 adds federated identity credential support, audit-log stdout streaming, standalone nodes, API token expiration, and an OpenGraph schema API. • Adds support for Federated Identity Credentials as a new Azure node/relationship type. • New option to stream audit logs to stdout, enabling log-pipeline integrations without file access. • New GetGraphSchemaDisplayKinds API endpoint for querying OpenGraph schema display kinds. • Supports standalone (unconnected) nodes in ingestion — nodes no longer require edges to be persisted. • Supports arbitrary endpoint matching for edge ingest, enabling more flexible OpenGraph data ingestion. • Adds an Expiration column to the API Tokens management UI. • Updates the Explore page Table View with a new ScrollArea component for improved large-dataset navigation. • Container image base updated to Debian 12. • Adds a new reusable payload validator and CLI interface for ingest pipelines. • Updated SimpleEnvironmentSelector to support OpenGraph environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v8.7.0 https://github.com/SpecterOps/BloodHound/releases/tag/v8.7.0 Wed, 04 Mar 2026 16:11:13 GMT BloodHound v8.7.0 adds OpenGraph extension management UI, cancelable analysis runs, column resizing, and API key controls. • Adds OpenGraph extension upload dialog in the UI, allowing users to upload custom graph schema extensions directly from the interface. • Adds delete extension UI flow in OpenGraph Management, enabling removal of custom extensions from within the product. • Adds Upsert Extension endpoint for programmatically creating or updating OpenGraph schema extensions via the API. • Adds Delete Extension endpoint for removing OpenGraph schema extensions via the API. • Adds new validation checks on the Upsert Schema Extension endpoint to enforce correctness of extension definitions. • Adds SourceKind to the DAWGS Kinds table, expanding OpenGraph schema metadata. • Adds Source Kind Deactivation support in the Schema Service. • Adds a migration for the OpenGraph Findings list findings table. • Enables table view column resizing in the UI for more flexible data exploration. • Enables cancellation of a queued analysis run from the Scheduled Analysis interface. • Allows the `analysis.scheduled` parameter to be updated directly from the UI, removing the need for manual config changes. • Adds a new `scheduled_analysis_configuration` feature flag to gate scheduled analysis configuration controls. • Adds a new `opengraph_collector_platform_support` feature flag for OpenGraph collector platform support. • Adds API key disablement support in the auth middleware, allowing API keys to be disabled without deletion. • Adds an API-level check enforcing constraints on removal of API keys. • Deletes all auth tokens on startup to enforce clean session state. Breaking changes: • All existing auth tokens are deleted on startup; any sessions or integrations relying on persisted auth tokens will be invalidated after upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v8.6.0 https://github.com/SpecterOps/BloodHound/releases/tag/v8.6.0 Wed, 11 Feb 2026 20:15:34 GMT BloodHound v8.6.0 adds OpenGraph management, Integrated Windows Auth, Entra ID last-logon data, and scheduled analysis improvements. • Adds OpenGraph Management admin page for managing OpenGraph nodes, relationships, and extensions via the UI. • Adds OpenGraph nodes to the shortest-path endpoint, enabling cross-graph pathfinding. • Adds OpenGraph edge filtering in the UI to control which relationship types are displayed. • Supports OpenGraph remediations, surfacing remediation guidance for OpenGraph findings. • Adds a Get Extension Information endpoint for querying schema extension details. • Adds namespace support to schema extensions via the API. • Generates AD and Azure extension schemas automatically and applies them on startup. • Adds a new app configuration field to disable API keys globally. • Adds support for bypassing query limits when the `prefer:wait=-1` header is provided. • Adds Integrated Windows Authentication (IWA) support in the frontend. • Adds Last Logon Timestamp as a property on Entra ID (AzureAD) User nodes. • Displays zone information in the object info panel for graph nodes. • Adds file ingest warnings directly to the file ingest table. • Supports an 'Analyze Now' trigger for scheduled analysis. • Adds scheduled analysis as a user-updatable parameter. • Adds a finding resource and type to the API client. • Adds literal values to unified graph responses. • Reworks Local Group post-processing logic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v8.5.1 https://github.com/SpecterOps/BloodHound/releases/tag/v8.5.1 Tue, 27 Jan 2026 16:05:44 GMT BloodHound v8.5.1 reworks Local Group post-processing for more accurate AD attack path analysis. • Reworks Local Group post-processing pipeline to improve accuracy of local group membership attack path data. