Integrate BloodHound Enterprise with Cortex XSOAR

Learn how to integrate BloodHound Enterprise with Cortex XSOAR by Palo Alto Networks.

The BloodHound Enterprise integration for Cortex XSOAR lets you ingest and manage BloodHound Enterprise attack path findings in Cortex XSOAR as incidents.

Use this integration to:

• Automatically convert BloodHound Enterprise attack path findings into Cortex XSOAR incidents
• Attach remediation guidance and posture context to incidents
• Run playbooks and custom commands to analyze, triage, and remediate findings

Key capabilities include:

• Automated incident creation with titles, descriptions, remediation guidance, impact/exposure metrics, severity, and domain/environment context
• Playbook linking per incident to run custom analysis commands
• Custom commands:
  • Object ID lookup by name
  • Asset information by object ID
  • Path analysis between two nodes in the BloodHound graph

Prerequisites

Before installing and configuring the Cortex XSOAR integration, ensure that you have the following:

• Cortex XSOAR instance with an admin account
• BloodHound Enterprise tenant
• BloodHound Enterprise API key/ID pair

We recommend a non-personal API key/ID pair.

Configure Cortex XSOAR

Set up the SpecterOps BloodHound Enterprise integration instance in Cortex XSOAR.

1. Open integration instances

   1. Log in to your Cortex XSOAR instance.

   2. Go to Settings & Info > Settings > Integrations > Instances.

      
2. Add SpecterOpsBHE instance

   1. Search for the SpecterOps integration.

   2. Click Add Instance for the SpecterOpsBHE integration.

   3. Configure settings.

      Field	Description	Required?
      Name	Instance display name (default can be modified)	Yes
      BloodHound Enterprise Domain	Your tenant domain, e.g., https://example.bloodhoundenterprise.io	Yes
      Token ID	API token ID from BloodHound Enterprise	Yes
      Token Key	API token key from BloodHound Enterprise	Yes
      Proxy URL	Proxy URL to reach BloodHound Enterprise	No
      Proxy URL Username	Username for proxy authentication	No
      Proxy URL Password	Password for proxy authentication	No
      Finding Environment	Scope findings to one environment	No
      Finding Category	Scope findings to one category	No

      By default, Finding Environment and Finding Category are set to All.
      
3. Enable fetching and schedule interval

   1. Check the Fetches incidents option (required).

   2. Set Incident Type to “SpecterOpsBHE Attack Path” (optional).

   3. Set the Incidents Fetch Interval to your preferred schedule (required).

      The default fetch interval is 10 minutes.
      
4. Test and save the configuration

   1. Click Test to verify connectivity and credentials.

   2. Close the modal, then Save the instance.

      ”Success” indicates working parameters and connectivity. “Error” indicates invalid parameters or connection failure.
      
5. Manage multiple domains or disable instances

   • To add additional BloodHound Enterprise domains, create more instances with Add Instance.

   • To stop fetching, uncheck Enable to disable the instance.