Integration of Bloodhound Community Edition

[alcastronic]

Hi are there, this is more of a question/feature request.

Are there plan's already to integrate the bloodHound Community Edition with RedELK?
It seems that SpecterOps has deprecated the original BloodHound Repo.

Are there any dependencies from RedELK to the BloodHound version that could prevent "just plugging in" the Community Edition?

[MarcOverIP]

Valid point. We should move to the new Community Edition. You agree @fastlorenzo?

On a high level this should not be too hard I believe: just use the new docker container from them and test. Feel free to add a PR if you see the time.

[fastlorenzo]

@MarcOverIP agreed indeed, in the past I've made a small container that was taking SharpHound's JSON/ZIP files as input from a mount and was ingesting them directly into Neo4j.
The BloodHound Community Edition looks like a great enhancement to RedELK!
FYI - would require to update the Kibana app to embed it in the view.

[alcastronic]

I'll have a look into it and prepare a PR for the RedELK part first. I think it might make sense to integrate the full stack e.G not only the Neo4J db but also the new WebApp with another postgresql db. That would spawn three new dockers and it would be required to expose the Bloodhound WebApp via nginx. The app should be able to handle auth itself.

Looging at https://github.com/SpecterOps/BloodHound/blob/main/examples/docker-compose/README.md this should be fairly simple to integrate.

[alcastronic]

I a have it mostly done, there is however one issue with the reverse proxy support of the Bloodhound Community Edition as it wan'ts to be served from the root directory e.G https://127.0.0.1/ui/login so something like https://127.0.0.1/bloodhound/ui/login will not work. It is still possible to serve it on port 8080 as the Neo4J Browser but that would be over HTTP.

I have opened an issue SpecterOps/BloodHound#94 , maybe there is a way to change the root url altogether.

[alcastronic]

I have started the Bloodhound WebApp on port 8443, since the route can not be changed out-of-the-box.
There is still an error that I need to investigate further before opening an PR, the Explore dashboard fails with the following error.

[MarcOverIP]

Any help we can provide you on this?

[alcastronic]

It seems that the app is working now, I'll do some cleanup and than open a PR so someone can test it.

[alcastronic]

Current status:

• Ingestion of data works.

• Data is present :

• For me, the pre-build cipher queries did not return any data.

• Connection with Bloodhound (Version: 4.3.1) to neo4j works:

• Other apps are working as well:

• jupyter

• neo4j browser

• redelk dashboard

• When limted flag is present only RedELK is installed.

 Done with base setup of RedELK on ELK server
 You can now login to the following interfaces: 
   - Main RedELK Kibana interface on port 443 (user: redelk, pass:[...])

The include for the bloodhound server is commented out when limited is present.

• When limited flag is absent everything is installed for bloodhound including:

• postgresql

• neo4j

• bloodhound-app

• The login information for the previous apps and the bloodhound-community-ui is shown.

 Done with base setup of RedELK on ELK server
 You can now login to the following interfaces: 
   - Main RedELK Kibana interface on port 443 (user: redelk, pass:[...])
   - Jupyter notebooks on /jupyter (user: redelk, pass:[...])
   - Bloodhound community edition on https port 8443 (user: admin, pass:[...])
   - Neo4J Browser port 7473 (user: neo4j, pass:[...])
   - Neo4J using the BloodHound app on port 7687 (user: neo4j, pass:[...])

• [] The credentials file shows the appropriate credentials

# passwords used by RedELK installation - NOT A CONFIG FILE! - passwords are defined in .env file
CredHtaccessUsername = "redelk"
CredHtaccessPassword = "[...]"
CredESUsername = "elastic"
CredESPassword = "[...]"
CredNeo4jUsername = "neo4j"
CredNeo4jPassword = "[...]"
CredBloodhoundAdminEmail = ""
CredBloodhoundUsername = "admin"
CredBloodhoundPassword = "[...]"
CredPostgresUsername = "bloodhound"
CredPostgresPassword = ""

The Postgres password is missing in the creds file, it is porperly set in the .env file.
When the let's encrypt e-mail is not set, the BloodhoundAdmin e-mail is empty as well.

[alcastronic]

The Postgres password issue was resolved and PR #304 was opened.