graph_analysis
Analyze BloodHound graph data to discover shortest attack paths, search for nodes, decompose edge relationships, and find valid NTLM relay targets.
Instructions
Perform graph analysis operations in BloodHound
info_type options:
kinds - list graph node and edge kinds
search - search for nodes by name (needs: query; optional: search_type)
shortest_path - find shortest attack path between two nodes (needs: start_node, end_node; optional relationship_kinds)
edge_composition - decompose a complex edge into underlying relationships (needs: source_node, target_node, edge_type)
relay_targets - find valid NTLM relay targets for a given node (needs: source_node, target_node, edge_type)
pathfinding - get pathfinding result (optional: start_node, end_node, relationship_kinds)
acl_inheritance - get ACL inheritance path (needs: source_node, target_node)
args:
info_type: what type of graph operation to perform (required)
query: search text (for search)
search_type: type of search - fuzzy (default) or exact (for search)
start_node: Object ID of source node (for shortest_path)
end_node: Object ID of target node (for shortest_path)
source_node: Object ID of source node (for edge_composition and relay_targets)
target_node: Object ID of target node (for edge_composition and relay_targets)
edge_type: Realtionship type like "MemberOf", "AdminTo", (for edge_composition and relay_targets)
relationship_kinds: Comma-separated relationship filter (for shortest_path, optional)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| end_node | No | ||
| edge_type | No | ||
| info_type | Yes | ||
| start_node | No | ||
| search_type | No | fuzzy | |
| source_node | No | ||
| target_node | No | ||
| relationship_kinds | No |