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v8.5.0 https://github.com/SpecterOps/BloodHound/releases/tag/v8.5.0 Thu, 22 Jan 2026 17:43:32 GMT BloodHound v8.5.0 adds OpenGraph node/edge searchability, schema extension CRUD APIs, kind filtering, and new Privilege Zones UI improvements. • OpenGraph nodes are now searchable on the Explore page. • Explore search results now return custom node icon data for OpenGraph nodes. • New API endpoint to retrieve OpenGraph edge kinds. • Full CRUD database methods for OpenGraph schema extensions (extensions, node kinds, edge kinds, and properties). • OpenGraph schema extension migrations added. • Kind filtering added to the `asset-group-tags/{id}/selectors/{id}/members` API endpoint. • Asset group tag ID filtering added to the Global Search API. • Filter support added to the `GET /asset-group-tag/:id/members` endpoint. • Selector type counts added to `GET /api/v2/asset-group-tags`. • Kind count breakdown added to the Selectors API. • Adds `hygiene_attack_paths` count to the domains endpoint. • New `DisableTimeoutLimit` property added to application configuration. • Source Kind now supports deactivation and re-activation instead of hard deletion. • Far-reaching accessibility improvements across the UI. • Table view sort arrows are now always visible. • Processing indicator added to the UI for in-progress operations. • "Run" button now shows a visual 'running' status while a query is executing. • Complete schema environments CRUD implemented. • Basic schema relationship findings CRUD implemented. • Objects Accordion and Details Rules display redesigned in the details panel. • Privilege Zones selected details tabs added. • Citrix RDP support enabled via `analysis.citrix_rdp_support` configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v8.4.0 https://github.com/SpecterOps/BloodHound/releases/tag/v8.4.0 Tue, 02 Dec 2025 16:34:02 GMT BloodHound v8.4.0 adds an Auditor role, exposure values in Domain Selectors, Prometheus ingest metrics, and reworked Citrix CanRDP analysis. • Adds a new Auditor role for read-only audit access to the platform. • Adds exposure values to Domain Selectors for at-a-glance risk visibility. • Adds icons to the object count panel in Attack Graph Tool for faster object-type identification. • Adds Prometheus metrics for ingest throughput, enabling observability of data pipeline performance. • Exposes product edition in the VersionResponse API endpoint. • Allows SSO admins to disable MFA for individual users. • Adds environment filter capability to selector views. • Adds support for OR behavior across multi-filter conditions in selectors. • Reworks Citrix CanRDP analysis logic for more accurate privilege path detection. • Sets 'initial only' as the default certification when using Quick Add to create a selector. • Enables analysis descriptions to be displayed in the UI. • Adds vulnerability scanning to the CI/CD pipeline. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v8.3.0 https://github.com/SpecterOps/BloodHound/releases/tag/v8.3.0 Thu, 30 Oct 2025 16:41:26 GMT BloodHound v8.3.0 adds Privilege Zone history, ingest file retention controls, ADCS ESC6 improvements, and new AD/Azure graph properties. • Adds a History View for Privilege Zones, letting analysts track how zone membership has changed over time. • Adds a rolling asset group history window for tracking asset group changes over a configurable time range. • Adds API controls for retaining ingest files after processing, with a configurable default retention setting. • Adds a zone glyph selector for visually distinguishing Privilege Zones in the UI. • Adds a certification zone filter to GET certified members, scoping results to only certification-required zones. • Adds a File Ingest details panel and filter modal for inspecting and filtering ingested data files. • Adds the `netlogon` DC property to Domain Controller nodes for richer AD enumeration data. • Adds the GPO Status property with human-readable resolution to Group Policy Object nodes. • Adds service principals as supported principals in the `AZAddMembers` edge, expanding Azure attack path coverage. • Improves ADCSESC6 post-processing for more accurate ESC6 attack path detection. • Expands the `AdminSDHolderProtected` property into `ProtectAdminGroups` graph relationships for richer AdminSDHolder visibility. • Replaces ACLs display text with ACEs terminology in the Data Quality view for accuracy. • Adds a Summary Page to BloodHound Community Edition (BHCE). • Adds scroll support to