openhound-collector-common
Shared pure-Python, in-process infrastructure for OpenHound on-prem / Windows-auth
collectors. Factored out of the SCCM extension so collectors (starting with mssql) reuse
one implementation of the hard parts instead of copying them.
No child processes, no native database/auth binaries — TDS, NTLM, Kerberos, EPA channel
binding, SPNEGO, LDAP, WMI, and SOCKS5 are all done in Python via impacket / ldap3 /
pywin32 and the stdlib.
Layout (built incrementally)
| Subpackage | Purpose |
|---|---|
clients/mssql.py |
TDS + TLS-over-TDS + NTLMv2 (EPA CBT/SPN) + Kerberos + SSPI; EPA detection. TLS-1.2 cap. |
clients/auth.py |
Kerberos AP-REQ/SPNEGO + NTLM + current-user SSPI token minting. |
clients/ad.py |
LDAP transport×bind waterfall (lockout-safe), SPN search, SID→AD-object resolution. |
clients/wmi.py |
WMI over impacket DCOM + pywin32 (Win32_GroupUser, Win32_Service). |
discovery/dns.py |
DC/SRV/A discovery + DNS resolver override (proxy-aware). |
dlt/source_bridge.py |
push→pull DLT emit-resource bridge for multi-target collection. |
dlt/convert_pipeline.py |
convert-reads-DuckDB (self-run pipeline + opengraph_file + no-op source). |
dlt/duckdb_safe.py |
_safe/_ensure_columns/_arr defenses against dlt column-dropping. |
logging/log_context.py |
VERBOSE tier + [target]/[phase] contextvar tagging. |
graph/stub_node.py, graph/graph_edge.py |
generic edge model + edge-endpoint stub backfill. |
proxy/socks.py |
pure-Python SOCKS5 dialer. |
orchestration/run.py |
After convert, run_end_to_end flat-zips the emitted graph *.json into the graph dir (name from graph_zip_name, default <app.name>_collection.zip), ready for BloodHound File Ingest (loose files kept). |
Consumers
- ConfigManBearPig 2.0 (PyPI:
configmanbearpig) — the SCCM collector. Depends on a published, capped release (>=0.1.0,<0.2.0). mssql— the in-progress MSSQL collector.
This is a library: it has no CLI and is never installed on its own by an end user. It arrives as a transitive dependency when someone installs a collector:
uv tool install openhound --with configmanbearpig
Developing
See DEVELOPMENT.md — including how to work on this library and a collector at the same time without reinstalling after every edit.
License
Apache-2.0 (see LICENSE). This code was factored out of the SCCM collector, itself a port of
the Apache-2.0 ConfigManBearPig.ps1, so it inherits those terms.
1 maintainer
Metadata
1 maintainer
Release files for openhound-collector-common 0.1.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| openhound_collector_common-0.1.1.tar.gz | 177.0 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| openhound_collector_common-0.1.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 278.0 kB
Release files / openhound_collector_common-0.1.1.tar.gz
| Download URL | openhound_collector_common-0.1.1.tar.gz |
|---|---|
| Size | 177.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
5b4763dd9c43f3e2c0de5daef75e4fede6a58eec2b71cd928ec56d4b53c6fc20
|
|
BLAKE2b-256 checksum How to use checksums |
330449c0c8cdc23932765b94cf9f5c4cf8aab40cb0815331e75569bd4d7b535a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.12.0 {"installer":{"name":"uv","version":"0.12.0","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / openhound_collector_common-0.1.1-py3-none-any.whl
| Download URL | openhound_collector_common-0.1.1-py3-none-any.whl |
|---|---|
| Size | 101.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f82c5a35a9a2c0d51a67b1aedd13070158bc19d808feb3f85f2890bb79ff1427
|
|
BLAKE2b-256 checksum How to use checksums |
8ba29c992803cc2b1a0d3558af4c2b8efd1761435963a31815e4cf76626602be
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.12.0 {"installer":{"name":"uv","version":"0.12.0","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
