Announcements
New BloodHound Enterprise Capabilities
Read Justin Kohler’s recent blog post on new BloodHound Enterprise capabilities that extend Identity Attack Path Management beyond traditional identity infrastructure into Okta, GitHub, and Jamf-managed macOS environments. Register for the webinar with Jared Atkinson and Justin Kohler on March 31 to see how BloodHound Enterprise uncovers attack paths across Okta, GitHub, and Mac environments, helping teams prioritize what matters. They will also discuss additional enhancements, including Privilege Zones and role-based access control (RBAC).New Episode: Know Your Adversary
A new episode of the Know Your Adversary podcast dropped this week. Hear from Steve Elovitz from Palo Alto Networks’ Unit 42 on how modern adversaries operate once inside an environment, why identity has become a primary entry point for many attacks, and the attack patterns his team most frequently sees during incident response engagements.SO-CON 2026 is coming up in April!
There’s still time to save your spot at SO-CON 2026! Join us in Arlington, Virginia for our two-day (April 13-14) conference packed with talks, research, and community exchange, followed by four days (April 15-18) of deep-dive, hands-on trainings led by adversary-experienced practitioners.2026-03-26
This release resolves the following issues:
- Resolved several issues that could cause analysis to fail.
- Resolved an issue preventing Cypher queries on PostgreSQL from respecting minimum and maximum path length limits.
- Resolved an issue where Cypher queries on PostgreSQL failed with the error
ERROR: invalid reference to FROM-clause entry for table "s0" (SQLSTATE 42P01). - Resolved an issue where certain Cypher path queries on PostgreSQL could be slower than expected due to an inefficient edge-to-path join pattern.
- BloodHound will no longer support SHA-1 cipher suites when configured to serve HTTPS directly (without a load balancer).
2026-03-23
This release introduces new features, enhancements, and fixed issues to improve data collection, OpenGraph ingestion capabilities, and general usability. Key highlights include:
- Privilege Zones is now generally available!
- Property-based edge matching enables hybrid edge creation using cross-system attributes, such as email, username, or hostname.
- AzureHound collects Federated Identity Credentials (FICs) from Azure and adds new nodes and edges in BloodHound to represent these trust relationships.
- BloodHound Enterprise now allows you to upload nodes and edges in separate OpenGraph data payloads without losing disconnected nodes after ingestion.
New Features
Enhancements
Fixed Issues
See the release notes for a full list of fixed issues in this release.2026-03-04
This release improves graph investigation workflows in Explore and resolves reliability issues in findings export, Zone Builder tagging and filtering, and query naming. Key highlights include:
- Explore adds resizable table columns, Meta node details in the Entity Panel, and clearer edge guidance for Azure role relationships.
- Edge reference coverage expands with a new
valid_edges.jsonschema for valid source-target node relationships and supported edge types. - Fixed issues improve findings export accuracy, Zone Builder Tier Zero tagging timing and zone membership filtering behavior, and prebuilt query naming clarity.
Enhancements
Fixed Issues
See the release notes for a full list of fixed issues in this release.2026-02-17
This release addresses the following issues:
- Resolved an issue causing partial failures after uploading Azure sample data.
- Resolved memory and CPU performance issues during AD Group and Local Group analysis.
2026-02-11
This release enhances data collection capabilities with new customization options, expands permissions for Cypher query management, and improves Zone Builder with better rule testing, clearer terminology, and enhanced object identification.
New Features
Enhancements
Fixed Issues
12 issues resolved across BloodHound, SharpHound, and AzureHound.2026-01-30
This release addresses an issue where Local Group relationships could be incorrectly calculated during analysis.
2026-01-27
This release addresses the following issues:
- Resolved memory and performance issues during local group processing (DCOM, CanPSRemote, AdminTo, CanRDP).
- Resolved an issue where custom icons for nodes in OpenGraph data did not display in the graph on the Explore page.
- Set OpenGraph node search to enabled by default.
2026-01-22
This release introduces new features, enhancements, and fixes to improve usability, performance, and data collection. Key highlights include:
- Keyboard shortcuts improve accessibility
- Zone Builder (renamed) gains clearer forms, rule guidance, and consistent terminology
- APIs add safer filtering, member counts, and source-kind safeguards
- Data collectors add clearer logging and configuration guidance