the simple domain selector for environments with many domains. • Bumps SharpHound and AzureHound collector versions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v8.2.0 https://github.com/SpecterOps/BloodHound/releases/tag/v8.2.0 Tue, 23 Sep 2025 16:18:56 GMT BloodHound v8.2.0 adds ADCS pathfinding, saved query sharing, audit logging, job filtering, and new asset group tag capabilities. • Adds History Search API endpoint for querying past search activity. • Adds accordion detail panels for ADCS nodes in the graph explorer. • Updates built-in ADCS saved searches with improved coverage. • Adds `DCFor` edge type to the pathfinding relationship filter. • Makes `ManageCA` and `ManageCertificate` edges traversable in pathfinding. • Adds a `kinds` array to graph node API responses for richer type information. • Adds environment filter support to the `/selectors/:selectorId/members` API endpoint. • Adds member filtering per environment in the Priority Zone details page. • Adds filter dialog to the Finished Jobs log for narrowing ingestion history. • Adds Status and DataCollected filters to the Finished Jobs table. • Adds date range picker inputs to the Finished Jobs table for time-scoped filtering. • Adds tag glyph indicators on asset group tag items in the UI. • Adds new config option to enable or disable user analytics collection. • Adds Certify/Revoke Certification API for objects. • Adds List Certifications API endpoint. • Adds client type field to the Client API. • Adds a new Get Users Minimal API endpoint for lightweight user lookups. • Introduces a dynamic Content Security Policy (CSP) via API configuration. • Introduces `force_download_embedded_collectors` configuration option to force collector downloads. • Adds `sort_by` and environment filtering support to the `/asset-group-tags/:assetGroupTagId/selectors` endpoint and selectors list UI. • Adds saved query sharing: queries can be set to public and shared with specific users. • Persists saved query filters across sessions. • Adds delete confirmation modal for saved queries. • Adds a stale clients parameter for client management. • Bumps SharpHound bundled collector to v2.7.2. • Hides the manual upload button for users who lack upload permissions. • Refreshes BloodHound application icon and logos. • Adds Release Audit proof-of-concept feature for tracking release events. • Adds comma-separated number formatting to large numeric displays in the UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v8.1.1 https://github.com/SpecterOps/BloodHound/releases/tag/v8.1.1 Tue, 02 Sep 2025 16:51:31 GMT BloodHound v8.1.1 adds file logging support. • Enables file logging so BloodHound output can be persisted to disk for audit and troubleshooting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v8.1.0 https://github.com/SpecterOps/BloodHound/releases/tag/v8.1.0 Tue, 26 Aug 2025 17:11:01 GMT BloodHound v8.1.0 adds new saved-query APIs, AGT history filtering, ingest error details, and .deb packaging for Kali-style installs. • New `Get SavedQuery` API endpoint for retrieving individual saved Cypher queries. • New `GetSavedQueryPermissions` API endpoint for inspecting sharing/permissions on saved queries. • New `GetAllAttackPathFindings` API endpoint now accepts an Asset Group parameter for scoped attack-path results. • New API endpoint for file-level ingest error details, enabling per-file troubleshooting of ingestion failures. • Adds infinite-scrolling pagination to selectors and members lists on the Zone Management details page. • Adds an 'Analyze Now' button for on-demand graph analysis. • Adds a history filter dialog to the AGT (Asset Group Tagging) view for filtering tagging history entries. • AGT now records a history entry for auto-certification events during node tagging. • Adds denormalized property fields to the AGT selector nodes table. • Adds custom icon support for Asset Group Tags (AGTs). • Adds an 'X' button to the entity panel header to dismiss the selected item. • Adds an `environment` parameter to Privilege Zone member endpoints for environment-scoped queries. • Abuse info and GoldenCert attack guidance updated to Certify 2.0 commands. • Allows nullable NTLM registry values ingested from SharpHound. • Explore table now supports column sort state persistence. • Reworked Finished Jobs Log table UI. • Debian (.deb) package added for direct installation on distributions such as Kali Linux. • Bundles AzureHound 2.7.1. • Adds disabled-tier icons to the Privilege Zones UI. • AD special identities updated with expanded coverage. Breaking changes: • The `timezone` setting has been removed from the configuration file because the container image no longer supports it; any existing configuration referencing this setting will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v8.0.0 https://github.com/SpecterOps/BloodHound/releases/tag/v8.0.0 Tue, 29 Jul 2025 16:47:09 GMT BloodHound v8.0.0 adds ACL inheritance pathfinding, Explore table view, forest trust selectors, and database deletion by source kind. • Adds ACL inheritance pathfinding and a dropdown UI for visualizing ACL inheritance chains. • Adds an Explore graph data table with column management, row selection, JSON download, and copy-cell-to-clipboard support. • Adds an 'Incoming Forest Trust Builders' selector for cross-forest trust analysis. • Adds a Search Asset Group Tags API endpoint. • Adds a Single Findings API endpoint. • Adds an ACL inheritance API endpoint. • Adds deletion by source kind in Database Management. • Adds `source_kind` field to the OpenGraph schema. • Adds `IsReadOnlyDC` computer attribute ingestion. • Supports `HasSIDHistory` on Group objects. • AGT Selectors endpoint now supports pagination. • AGT history now records analysis enabled/disabled actions. • Tiering list now records history entries. • Adds visual icon indicator for disabled tiers in the Explore UI. • Bundles SharpHound v2.7.0. Breaking changes: • The AGT history endpoint has been renamed (see BED-6280); existing integrations or bookmarks using the old endpoint path will break. • Power users no longer have app config permissions; any workflow relying on power users reading or writing app config will stop working. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v7.6.0 https://github.com/SpecterOps/BloodHound/releases/tag/v7.6.0 Wed, 09 Jul 2025 16:08:14 GMT BloodHound v7.6.0 adds multi-tier analysis, Azure PIM/role coverage, a table view in Explore, and custom query import/export. • Adds multi-tier analysis support for Asset Group Tags (AGT), enabling tiered attack path analysis beyond Tier Zero. • Adds `AZRoleApprover` edge to model Azure PIM role approval relationships for post-processing. • Adds `AZRoleEligible` edge expansion for Tier Zero tagging, capturing eligible Azure role principals. • Adds `KindAZRoleEligibilityScheduleInstance` to Azure converters for richer PIM data ingestion. • Adds a table view in the Explore tab for browsing nodes and edges in a structured, sortable format. • Adds a summary view in the Explore tab for quick environmental overviews. • Adds an `analysis_enabled` flag to asset group tags, allowing per-tag analysis toggling. • Adds a Zone Management default view for managing security zones. • Retires the 'Automatically add parent OUs and containers of Tier Zero AD objects to Tier Zero' Early Access setting, with Tier Zero expansion now handled by the Asset Group Tag engine. • Requires AzureHound collector v2.6.0 for full Azure data collection compatibility. Breaking changes: • The 'Automatically add parent OUs and containers of Tier Zero AD objects to Tier Zero' Early Access setting is retired and no longer functional; Tier Zero OU/container expansion is now handled exclusively by the Asset Group Tag engine. • This release requires AzureHound v2.6.0; older collector versions will not be fully supported. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v7.5.0 https://github.com/SpecterOps/BloodHound/releases/tag/v7.5.0 Tue, 17 Jun 2025 14:11:43 GMT BloodHound v7.5.0 adds HasTrustKeys edge, Azure role ingest, custom node icons, zone-based tier management, and search highlight/zoom. • Adds new `HasTrustKeys` edge type for modeling Active Directory trust key relationships in the graph. • Ingests `AZRoleManagementPolicyAssignment` objects from Azure, expanding Azure attack path coverage. • Supports custom node icons in the UI for Generic Ingest custom node types. • Adds Create, Update, and Delete Tier/Zone APIs and UI controls for zone-based tier management. • Adds `analysis.tiering` parameter to application configuration for controlling tiering analysis behavior. • Highlights and zooms the graph view when using Search Current Nodes on the Explore page. • Displays node type in the Entity Panel for clearer node identification. • Adds in-product help text for the `AZRoleApprover` edge. • Updates Generic Ingest API with finalized JSON schema and Swagger documentation. • Bundles latest AzureHound release. • Adds `Created_by` / `Updated_by` fields using email instead of user ID for better auditability. • Adds a hounds (collectors) downloads API spec. