## Quick overview of a report
### Comprehensive Mitigation Paths for Active Directory Risks
A risk-based rating of Active Directory weaknesses, along with comprehensive mitigation paths.
### A dynamic web interface
Search bar and controls that are carefully tailored to identify the most risky misconfigurations.
### Progress Monitoring through an Evolving Interface
You can also observe indicators over time to help measuring mitigation efficiency.
## Prerequisites
1. To extract the data from the domain, you can use tools like [SharpHound](https://github.com/BloodHoundAD/SharpHound), [RustHound-CE](https://github.com/g0h4n/RustHound-CE) or [BloodHound.py](https://github.com/dirkjanm/BloodHound.py) and [AzureHound](https://github.com/BloodHoundAD/AzureHound) for EntraID environments.
2. To set up your BloodHound environment (including the GUI and Neo4j database), [BloodHound Automation](https://github.com/Tanguy-Boisset/bloodhound-automation) is **highly recommended due to its seamless integration with the Graph Data Science plugin**. Though it is perfectly fine to use the default [BloodHound CE](https://github.com/SpecterOps/BloodHound) installation, be aware that you will miss out on the benefits of GDS (e.g., smarter pathfinding, improved execution speed, etc.).
3. By default, BloodHound creates a neo4j base accessible on port 7687.
## Installation and setup
The easier way is to do the following command using `pipx`:
ADMiner is also available on some Linux distributions:
[](https://repology.org/project/ad-miner/versions)
A Docker image is available to build. Build the image with the following commmand:
Note that mounting the volume with `-v` is critical to get the output of the data. This assumes that the BHCE server is running on the Docker host with default settings.
## Usage
Run the tool:
Example:
If password renewal policy is known, you can specify it using the `-r` parameter to ensure that password renewal controls align with your environment's settings (default is 90 days). For example, if the password policy is set to 180 days, you can use the following:
Options:
-h, --help show this help message and exit
-b BOLT, --bolt BOLT Neo4j bolt connection (default: bolt://127.0.0.1:7687)
-u USERNAME, --username USERNAME
Neo4j username (default : neo4j)
-p PASSWORD, --password PASSWORD
Neo4j password (default : bloodhoundcommunityedition)
-e EXTRACT_DATE, --extract_date EXTRACT_DATE
Extract date (e.g., 20220131). Default: last logon date
-r RENEWAL_PASSWORD, --renewal_password RENEWAL_PASSWORD
Password renewal policy in days. Default: 90
-c, --cache Use local file for neo4j data
-l LEVEL, --level LEVEL
Recursive level for path queries
-cf CACHE_PREFIX, --cache_prefix CACHE_PREFIX
Cache file to use (in case of multiple company cache files)
--gpo_low Perform a faster but incomplete query for GPO (faster than the regular query)
-ch NB_CHUNKS, --nb_chunks NB_CHUNKS
Number of chunks for parallel neo4j requests. Default : 20 * number of CPU
-co NB_CORES, --nb_cores NB_CORES
Number of cores for parallel neo4j requests. Default : number of CPU
--rdp Include the CanRDP edge in graphs
--evolution EVOLUTION
Evolution over time : location of json data files. ex : '../../tests/'
--cluster CLUSTER Nodes of the cluster to run parallel neo4j queries. ex : host1:port1:nCore1,host2:port2:nCore2,...
In the graph pages, you can right-click on the graph nodes to cluster them or to open the cluster.
