bloodhound-enterprise

Specialist agent for attack-path triage. Takes a domain (or "all domains") and produces a ranked, evidence-backed list of findings worth remediating. Use when the caller wants attack-path work specifically — not a general audit, not a Cypher investigation, not data ingestion.

Top-level BloodHound Enterprise analyst. Accepts open-ended questions about an Active Directory or Azure environment ("audit our Tier Zero", "what attack paths are active in this domain", "produce a posture report") and routes to the appropriate skill. Use this agent as the entrypoint when the task isn't already narrow enough to call a specialist directly.

Specialist for Tier Zero hygiene — audits asset-group-tag membership, certifies deliberate inclusions, surfaces drift, and catches shadow changes via the audit log. Use when Tier Zero is the explicit subject of the request, when the caller suspects a tier was modified incorrectly, or as a periodic hygiene cycle.

Open-ended graph investigation via raw OpenCypher queries. Use when the prebuilt tools don't capture the question — bespoke "find every X that can reach Y via Z" queries, ad-hoc relationship walks, novel attack-path patterns, or one-off exports for analysis. Read-only by default; writes require explicit opt-in.

Push SharpHound / AzureHound collection data into a BloodHound Enterprise deployment, monitor the ingest pipeline, and confirm the graph is updated. Use when the caller has fresh collection output to load, when the deployment's posture data is stale, or when the caller asks "ingest these files", "upload SharpHound output", "push collection data".

Compare BHE posture between two points in time — what got better, what got worse, and which specific findings drove the change. Use when the caller asks "how have we improved", "what changed since last week", "produce a trend report", or at the close of a remediation cycle.

Audit the Tier Zero asset group — list members, validate that every inclusion is intentional, identify drift since the last audit, and certify or revoke certifications as needed. Use when the caller asks "audit Tier Zero", "review the tier list", "who's in Tier Zero and why", or after Tier Zero membership changes are reported in the audit log.

Investigate a single AD or Azure principal — who controls it, what it controls, where it has admin rights, and what's reachable via its credentials. Use when the caller asks "tell me about this user", "what does X have access to", "who can compromise Y", or when triaging a finding tied to a specific principal.