BloodHound Reporting,
One Graph per Engagement
BloodHound reporting with the graph inside the engagement. Import SharpHound or AzureHound data and every engagement keeps its own attack graph, paths, and findings.
Import Once. Report From One Place.
BloodHound shows you the path to Domain Admin. Getting that path into a report means screenshots of a graph, edges retyped by hand, and a database you wipe before the next job. Neuron imports the same collection data into the engagement and keeps the graph there.
Import SharpHound output, as the zip or the individual JSON files, or an AzureHound collection, and Neuron builds a directory dataset for the engagement: users, groups, computers, OUs, GPOs, domains, certificate templates, and certificate authorities, with the edges between them. Computers in the collection become hosts on the engagement, linked to their directory objects.
Import an Active Directory and an Entra ID collection together and they merge into one hybrid graph, with on-prem users and groups joined to their synced cloud identities.
$ neuron import --source ad-json \ 20261028_acme_BloodHound.zip entra.json SharpHound: 10 files, AzureHound: 1 file✓ Hybrid dataset: 21,640 nodes, 168,233 edges✓ 1,206 computers linked to hosts- 11:24 Finding Helpdesk can reset Domain Admin passwords
- 11:02 Import BloodHound: 21,640 nodes, hybrid
- 10:48 Import Certipy: 2 CAs, 3 vulnerable templates
- 10:31 Import NetExec: 41 hosts, 23 shares
Why BloodHound Reporting Takes So Long
BloodHound is built to find attack paths and it does that brilliantly. It was never meant to be the engagement record. The graph lives in one tester's database, the path that proved domain compromise lives in a screenshot, and the next engagement starts by clearing it all.
On a team, each tester runs their own instance and imports their own copy of the data. Owned principals, promising paths, and the reasoning behind them never reach the rest of the team, and the report author rebuilds the chain from memory and image files.
When the client asks for a retest six months later, the original graph is long gone, and so is any way to show what changed.
Everything BloodHound Produces, On the Engagement
Import BloodHound output from the browser or with neuron import, and it lands the moment the import finishes.
A Dataset per Engagement
Each import builds a directory dataset inside the engagement, with node, edge, user, computer, and group counts, so switching engagements never means clearing a database.
Active Directory and Entra ID
SharpHound and AzureHound collections through one importer. Load both and they merge into a hybrid graph, with on-prem users and groups linked to their synced Entra ID objects.
Attack Paths and Tier Zero
Shortest paths from a node, a saved set, or everything marked owned to Tier 0, with tiers assigned on import from SpecterOps' TierZeroTable rules.
AD CS Escalation Edges
Certificate templates and CAs import with their ESC abuse edges derived, so AD CS paths appear alongside group membership and ACL abuse.
Edge Confidence
Every edge is marked as collected, computed, assumed, or inferred from GPO policy, so a finding can state exactly how certain each step is.
Hosts Linked to Nodes
Computer objects create or update hosts on the engagement, linked to their directory node, so the host record and the graph tell the same story.
How to Import BloodHound Results
- 01
Collect with SharpHound or AzureHound
Run the collector you already use. SharpHound writes a zip of JSON files for Active Directory, and AzureHound writes a single JSON collection for Entra ID and Azure.
$ SharpHound.exe -c All --zipfilename acme.zip - 02
Keep the raw collection
A BloodHound collection is a snapshot of the domain on one day. Copy the zip into the engagement File Share so the original is there when the retest collection needs comparing.
$ neuron copy acme.zip neuron:Collections/ - 03
Import the collection
Name the importer with --source ad-json and pass the zip, the JSON files, or both collections at once. AD and Entra ID files sent in one import merge into a single hybrid dataset.
$ neuron import --source ad-json acme.zip entra.json - 04
Or import in the browser
Open Directory in the engagement sidebar and choose Import, or pick Directory & Identity JSON on the Import page. From the browser you can also append a new collection to an existing dataset.
Your Infrastructure. Your Data.
Neuron is self-hosted. Import BloodHound results from the browser or the CLI and they land on your own server, inside your network. Scan data never passes through a third-party cloud.
BloodHound needs the Directory module on your Neuron server.
From BloodHoundto the Final Report
The path that proves the finding is already in the engagement. Save it from the Paths panel, mark the principals you compromised as owned, and create the finding from the graph with the affected users, groups, and computers attached instead of a screenshot.
Edge labels carry their confidence, so the write-up can say which steps were observed and which come from GPO policy. The Relations library supplies abuse and OPSEC notes for each edge type, the detail a client needs to break the path.
The whole team works the same graph at the same time, and because the dataset stays with the engagement, the retest can import a fresh collection next to the original and show which paths are gone.
BloodHound Integration FAQ
The questions teams ask most about BloodHound and Neuron.
How do I get BloodHound attack paths into a pentest report?
Import your SharpHound or AzureHound data into the Neuron engagement. Neuron builds the attack graph inside the engagement, so you find the path, save it, and create a finding from it with the affected objects attached, with no screenshots or exports.
Which BloodHound data formats does Neuron import?
SharpHound output as the zip or the individual JSON files, and AzureHound JSON collections for Entra ID and Azure. Collectors that write the same BloodHound-compatible JSON, such as bloodhound-python, import the same way.
Do I need to clear the BloodHound database between engagements?
No. Every engagement keeps its own directory datasets, so you can switch between engagements and come back to a graph exactly as you left it. A dataset is only deleted when you delete it.
Can the Neuron CLI import SharpHound data?
Yes. Run neuron import --source ad-json on the SharpHound zip or JSON files. The source has to be named because a zip is not detected from its content, and --tag tags the hosts created from computer objects.
Can several testers work the same BloodHound graph?
Yes. Everyone assigned to the engagement works the same dataset at once, sees the same owned principals and saved paths, and creates findings from the same graph.
What do I need to license to import BloodHound data?
Directory datasets need the Directory module on your Neuron server. It includes the graph, path queries, the Cypher query library, Tier Zero rules, and edge documentation synced from SpecterOps.
More Neuron Integrations
NetExec (nxc) Reporting and Logging
Active DirectoryCertipy AD CS Reporting and ESC Findings
Active DirectoryPCAP Import: Hosts and Services From Captures
Network DiscoveryNessus Reporting and .nessus File Import
Vulnerability ScannersQualys Report Import for Pentest Reporting
Vulnerability ScannersOpenVAS Reporting and Greenbone Report Import
Vulnerability ScannersNexpose and InsightVM Report Import
Vulnerability ScannersOpenAPI and Swagger Import for API Pentests
Web TestingReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform