You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This will process the data in neo4j and output 3 csv reports in the GoodHound directory.
29
27
30
28
31
29
30
+
## Installation
31
+
32
+
### Pre-requisites
33
+
- Python and pip already installed.
34
+
- Both neo4j and bloodhound will need to be already installed. The docs at https://bloodhound.readthedocs.io/en/latest/#install explain this well.
35
+
36
+
### Using Pip
37
+
Use pip to install directly from the PyPi library, if you do not wish to change any local modules you already have installed it is recommended to use pipenv:
38
+
```
39
+
pip install goodhound
40
+
```
41
+
This will create a 'goodhound' entrypoint that you can call from the CLI:
42
+
```
43
+
goodhound -h
44
+
```
32
45
33
46
### Default behaviour
34
47
@@ -68,11 +81,14 @@ The weakest links report is a way to potentially find links of attack paths that
68
81
- csv saves a comma separated values file for use with reporting or MI (completing the graphs, actions, charts trifecta in the tagline)
69
82
- md or markdown to display a markdown formatted output
70
83
71
-
-f an optional filepath for the csv output option
72
-
-v enables verbose output to display query times
84
+
-d an optional filepathdirectory path for the csv output option
73
85
74
86
By default the output is csv in the current working directory.
75
87
88
+
-q supresses all output
89
+
-v enables verbose output
90
+
--debug enables debug output
91
+
76
92
### Number of results
77
93
-r can be used to select the amount of results to show. By default the top 5 busiest paths are displayed.
78
94
-sort can be used to sort by:
@@ -86,11 +102,7 @@ For example, you want to add the highvalue label to 'dbserver01' because it cont
The schema can contain multiple queries, each on a separate line.
90
-
91
-
### Query
92
-
-q can be used to override the default query that is run to calculate the busiest path. This is largely for debugging the script if your dataset is large and you want to temporarily load in a query that looks at a smaller set of your data in order to quickly try GoodHound out.
93
-
Care should be taken to ensure that the query provides output in the same way as the built-in query, so it doesn't stop any other part of GoodHound running.
105
+
The schema can contain multiple queries, each on a separate line.
94
106
95
107
### SQLite Database
96
108
By default Goodhound stores all attack paths in a SQLite database called goodhound.db stored in the local directory. This gives the opportunity to query attack paths over time.
@@ -103,29 +115,6 @@ Larger datasets can take time to process.
103
115
GoodHound does "warm-up" the database using the same query that the Warm-Up Database option in the Bloodhound GUI does, however the Neo4j documentation suggests that this is no longer necessary, and in practice I haven't seen it make any different on Neo4j 4.0 and greater.
104
116
There are also many guides for tuning the neo4j database for increased performance which are out of scope here (although if I make any significant improvements I'll document the findings).
105
117
106
-
## Installation
107
-
108
-
### Pre-requisites
109
-
- Python and pip already installed.
110
-
- Both neo4j and bloodhound will need to be already installed. The docs at https://bloodhound.readthedocs.io/en/latest/#install explain this well.
111
-
112
-
### Downloading GoodHound
113
-
Either download using git or by downloading the zip file and extract to your chosen location.
- Goodhound will install py2neo and pandas libraries, if you do not wish to change any local modules you already have installed it is recommended to use pipenv.
126
-
```
127
-
pip install -r requirements.txt
128
-
```
129
118
130
119
## SQLite Database
131
120
By default Goodhound will insert all of attack paths that it finds into a local SQLite database located in a db directory inside the current working directory.
0 commit comments