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v7.4.0 https://github.com/SpecterOps/BloodHound/releases/tag/v7.4.0 Tue, 27 May 2025 17:52:48 GMT BloodHound v7.4.0 adds tiering/selector engine, custom node kinds for generic ingest, Azure role eligibility, and new tiering management APIs. • Adds selector engine for Asset Group Tiering (AGT), enabling automated membership calculation via configurable selectors. • Adds create/edit selector page in the UI for defining tier membership selectors. • Adds disabled selector badges in the tiering UI to visually indicate inactive selectors. • Adds tabs for tier management in the UI. • Adds `/selector-preview` endpoint to preview selector results before committing. • Adds `GET /selector/:selectorId` endpoint to retrieve a specific selector's details. • Adds API endpoint to list all objects from a tier/label. • Adds API endpoint to list all objects from a specific selector. • Adds `counts` query parameter to tier/label membership endpoints to return member counts. • Adds `GET` tier/label list endpoint for programmatic enumeration of tiers and labels. • Adds member info retrieval with selectors list. • Adds email column to AssetGroupHistory for improved audit tracking. • Adds custom node kinds support in the Generic Ingest pipeline. • Adds schema validation for the generic ingest pipeline. • Adds ingest support for AzureRoleEligibilityScheduleInstance objects. • Adds edge panels for AZRoleEligible edges in the UI. • Enables deep linking as a generally available feature. • Updates permissions required to interact with the database management component. • Replaces the `TrustedBy` relationship with a reworked implementation affecting common searches and AGT queries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v7.3.0 https://github.com/SpecterOps/BloodHound/releases/tag/v7.3.0 Tue, 22 Apr 2025 15:56:39 GMT BloodHound v7.3.0 adds NTLM relay attack paths, GPOLocalGroup ingestion, new tiering selectors, and a list-kinds API endpoint. • Adds CoerceAndRelayNTLMtoADCS relay target detection, surfacing NTLM coercion-to-ADCS attack paths in the graph. • Promotes NTLM attack path analysis to general availability (GA). • Adds ingestion of GPOLocalGroup data, enabling BloodHound to map local group membership configured via Group Policy. • New 'list kinds' API endpoint (`/api/v2/graph/kinds` or similar) exposes all known node and edge kinds programmatically. • New asset management page in the UI for managing tiered assets. • Adds create and update selector workflows for tier management, including a Cypher-based selector component. • New API endpoint to retrieve member counts per asset group tag (`/member/counts`). • Adds API contract for tier/label details. • Clicking a node in the Edge Composition or Relay Targets panel now performs a single-node search directly in Explore. • Attack Path Findings now include a direct link to the Explore view for investigated paths. • Sets sequential layout as the default graph layout in Explore. • Adds help text for `OwnsRaw` and `WriteOwnerRaw` edges in the entity panel. Breaking changes: • `FileUploadJob` is renamed to `IngestJob` — any integration or tooling referencing `FileUploadJob` by name will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v7.2.1 https://github.com/SpecterOps/BloodHound/releases/tag/v7.2.1 Thu, 03 Apr 2025 15:51:11 GMT Adds `HTTPEnrollmentEndpoints` ingestion and 64-bit support for edge relay and composition queries. • `HTTPEnrollmentEndpoints` are now ingested as new node types • `GetEdgeRelayTargets` returns results using 64-bit integers • `GetEdgeComposition` parses node IDs into 64-bit integers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v7.2.0 https://github.com/SpecterOps/BloodHound/releases/tag/v7.2.0 Tue, 25 Mar 2025 17:06:07 GMT BloodHound v7.2.0 adds deep linking across all search modes, new ADCS/NTLM relay attack paths, and bidirectional shortest-path for PostgreSQL. • Adds deep linking for node search, pathfinding search, Cypher search, composition/relationship queries, and node context menu — shareable URLs now encode full graph exploration state. • Supports `selectedItem` and `expandedPanelSections` URL query parameters so specific nodes and open panel sections are preserved in shared links. • Supports deep linking for the selected environment, keeping domain/tenant context in the URL. • Supports Export Graph data functionality via deep linking. • Adds `back_button_support` feature flag, letting users enable or disable browser back-button navigation within the graph UI. • Adds plumbing for CA Enrollment Endpoints (CoerceToADCS) attack path edges. • Adds `CoerceAndRelayNTLMToSMB` composition-to-relay-targets attack path, showing SMB relay chains in pathfinding. • Adds `LimitedRights` edges to the pathfinding filter options. • Implements bidirectional BFS for shortest-path (SP/ASP) queries on PostgreSQL backends, improving performance for large environments. • Removes self-relay from SMB and LDAP(S) relay attack path logic, reducing false-positive paths. