BloodHound OpenGraph Skill

Use this skill when creating custom BloodHound schema/extensions, ingestors, or attack-path queries that require graph-model customization. For standard OpenHound GitHub/Jamf/Okta analysis, use the matching OpenHound domain skill instead.

Input Contract

• Context describing the required extension (new node/edge types, ingestor data source, Cypher query need).

Workflow

1. Read ../../references/docs/opengraph-extension-management.md before making schema/install/upload recommendations.
2. Read ../../references/docs/collector-source-index.md for GitHound, JamfHound, OktaHound, and SCIM source context.
3. Inspect ../../references/examples/node-edge-reference.md and ../../references/examples/example-cypher.md before proposing custom labels, edges, or queries.
4. For SCIM bridge modeling, read ../../references/docs/scim-methodology.md and preserve SCIM_* labels/edges.
5. Separate extension schema design from collector implementation, saved queries, privilege-zone rules, and data payload upload steps.

Output

• Documentation or code for custom node/edge definitions, ingestors, or Cypher queries aligned with BloodHound CE or OpenGraph extensions.
• Notes about performance, compatibility, and MITRE technique relevance.