A Go library to create BloodHound OpenGraphs easily


This library also exists in: Go | Python

Features

This module provides Go types and helpers for creating and managing graph structures that are compatible with BloodHound OpenGraph. The APIs follow the BloodHound OpenGraph schema and best practices.

If you don't know about BloodHound OpenGraph yet, a great introduction can be found here: https://bloodhound.specterops.io/opengraph/best-practices

Installation

Install with:

go get github.com/TheManticoreProject/bhopengraph

Examples

Here is an example of a Go program using the bhopengraph Go library to model the Minimal Working JSON from the OpenGraph Schema documentation:

package main

import (
	"github.com/TheManticoreProject/bhopengraph"
	"github.com/TheManticoreProject/bhopengraph/edge"
	"github.com/TheManticoreProject/bhopengraph/node"
	"github.com/TheManticoreProject/bhopengraph/properties"
)

func main() {
	// Create an OpenGraph instance
	graph := bhopengraph.NewOpenGraph("Base")

	// Create nodes
	bobProps := properties.NewProperties()
	bobProps.SetProperty("displayname", "bob")
	bobProps.SetProperty("property", "a")
	bobProps.SetProperty("objectid", "123")
	bobProps.SetProperty("name", "BOB")

	bobNode, _ := node.NewNode("123", []string{"Person", "Base"}, bobProps)

	aliceProps := properties.NewProperties()
	aliceProps.SetProperty("displayname", "alice")
	aliceProps.SetProperty("property", "b")
	aliceProps.SetProperty("objectid", "234")
	aliceProps.SetProperty("name", "ALICE")

	aliceNode, _ := node.NewNode("234", []string{"Person", "Base"}, aliceProps)

	// Add nodes to graph
	graph.AddNode(bobNode)
	graph.AddNode(aliceNode)

	// Create edge: Bob knows Alice
	knowsEdge, _ := edge.NewEdge(
		bobNode.GetID(),   // Bob is the start
		aliceNode.GetID(), // Alice is the end
		"Knows",
		nil,
	)

	// Add edge to graph
	graph.AddEdge(knowsEdge)

	// Export to file
	graph.ExportToFile("minimal_working_json.json")
}

This gives us the following Minimal Working JSON as per the documentation:

{
  "graph": {
    "edges": [
      {
        "end": {
          "match_by": "id",
          "value": "234"
        },
        "kind": "Knows",
        "start": {
          "match_by": "id",
          "value": "123"
        }
      }
    ],
    "nodes": [
      {
        "id": "123",
        "kinds": [
          "Person",
          "Base"
        ],
        "properties": {
          "displayname": "bob",
          "name": "BOB",
          "objectid": "123",
          "property": "a"
        }
      },
      {
        "id": "234",
        "kinds": [
          "Person",
          "Base"
        ],
        "properties": {
          "displayname": "alice",
          "name": "ALICE",
          "objectid": "234",
          "property": "b"
        }
      }
    ]
  },
  "metadata": {
    "source_kind": "Base"
  }
}

Contributing

Pull requests are welcome. Feel free to open an issue if you want to add other features.

References

• BloodHound OpenGraph Best Practices
• BloodHound OpenGraph Schema
• BloodHound OpenGraph API
• BloodHound OpenGraph Custom Icons