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v7.1.0 https://github.com/SpecterOps/BloodHound/releases/tag/v7.1.0 Fri, 07 Mar 2025 17:13:17 GMT BloodHound v7.1.0 adds NTLM relay attack paths, reworked Owns/WriteOwner edges, and new ADCS coercion post-processing. • Adds post-processing for CoerceAndRelayNTLMtoADCS attack paths, surfacing NTLM relay routes to AD CS targets. • Adds post-processing for CoerceAndRelayNTLMToLDAP(S) attack paths, with abuse details and relay-target composition. • Adds pre-built saved queries for NTLM relay attack paths. • Reworks Owns/WriteOwner edge logic (BED-4965), replacing OwnsRaw and WriteOwnerRaw with updated ACL relationship model. • Adds ingestion support for NTLM relay data to populate new NTLM relay edges. • Adds the `back_button_support` feature flag for browser back-button navigation within the UI. • Adds the `tier_management_engine` feature flag gating the new tier management engine. • Enforces SSO role-provisioning changes on every login, not just the first. • Enables recreating the default admin user via environment variable. • Adds client-side UI controls disabling for read-only users. • Includes the Direct Access Users group in collection and post-processing. Breaking changes: • The `highvalue` property is removed from the graph schema; any queries or workflows relying on the `highvalue` field will break. • `OwnsRaw` and `WriteOwnerRaw` are removed from ACLRelationships; tooling or queries referencing these relationship types will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v7.0.0 https://github.com/SpecterOps/BloodHound/releases/tag/v7.0.0 Wed, 05 Feb 2025 17:44:09 GMT BloodHound v7.0.0 adds CoerceAndRelayNTLMToSMB detection, a new vertical nav, Cypher shortcuts, and expanded posture/findings APIs. • Adds post-processing and exploitation information for the CoerceAndRelayNTLMToSMB attack path edge. • Introduces Cypher query shortcut helpers in the UI to speed up graph query authoring. • Redesigns navigation with a new vertical nav bar, including collapsible state and integrated collector downloads. • Adds a 'No Data' alert to surface missing collection data directly in the UI. • Adds `display_title` and `display_type` fields to the `finding-trends` API endpoint. • Introduces aggregated risk and posture data view on the Posture page. • Adds impact/exposure data to findings on the Posture page. • Applies consistent Kerberoastable exclusions across relevant attack path queries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v6.4.0 https://github.com/SpecterOps/BloodHound/releases/tag/v6.4.0 Tue, 14 Jan 2025 19:56:37 GMT BloodHound v6.4.0 adds SSO auto-provisioning with role mapping and multi-sort support for the /details API. • Adds auto-provisioning support to the SSO auth flow, allowing users to be automatically created on first SSO login. • Adds role provisioning support for SSO providers, enabling automatic role assignment based on SSO identity provider attributes. • Adds configurable SSO provider options, giving administrators more control over SSO provider configuration. • Enables the `GET /details` API to accept multiple `sort_by` query parameters simultaneously. • Updates default Tier Zero asset group membership (removes DnsAdmins from default Tier Zero). • Adds backend redirect logic to send users back to the UI with a meaningful error when SSO login fails. Breaking changes: • The Create SAML Endpoint API is deprecated in this release. • Requires SharpHound v2.5.13; earlier collector versions are not supported with this release. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v6.3.0 https://github.com/SpecterOps/BloodHound/releases/tag/v6.3.0 Wed, 11 Dec 2024 17:18:46 GMT BloodHound v6.3.0 adds CoerceToTGT edge, a revamped Posture page, OIDC SSO support, graph label toggling, and more default Tier Zero nodes. • Adds new `CoerceToTGT` attack edge for modeling Kerberos TGT coercion paths in Active Directory graphs. • Enables the updated Posture page with a new date-range selector and supporting API implementation for tracking security posture over time. • Enables OIDC as a supported SSO provider type, including callback URI display in OIDC provider details. • Adds a PATCH endpoint to update existing SSO providers, plus UI support for editing SSO provider configurations. • Adds ability to download the SAML signing certificate directly from the UI. • Expands the default set of Tier Zero (T0) nodes for more comprehensive high-value asset coverage. • Adds toggle labels option to show or hide node/edge labels in the graph explorer. • Publishes OpenAPI specs for Add, Create, List, and Update SSO provider endpoints, and for the Posture and Findings APIs. • Updates bundled SharpHound collector to v2.5.9. