OpenHound Jamf / JamfHound

Use this skill for OpenHound Jamf OpenGraph query design and attack-path triage with JamfHound/OpenHound Jamf data.

Required context

• Authorized Jamf tenants/sites and managed device scope.
• Whether JamfHound/OpenHound Jamf extension/schema/data is loaded.
• Collector account type/permissions, Jamf Cloud vs on-prem context, and site scoping.
• Target accounts, groups, API clients, sites, computers, tenant objects, policies, scripts, or profiles.

Workflow

1. Read ../../references/docs/bloodhound-query-methodology.md, ../../references/docs/openhound-jamf-methodology.md, and ../../references/docs/collector-source-index.md.
2. Inspect JamfHound schema/object examples under ../../references/examples/jamfhound/ when node/property shape matters.
3. Search ../../references/query-indexes/openhound-jamf.md and ../../references/examples/example-cypher.md for a saved-search starting point.
4. Inspect the referenced JSON snapshot before adapting.
5. Preserve jamf_ labels/edges and r.traversable = True filters where the source query uses them.
6. Distinguish tenant-wide paths from site-scoped permissions and identify hybrid identity/device bridge assumptions.