OpenHound is a standardized framework for building and running OpenGraph collectors and converters. It is built in Python and powered by the Data Load Tool (DLT) library, giving you a consistent workflow to collect, process, and convert data from any source into BloodHound-compatible graphs.
The openhound-github extension collects resources from Github organizations and transforms these into useable nodes and edges for BloodHound.
Enterprise GitHub App credentials accept either client_id or app_id as the
JWT issuer. When both are configured, client_id is preferred. At least one
identifier must be supplied together with key_path and enterprise_name.
GitHub.com is the default deployment and does not require endpoint configuration.
To collect from GitHub Enterprise Server, set both API endpoints in config.toml:
[sources.github]
rest_api_url = "https://ghe.example/api/v3"
graphql_url = "https://ghe.example/api/graphql"Both values must be provided together when overriding the GitHub.com defaults.
Endpoint URLs must use HTTPS and share the same origin. GitHub App
credentials.api_uri may override only the path on that same origin.
A token with enterprise SCIM access is used to collect both /scim/v2/enterprises/{enterprise}/Users and /scim/v2/enterprises/{enterprise}/Groups. The collector emits normalized SCIM_Organization, SCIM_User, and SCIM_Group nodes plus SCIM_Contains, SCIM_MemberOf, and SCIM_Provisioned relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
SOURCES__GITHUB__EMIT_LEGACY_SCIM_CORRELATIONS=true temporarily reproduces GitHound-style Okta-to-SCIM correlation relationships. It defaults to false because a dedicated hybrid correlator should own IdP-to-SCIM matching; GitHub remains authoritative for GitHub's SCIM resources and target-system provisioning relationships.
Enterprise roles, including the built-in members role, are emitted through GH_HasRole and granular enterprise capability relationships. Only capability relationships with a confirmed privilege path are traversable; descriptive permissions such as GH_WriteEnterpriseSso remain non-traversable.
The collector runs successfully with the documented read-only permission set. Some higher-fidelity relationships require optional non-read-only permissions because GitHub exposes the supporting read APIs behind privileged permission names:
- Organization
Members: writeenables external group mapping collection for IdP-synced teams, which allows the converter to emitSCIM_Provisionededges fromSCIM_GrouptoGH_Team. This is useful when the organization uses team synchronization with an external identity provider; if no GitHub teams are linked to external groups, this permission does not add graph data. - Classic PAT scope
manage_runners:enterpriseenables enterprise self-hosted runner group and runner collection. This is useful when the enterprise has enterprise-scoped runner groups or runners, especially runner groups shared into organizations; if all runners are organization- or repository-scoped, this scope does not add graph data. - Repository
Administration: readenables deploy key collection. GitHub exposes repository deploy keys through an administration-scoped read endpoint, and the collector emitsGH_DeployKeynodes only when that endpoint is accessible.
If these optional permissions are not granted, OpenHound skips the affected resources and continues collecting the rest of the GitHub environment.
For organization installations limited to selected repositories, the collector
uses the enterprise installation's read-only organization-installation
repositories API to create exact GH_CanAccess edges. Grant the enterprise
installation Enterprise organization installations: read or Enterprise
organization installation repositories: read. Without either permission,
selected-repository edges are skipped; installations set to all continue to
use the collected organization repository inventory.
Installation discovery still uses each organization's API and requires Organization administration: read on that organization's credential. The enterprise permission alone does not discover installations. The selected-repository lookup runs one installation at a time and stops for the rest of a collection if GitHub rate-limits it after retries.
With GitHub Enterprise Cloud credentials, the collector uses the enterprise
credential inventory export to collect classic personal access tokens. It
requests the full inventory, stores every CSV row and its original field values
in the enterprise_credential_inventory resource, and currently models only
classic PAT rows. The export contains credential metadata, including owners,
scopes, authorization details, and token hashes used for audit correlation. It
does not contain plaintext PAT values. Limit access to the raw output to people
who need the credential inventory.
The enterprise GitHub App needs Enterprise credentials: read permission.
When collecting with a classic PAT instead of an app installation, that token
needs the read:enterprise scope. If an enterprise app also has
credentials.pat_token configured, the app remains the primary export
credential. The collector retries once with the PAT only when GitHub rejects
the app's export creation for authorization. It does not switch credentials
after an export starts or when GitHub reports a rate limit.
Rate-limit retry warnings identify the affected method and API path.
The CSV download is streamed, but the parsed export is held in memory as one raw record; very large enterprises may need a chunked raw-resource design.
GitHub limits the number of exports an enterprise can start per day. When the
last successful export was downloaded within the past 24 hours, the collector
downloads it again before trying to start a new export. If GitHub reports that
the saved export is gone, the collector starts a new one and polls until its
CSV is ready. GitHub may still reject a new export when its limit is reached.
The raw record's as_of value and each PAT node's inventory_as_of value
show when that snapshot was taken. An unavailable or denied export is logged
and does not stop other resources from collecting.
Classic PAT nodes include the owner, scopes, lifecycle dates, credential state, direct enterprise authorization, and total authorization count. Organization edges record authorizations reported in the export. The export does not enumerate repositories accessible to a classic PAT, so this collection does not emit classic PAT-to-repository access edges. Potential repository access can be derived from the token owner's repository roles and the token's scopes, subject to organization policy and SSO authorization; it is not a direct grant reported by the export. GitHub Enterprise Server and organization-only configurations skip this resource.
Follow the OpenHound GitHub collector docs to get started: