specterops/openhound repository overview

⁠Quick reference

• Maintained by:
  SpecterOps⁠
• Where to get help:
  SpecterOps Community Slack⁠
• Where to report issues:
  GitHub Issues⁠
• Supported architectures:
  amd64, arm64

⁠Supported tags

For a full list of supported tags, see the tags⁠ page. We maintain two different tag formats for the OpenHound container image:

• latest: Latest OpenHound image using the openhound CLI entrypoint.
• <version>: Version-pinned image using the openhound CLI entrypoint.
• <version>-enterprise: Version-pinned image for BloodHound Enterprise customers. Starts the scheduler by default.

The -enterprise variant is intended for BloodHound Enterprise managed schedules and does not publish a latest-enterprise tag.

Note: Both variants use the same base image but have different entrypoints configured. The -enterprise variant uses API endpoints that are only available in BloodHound Enterprise and will not work with BloodHound community edition.

⁠What is OpenHound

OpenHound is a standardized framework for building and running OpenGraph collectors and converters. It is built in Python and powered by the Data Load Tool (DLT)⁠ library, giving you a consistent workflow to collect, process, and convert data from any source into BloodHound-compatible graphs.

The OpenHound container image includes the OpenHound CLI and the following collectors and converters:

• Github Collector: Collects data from GitHub organizations, such as repositories, branches, and users.
• JAMF Collector: Collects data from JAMF Pro instances, including devices, users, and groups.
• Okta Collector: Collects data from Okta tenants, including users, groups, and applications.

⁠How to use this image

⁠Enterprise

For BloodHound Enterprise customers, refer to the OpenHound for Enterprise⁠ documentation for instructions on how to use the OpenHound container image.

⁠Community

To run OpenHound commands using the CLI entrypoint, use the following syntax:

docker run --rm specterops/openhound:latest <command> [options]

⁠Collect

docker run --rm specterops/openhound:latest collect <collector> ./dir

⁠Preprocess

docker run --rm specterops/openhound:latest preproc <collector> ./dir/<collector> ./lookup.duckdb

⁠Convert

docker run --rm specterops/openhound:latest convert <collector> ./dir/<collector> ./dir/graph

⁠OpenHound documentation

Quickstart guide: https://bloodhound.specterops.io/openhound/overview⁠
Contributor documentation: https://specterops.github.io/openhound/⁠

⁠License

View license information⁠ for OpenHound

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.