Everything is dependency-free at runtime: the web UI is embedded in the binary, there is no build step for the frontend, and no CDN is used.

With Go 1.26+:

go install github.com/krazybeastx1/omenhound/cmd/omenhound@latest
# binary -> "$(go env GOPATH)/bin/omenhound"; add that dir to PATH if needed
omenhound version

Pin a release with @v0.1.0. Prebuilt linux/macOS/Windows archives (with checksums.txt) are attached to each release.

git clone [email protected]:krazybeastx1/omenhound.git
cd omenhound
make build          # -> bin/omenhound
./bin/omenhound version

make vet test build is exactly what CI runs.

The sample collector ships a deterministic fake domain so you can exercise the whole pipeline — collect, ingest, attack-path UI, abuse rendering — with zero infrastructure.

# collect a graph and look at it
./bin/omenhound collect --collector sample --out graph.json

# serve the API + web UI using the in-memory store
./bin/omenhound serve --collector sample --addr 127.0.0.1:8080

Open http://127.0.0.1:8080, click a node, then click an edge. Or make run-sample.

At this point you have already proven: collection, the graph store, the ingestion API, the web UI, and the dynamic abuse renderer.

OmenHound supports LDAP simple bind over LDAPS, NTLM, and pass-the-hash. Plaintext LDAP is refused unless you explicitly opt in with --allow-plaintext-ldap (lab only).

export OMENHOUND_PASSWORD='...'            # keep secrets out of argv/history

./bin/omenhound collect \
  --collector ldap \
  --domain corp.local --server dc01.corp.local \
  --ldaps --username 'CORP\svc_omenhound' \
  --password-stdin --out corp.json

If you already use bloodhound-ce-python, the collector accepts the same short flags:

Example with SRV discovery and a CE-compatible archive:

./bin/omenhound collect --collector ldap -d corp.local -ns 10.0.0.10 \
  -u 'CORP\svc' --password-stdin --use-ldaps -c group,objectprops \
  --zip -op corp_ --out corp_collection.zip

Pass-the-hash instead of a password (LDAPS strongly recommended; a cleartext NTLM bind is refused unless you add --allow-plaintext-ldap):

./bin/omenhound collect --collector ldap -d corp.local -dc 10.0.0.10 \
  -u 'CORP\svc' --use-ldaps --hashes 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0' \
  -c dc --out corp.json

Kerberos over LDAP and SMB. The DC must be named by hostname (a service ticket is issued for a name, not an address), and cleartext LDAP is still refused unless --allow-plaintext-ldap:

# password
./bin/omenhound collect --collector ldap -d corp.local -dc dc01.corp.local -k \
  -u svc --password-stdin --use-ldaps -c all --zip -op corp_ --out corp.zip

# a TGT you already have (e.g. after kinit)
export KRB5CCNAME=/tmp/krb5cc_1000
./bin/omenhound collect --collector ldap -d corp.local -dc dc01.corp.local -k \
  --use-kcache -u svc --use-ldaps -c all --out corp.json

Every BloodHound.py method is implemented: group, objectprops, acl, trusts, container (over LDAP) and session, localadmin, rdp, dcom, psremote, loggedon (over SMB/RPC). -c dc / -c dconly expands to group,trusts,objectprops,acl,container; -c default expands to group,localadmin,session,trusts; -c all runs everything. An unknown method name is reported explicitly — never silently dropped.

The LDAP passes collect users, groups, computers and membership, their properties, object security descriptors → ACL edges, trustedDomain objects → TrustedBy edges, and OUs/GPOs/containers → Contains + GPLink edges. Each pass is self-sufficient: -c acl emits ACL edges and creates the OU/GPO/Container nodes it needs, and -c container builds the containment tree without needing acl.

The SMB/RPC passes resolve what LDAP cannot see — logged-on sessions (HasSession), local Administrators (AdminTo), and the remote-access groups (CanRDP, ExecuteDCOM, CanPSRemote) — by querying every collected computer over an authenticated SMB session:

# full remote-facts collection, LDAP + SMB
./bin/omenhound collect --collector ldap -d corp.local -dc dc01.corp.local \
  -u 'CORP\svc' --password-stdin --use-ldaps \
  -c all --timeout 30m --zip -op corp_ --out corp_bloodhound.zip

# just sessions + local admins
./bin/omenhound collect --collector ldap -d corp.local -dc dc01.corp.local \
  -u 'CORP\svc' --password-stdin --use-ldaps \
  -c session,localadmin --timeout 10m --out corp.json

SMB computers are queried one at a time, so --timeout is the overall budget — raise it for a large domain. Pass-the-hash works over SMB as well as LDAP (--hashes NT). A computer is only dialled if it has a dNSHostName; if the SMB credentials are missing, or a host is unreachable, the run continues and reports it in Meta.Warnings.

One caveat on validation — the parsers and mappings are tested against impacket-generated descriptors and hand-built fixtures, and the SMB pass's filtering/resolution are unit-tested, but the live LDAP and SMB/RPC paths have not yet been exercised against a real domain controller or host, so treat first contact as unverified.

See Coming from BloodHound.py for the full method table.

OmenHound imports the JSON or --zip output of bloodhound-ce-python directly.

# your existing workflow
bloodhound-ce-python -d cascade.local -u s.smith -p '...' -ns 10.129.46.41 -c all --zip
# -> 20260101120000_cascade.local_bloodhound.zip

# import it
./bin/omenhound import --in 20260101120000_cascade.local_bloodhound.zip --out cascade.json

Or push it straight into a running server (needs --api-token on serve):

./bin/omenhound import --in collection.zip --api http://127.0.0.1:8080 --token "$OMENHOUND_API_TOKEN"

The importer keeps SIDs/GUIDs verbatim, follows the BloodHound CE edge directions, and reports anything it dropped rather than inventing results:

import: 1284 nodes, 3610 edges, 12 placeholders from 7 file(s) (domain "CASCADE.LOCAL")
import: ACE right names with no OmenHound edge (skipped): map[...]

export OMENHOUND_NEO4J_PASSWORD='...'
export OMENHOUND_API_TOKEN="$(openssl rand -hex 32)"

./bin/omenhound serve \
  --neo4j-uri bolt://127.0.0.1:7687 --neo4j-user neo4j \
  --collector none --addr 127.0.0.1:8080

Then push a collection into it:

curl -sS -X POST http://127.0.0.1:8080/api/v1/ingest \
  -H "Authorization: Bearer $OMENHOUND_API_TOKEN" \
  --data-binary @corp.json

Because the graph uses the BloodHound CE schema, you can now point BloodHound CE (or your own Cypher) at the same database.

Next: How It Works →