Which Bloodhound API call should be used to update the schema and import data into Bloodhound?

[jsdhasfedssad]

Hi,

Thank you for this tool.

Which Bloodhound API call should be used to update the schema and import data into Bloodhound? Your instructions does not say. This is needed for the -B parameter.

Is the schema output, BloodHound-customnodes, from MSSQLHound.ps1 still valid so that it can be used as an alternative to above? Using this output it seems that for example :MSSQL_HasLogin is missing which makes for example the query MATCH p = (:Base)-[:MSSQL_HasLogin]->() RETURN p fail. On the other hand MATCH p = (:Base)-[:MSSQL_Login]->() RETURN p, which does exist, also fails. I have imported a regular Bloodhound dump as well as a dump from MSSQLHound. When I search a user account that I know has access to MS SQL I get three results, the regular original AD account node type, the new MSSQL_Login node type and the new MSSQL_DatabaseUser node type. Still the above queries and others fails.

[Mayyhem]

Hi @jsdhasfedssad ,

The ability to import OpenGraph schema.json was added in BloodHound 9.0.0. The import via -B option targets the /api/v2/extensions API endpoint automatically. The schema.json file can contain custom icons for nodes and defines which edge classes exist and whether they are traversable, enabling pathfinding in BloodHound when using a postgres backend graph database and enabling OpenGraph extension management. The new Go implementation of MSSQLHound supports this feature. You can install BloodHound with these features using https://github.com/Mayyhem/OpenGraphWorkshop/blob/main/install-bloodhound/LINUX_install-bhce-pathfinding.sh (or another script in this folder if using Mac/Windows).

Custom node icons can also be defined by sending a payload to /api/v2/custom-nodes, but this is not the same as uploading an extension schema (it does not define edge traversability so it does not enable pathfinding). Uploading an extension schema containing icon definitions supercedes this method, but using custom-nodes alone will populate just the node icons.

Did you run MSSQLHound as a user with a valid server login that has permissions in the MSSQL instance you ran it against? This query should return results: MATCH p = (:Base)-[:MSSQL_HasLogin]->() RETURN p if there are any Active Directory (Windows-type) server logins in the instance.

If you could please share the exact command you ran, sanitized console logs, and sanitized output .json from the tool, I can help troubleshoot further.

Thanks for the report!