BloodHound Narrator

Turn BloodHound attack paths into boardroom-ready security reports — entirely offline.

Built for pentesters, blue teams, and AD security consultants who need to translate BloodHound graph output into actionable deliverables without spending hours writing prose.

BloodHound Narrator ingests Cypher export JSON, scores each attack path on a weighted severity model, and produces a dual-layer Markdown report:

1. CISO / Executive Layer — severity summary table, per-path business risk narrative, impact statements written in non-technical language that management and board members can act on.
2. Technical Remediation Appendix — step-by-step hardening playbook with PowerShell commands, Event IDs to monitor, and remediation guidance per finding.

Detected attack patterns: DCSync, Kerberoasting, unconstrained delegation, GenericAll / WriteDacl / WriteOwner ACL abuse, GPO takeover, lateral movement chains (AdminTo + HasSession), Tier 0 boundary violations, stale service account passwords, and sensitive data exposure paths.

No API keys. No network calls. No data exfiltration risk. Air-gap compatible. Works in regulated, classified, and OT environments.

Setup

Install PowerShell (if not already present):