Use the Microsoft Sentinel Integration with BloodHound Enterprise

View BloodHound Enterprise attack path risk, audit logs, posture trends, and critical asset exposure in Microsoft Sentinel dashboards and incidents.

Workbooks in Microsoft Sentinel provide interactive dashboards that help you review and investigate data.

The BloodHound Enterprise integration includes workbooks that visualize attack path data, audit logs, posture trends, and Tier Zero asset exposure.

You can also use Microsoft Sentinel’s incident management capabilities to triage and track remediation of BloodHound Enterprise findings.

See the Microsoft Sentinel documentation for more information.

Dashboards

Explore the following dashboards to review BloodHound Enterprise data in Microsoft Sentinel.

Attack Path Overview

Use this dashboard for high-level attack path trends across environments:

• Total attack paths by environment
• Exposure-oriented metrics such as expected compromise indicators
• Tier distribution context
• Environment filtering for focused analysis

Attack Path Details

Use this dashboard to investigate individual paths and prioritize remediation:

• Timeline and state changes for path findings
• Affected principals and related objects
• Exposure and impact context
• Remediation-linked context for triage

Audit Logs

Use this dashboard to monitor security-relevant operational changes:

• Create/update/delete activity timeline
• Actor and object context
• Environment-level filtering

Posture

Use this dashboard to monitor posture and progress over time:

• Posture trend metrics
• Service/control health indicators
• Environment-to-environment comparison

Tier Zero Assets

Use this dashboard to prioritize highest-impact exposure:

• Tier Zero principal inventory
• Exposure-oriented prioritization indicators
• Relationship context for critical assets

Work with incidents

Analytics Rules generate incidents from BloodHound Enterprise findings in custom log tables.

1. In Microsoft Sentinel, open Incidents.
2. Filter by BloodHound-related product/source fields.
3. Triage, assign, and track remediation in your incident workflow.

Use incidents for operational ownership and dashboards for trend/coverage analysis.

Multi-environment analysis

Use environment filters across dashboards to compare business units, regions, or segmented environments.

• View one environment in isolation.
• Compare multiple environments side-by-side.
• Reduce noise by excluding non-relevant environments.

Data scope and freshness

Dashboard and incident views reflect connector configuration choices:

• Environment and finding-type selection
• Polling cadence
• Initial lookback window (Lookup Days)
• Deduplication behavior favoring latest event state