BloodHound CE - Active Directory Attack Path Analysis

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## BloodHound Community Edition - Attack Path Analysis

BloodHound Community Edition uses graph theory to reveal hidden and unintended privilege relationships in Active Directory, Entra ID, and Azure environments. Built on an open source project with a large and active community of security professionals, BloodHound is one of the most widely adopted attack path analysis tools in offensive and defensive security.

This pre-hardened AMI delivers a fully operational BloodHound CE instance in minutes - no manual Docker Compose configuration, no graph backend wiring, and no default credentials to rotate away.

## How It Works

Feed the platform output from SharpHound and AzureHound collectors and it maps every principal, group, computer, certificate template, and trust into an interactive graph. Trace the exact attack paths an adversary could walk to reach Domain Admins or any other high-value target. A built-in query library and pathfinding surface the shortest routes to compromise, so red teams can prove impact and blue teams can find and cut the edges that matter.

Under the hood, this AMI runs the official upstream BloodHound Go API and React user interface backed by a PostgreSQL graph database - installed, secured, and running from first boot.

## Why This AMI vs a Manual Install

Standing BloodHound up yourself means running a Docker Compose stack, choosing and wiring a graph backend, provisioning PostgreSQL, generating a JWT signing key and an administrator account, and rotating away every default the upstream compose ships. This image completes every one of those steps at build time:

• Runs the official upstream container image unmodified, pinned by version
• PostgreSQL is never exposed on a host port
• Unique PostgreSQL password, JWT signing key, and administrator password generated on each instance's first boot
• No secrets are ever shipped in the image

## Security Hardening

• No default or shared credentials: PostgreSQL password, JWT signing key, and administrator password are all generated uniquely on every instance's first boot; well-known upstream defaults are proven absent and rejected by the live API
• Single-use admin password: the generated administrator password is issued already expired, forcing the operator to set a new one at first sign-in
• Fresh database per instance: the captured image carries no ingested collector data, no computed attack paths, and no user accounts
• Network isolation: PostgreSQL is reachable only on the internal container network and never published to a host port
• No GPLv3 graph engine: runs BloodHound's first-party PostgreSQL graph backend rather than the EOL Neo4j 4.4 line, so no GPLv3 component and no end-of-life database
• Dedicated data volume: the Docker data root lives on its own disk, surviving OS-disk changes and resizable independently

## Concrete Use Cases

• Active Directory attack path analysis: ingest SharpHound output and trace every path a low-privileged user could take to Domain Admins, DCSync rights, or other Tier Zero assets, then prioritise the edges to remove
• Entra ID and Azure privilege review: feed AzureHound data to map role assignments, application ownership, and consent grants across a tenant
• Red and blue team assessment: run BloodHound on your own AWS account during an engagement or purple-team exercise, keeping sensitive collector data on infrastructure you control

## AWS Integration

Deploy on any EC2 instance type; the recommended size is m5.large. Put the BloodHound UI behind an Application Load Balancer with your own TLS certificate and domain, back up the security database and computed graph using EBS snapshots or AWS Backup, and resize the dedicated data volume independently of the OS disk as your ingested datasets grow.

## Getting Started

1. Launch the AMI on an m5.large (or larger) instance

2. Retrieve the single-use admin password from the root-only file on the instance

3. Sign in to the BloodHound UI and set your permanent password

4. Upload SharpHound or AzureHound collector output

5. Explore attack paths in the interactive graph

For a guided deployment walkthrough or questions before purchase, contact support@cloudimg.co.uk.

## Open Source and Source Availability

BloodHound Community Edition is licensed under the Apache License, Version 2.0. This image ships the official upstream container image unmodified; the complete corresponding source is available from the upstream project at github.com/SpecterOps/BloodHound. cloudimg's charges are for the packaging, hardening, and support services described here, not for the software licence.