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v6.2.0 https://github.com/SpecterOps/BloodHound/releases/tag/v6.2.0 Thu, 14 Nov 2024 17:26:10 GMT BloodHound v6.2.0 adds OIDC authentication support, a unified SSO admin UI, and more accurate Kerberoastable detection. • Adds OIDC provider support with login and callback handlers, enabling OpenID Connect as an authentication method alongside SAML. • New API endpoint to list OIDC providers, with backward-compatible unified `ListAuthProviders` endpoint covering both SAML and OIDC. • New SSO provider delete API endpoint for programmatic removal of SSO configurations. • Adds instant redirect to the identity provider when only one SSO provider is configured, streamlining the login flow. • Refactors the SAML admin UI into a unified SSO admin UI supporting both SAML and OIDC providers. • Adds audit logging for SAML authentication attempts. • New permission scope for `RoleUploadOnly` to restrict upload-only role access more granularly. • GMSA and MSA accounts are now correctly excluded from Kerberoastable detections, reducing false positives. • Adds a Posture page (behind a feature flag), surfacing new attack surface visibility capabilities. • Adds API endpoint structure for the Posture page in the JS client. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v6.1.0 https://github.com/SpecterOps/BloodHound/releases/tag/v6.1.0 Tue, 22 Oct 2024 15:42:24 GMT BloodHound v6.1.0 adds OIDC provider registration and scheduled analysis runs. • New OIDC Provider endpoint and API registration support, enabling external identity provider integration. • New Scheduled Analysis feature, allowing graph analysis to be triggered automatically on a schedule. • Updated impact table for the Butterfly attack path view. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v6.0.0 https://github.com/SpecterOps/BloodHound/releases/tag/v6.0.0 Mon, 30 Sep 2024 16:45:02 GMT BloodHound v6.0.0 adds Citrix RDP analysis, expanded ADCS abuse info, OIDC feature flag, dark mode on by default, and prune TTL support. • Adds Citrix CanRDP post-processing and a Citrix RDP Configuration UI for analyzing Citrix-based remote access paths. • Adds abuse info for generic ACL edges against ADCS nodes, improving ADCS attack-path guidance. • Expands ESC9b and ESC10b abuse info with improved detail for certificate-based attack paths. • Adds more general abuse info entries for additional edge types. • Introduces `SchannelAuthenticationEnabled` property support, enabling detection of Schannel-based authentication configurations. • Adds support for prune TTLs and moves the reconciliation feature flag to parameters, enabling data lifecycle management. • Adds `preMigrationDaemons` support for running pre-migration tasks during startup. • Introduces a feature flag for the OIDC initiative, laying groundwork for OpenID Connect authentication. • Enables dark mode by default and removes the dark mode feature flag toggle. • Grants `SavedQueriesRead` permission to the ReadOnly role, allowing read-only users to access saved queries. • Normalizes files to UTF-8 when extracting ZIP files during ingest, broadening compatibility with non-ASCII data sources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v5.15.0 https://github.com/SpecterOps/BloodHound/releases/tag/v5.15.0 Tue, 10 Sep 2024 16:03:04 GMT BloodHound v5.15.0 adds owned-object visuals, auto-T0 tagging, Write gPLink abuse detection, and new saved-query sharing APIs. • Adds visual representation of owned objects directly in the graph UI. • Automatically tags Tier 0 parent objects, reducing manual classification work. • Detects Write gPLink abuse as a new attack path edge. • Introduces the `LoginURL` Azure AD property for app objects. • Collects additional Active Directory properties for richer node data. • Removes `CanAbuse` edges, replacing them with more specific relationships. • Adds a saved-query update endpoint (PUT/PATCH for existing saved queries). • Adds a saved-query share endpoint to share queries with other users. • Adds a saved-query unshare endpoint to revoke sharing. • Adds a `~eq` case-insensitive string equality predicate for API filtering. