SharpHound
Overview
The SharpHound integration connects the Praetorian Guard Platform (PGP) with Active Directory attack path data collected by SharpHound, the official data collector for BloodHound. By uploading SharpHound export files into PGP, security teams can analyze Active Directory relationships, identify attack paths, and discover privilege escalation opportunities within their internal environment.
Active Directory remains the backbone of identity and access management for most enterprises, and misconfigurations in AD often create exploitable attack paths that adversaries use for lateral movement and privilege escalation. SharpHound collects detailed information about AD objects -- users, computers, groups, domains, GPOs, OUs, and their relationships -- and PGP parses this data to build a comprehensive model of your AD security posture.
Unlike API-based integrations, the SharpHound integration is a file-based import. You collect data offline using SharpHound, upload the resulting ZIP archive to PGP, and PGP processes the BloodHound JSON files to extract AD objects and relationships. This approach supports air-gapped environments and does not require direct network connectivity between PGP and your Active Directory.
What the Integration Does
The SharpHound integration accepts BloodHound-format ZIP archives containing JSON files produced by SharpHound. PGP downloads the uploaded archive, extracts the JSON files, and streams each file through a parser that converts BloodHound data into PGP's internal AD object and relationship models.
The parsing process involves several stages:
The integration processes the following BloodHound data types: users, computers, groups, domains, GPOs, OUs, containers, and issuance policies. Each type is identified from the file metadata and processed accordingly.
All imported data maps to PGP's internal attack surface. The uploaded SharpHound file is deleted after processing.
Prerequisites
Before setting up the SharpHound integration, ensure you have:
Collecting Data with SharpHound
``
SharpHound.exe --collectionmethods All
`
SharpHound will produce a timestamped ZIP archive (e.g., 20240115120000_BloodHound.zip) containing JSON files for each AD object type.Transfer the ZIP archive to a location where you can upload it to PGP. Collection Methods
SharpHound supports various collection methods. The All method provides the most comprehensive data, but you can use specific methods as needed:
Setup
In PGP, navigate to the Integrations page. Select SharpHound from the list of available integrations. Upload your SharpHound ZIP archive using the file upload interface. PGP will begin processing the file automatically. Processing time depends on the size of your AD environment. Field Reference
What Data Is Synced
AD Objects (Assets)
The integration imports Active Directory objects as internal assets within PGP.
AD Relationships (Risks)
The integration imports relationships between AD objects, which represent potential attack paths.
Well-Known Entities
PGP automatically generates well-known AD objects and relationships for each discovered domain, including built-in groups (Domain Admins, Enterprise Admins, etc.) and their standard relationships. This ensures that the AD model is complete even if SharpHound did not enumerate every built-in object.
API Endpoints Used
This integration does not use external API endpoints. It is a file-based import that processes BloodHound JSON data uploaded directly to PGP.
Troubleshooting
Security and Data Handling
The SharpHound integration processes data from uploaded files rather than connecting to external APIs. The uploaded SharpHound ZIP archive is stored temporarily in PGP's encrypted file storage and is deleted after processing is complete.
Active Directory data imported from SharpHound includes object metadata such as names, SIDs, group memberships, and permission relationships. PGP does not import or store user passwords, password hashes, Kerberos tickets, or any authentication secrets from the SharpHound data.
Because this is a file-based import, no persistent credentials are stored for this integration. Each import is a one-time operation that processes the uploaded file and removes it upon completion. To update the AD data in PGP, collect new data with SharpHound and upload a fresh archive.