cypher_query
Run and manage Cypher queries in BloodHound, including interpreting natural language, validating, saving, sharing, and exporting queries for attack path analysis.
Instructions
Execute and manage Cypher queries in BloodHound.
info_type options:
run - execute a cypher query (needs: query; optional: include_properties)
interpret - interpret a natural language query into cypher (needs: query, result_json)
list_saved - list saved queries (optional: name, skip, limit)
create_saved - save a new query (needs: name, query)
get_saved - get details of a saved query (needs: query_id)
update_saved - update an existing saved query (needs: query_id; optional: name, query, description)
delete_saved - delete a saved query (needs: query_id)
share_saved - share a saved query with other users (needs: query_id; optional: user_ids, public)
saved_permissions - get saved query permissions (needs: query_id)
export_saved - export a saved query (needs: query_id)
import_saved - import saved queries (needs: payload_json)
export_saved_many - export saved queries (optional: query_ids)
validate - validate a cypher query for syntax and semantics (needs: query)
args:
info_type: Operation to perform
query: Cypher query string (for run, create_saved, update_saved, validate)
include_properties: Include node/edge properties in results (for run, default: True)
name: Query name (for create_saved, update_saved, list_saved filter)
query_id: Saved query ID (for get_saved, update_saved, delete_saved, share_saved)
result_json: JSON result string from a previous run (for interpret)
description: Query description (for update_saved)
user_ids: Comma-separated user IDs to share with (for share_saved)
query_ids: Comma-separated saved query IDs to export
payload_json: JSON string/object for saved query import
public: Make query public (for share_saved, default: False)
limit: Max results (default 100)
skip: Pagination offset (default 0)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| skip | No | ||
| limit | No | ||
| query | No | ||
| public | No | ||
| query_id | No | ||
| user_ids | No | ||
| info_type | Yes | ||
| query_ids | No | ||
| description | No | ||
| result_json | No | ||
| payload_json | No | ||
| include_properties | No |