BloodHound JSON Formats

  • Updated

This article applies to BHCE and BHE

Collectors for BloodHound Enterprise (BHE) and BloodHound Community Edition (BHCE) store their data as JSON.

SharpHound Enterprise uploads it's JSON data directly to the API endpoint `/ingest`, whereas SharpHound CE drops JSON files to disk which has to be uploaded via UI or to the API endpoint `/file-upload`.

The JSON structure is documented in this article.

Basic JSON Format

The JSON file contains two main objects:

  • data
    • An array of collected objects, one JSON file contains one type of objects.
  • meta
    • An object containing meta information about the collection and the `data` array.
      • methods is a bitmask of the collection method used. This is used for the BloodHound ingestor to know what data to expect. Possible values can be found in models.go as `CollectionMethods`.
      • type describes the type of objects in the data array. One JSON file can only contain one data type. Possible values can be found in models.go as `DataType`.
      • count is an int representing the number of objects in the `data` object array.
      • version is an integer representing the version of the JSON format.
{
"data": [
{
[...]
}
],
"meta": {
"methods": 127999,
"type": "users",
"count": 1,
"version": 5
}
}

Detailed JSON Format

JSON data of each node type will vary greatly. Examples of detailed JSON formats for some node types can be found in the latest version directory in the BHCE's repository.