attack_paths
Query BloodHound Enterprise to retrieve attack path findings, trends, and types, and manage risk acceptance for identified attack paths.
Instructions
Query BloodHound Enterprise attack path data.
info_type options:
domain_findings - export attack path findings for a domain (needs: domain_id)
finding_trends - list attack path finding trends
types - list all attack path types
start_analysis - start attack path analysis
details - get all attack path findings with details
domain_available_types - list attack path types available in a domain (needs: domain_id)
domain_details - list attack path details for a domain (needs: domain_id)
domain_sparkline - list attack path sparkline values for a domain (needs: domain_id)
acceptance - update attack path risk acceptance (needs: attack_path_id, acceptance_json)
args:
info_type: what to retrieve or update (default: details)
domain_id: Domain object ID for domain-scoped attack path endpoints
attack_path_id: Attack path finding ID for risk acceptance
acceptance_json: JSON string or object accepted by the BHE risk acceptance API
finding_name: Case-insensitive filter for finding/type/name fields
source_name: Case-insensitive filter for source fields
target_name: Case-insensitive filter for target fields
environment_id: Case-insensitive filter for environment/domain fields
accepted: Filter findings by accepted/risk acceptance state
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| accepted | No | ||
| domain_id | No | ||
| info_type | No | details | |
| source_name | No | ||
| target_name | No | ||
| finding_name | No | ||
| attack_path_id | No | ||
| environment_id | No | ||
| acceptance_json | No |