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v5.14.0 https://github.com/SpecterOps/BloodHound/releases/tag/v5.14.0 Tue, 20 Aug 2024 15:42:55 GMT BloodHound v5.14.0 expands OpenAPI spec coverage, adds AIACA nodes in CA chains, and improves Saved Cypher with description fields. • Adds AIACA nodes to the certificate authority chain graph, improving PKI attack path visibility. • Adds a description field to Saved Cypher queries for better organization and documentation. • Expands OpenAPI spec to cover auth/user, grapher, cypher, search, data, analysis, and group entity endpoints. • Adds UI permission gating for asset group edits, restricting modifications to authorized users. • Adds audit log entries for failed auth token deletion events. • Adds support for Entra devices with unsupported operating systems as graph nodes. • Adds default query result limits to all graph queries to improve stability at scale. • Introduces Cypher-to-PgSQL generic translation layer, enabling broader PostgreSQL backend support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v5.13.0 https://github.com/SpecterOps/BloodHound/releases/tag/v5.13.0 Thu, 01 Aug 2024 17:33:56 GMT BloodHound v5.13.0 adds dark mode, hybrid path analysis, DCSync group shortcutting, and live datapipe status exposure. • Adds dark mode UI theme across the application, including updated Copy menu palette support. • Introduces hybrid path edge post-processing and edge panels for cross-environment attack path analysis. • Adds DCSync group shortcutting to accelerate DCSync-related attack path calculations. • Exposes live datapipe status via the tool API, enabling real-time ingest pipeline monitoring. • Returns partial failure details when ingesting zip files, so practitioners can see which entries failed without losing the whole ingest. • Displays server version on the profile page. • Supports negative numbers in Cypher queries. • Expands OpenAPI (OAPI) spec coverage to include entity path endpoints for User, Computer, Domain, GPO, OU, Base, Azure, and Meta entities. • Bumps SharpHound to v2.5.4. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v5.12.0 https://github.com/SpecterOps/BloodHound/releases/tag/v5.12.0 Wed, 17 Jul 2024 17:40:02 GMT BloodHound v5.12.0 enforces unique Asset Group name tags and adds group shortcutting for SyncLAPSPassword post-processing. • Enforces uniqueness of Asset Group name tags, preventing duplicate AG names across the environment. • Adds group shortcutting to SyncLAPSPassword post-processing, expanding attack-path coverage for LAPS-related edges. • Adds entity query responses and bh-graph models to the OpenAPI specification, broadening API documentation coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v5.11.0 https://github.com/SpecterOps/BloodHound/releases/tag/v5.11.0 Mon, 17 Jun 2024 16:03:33 GMT BloodHound v5.11.0 adds FedRAMP EULA flag, API timeout removal, asset group members view, and password update requirement. • `feat: require current password to update password` enforces the existing password during updates. • Display members of custom asset groups on Group Management screen • Add FedRAMP EULA feature flag by `BED-4391` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v5.10.0 https://github.com/SpecterOps/BloodHound/releases/tag/v5.10.0 Tue, 28 May 2024 17:34:05 GMT Bloodhound v5.10.0 adds configurable Cypher controls, audit logs for mutations, and parameter parsing • Adds support for configuring `CypherControls` via configuration to control query execution limits. • Adds the `MERGE` clause to supported Cypher queries for graph mutation operations. • Adds a new complexity measurement system for Cypher graph mutations to help evaluate query cost before execution. • Adds audit logs that record all graph mutation attempts by users for security tracking. • Adds parameter parsing support in the Cypher frontend, enabling dynamic values in Cypher queries. • Enables obtaining object information even if the type is not in the schema by funneling localgroups and localusers through the Base entity endpoint. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v5.9.0 https://github.com/SpecterOps/BloodHound/releases/tag/v5.9.0 Thu, 09 May 2024 18:17:33 GMT BloodHound v5.9.0 adds ESC2 pre-defined query, OpenAPI schema updates, RoleSeparationEnabled property, and Issuance Policy Entity Panel • `feat: add ESC2 pre-defined query` enables a new built-in query for ESC2 attack paths. • `feat: add RoleSeparationEnabled property` adds a new capability/property related to role separation logic. • `feat: post process AZAddSecret edges from roles instead of principals` changes the source of AZAddSecret edge composition to roles, unlocking role-based Azure attack path analysis. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound https://github.com/SpecterOps/BloodHound/releases/tag/v5.8.1 https://github.com/SpecterOps/BloodHound/releases/tag/v5.8.1 Mon, 15 Apr 2024 16:11:13 GMT BloodHound v5.8.1 adds `--risk-exposure-calc` flag for risk exposure calculations and default ESC.13 schema support. • Adds ESC.13 attack path edges to AD schema, enabled by default in pathfinding • Adds IssuancePolicy nodes and edge information to the data ingest pipeline and UI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bloodhound