openhound-github 0.18.0

Github collector for OpenHound

About

OpenHound is a standardized framework for building and running OpenGraph collectors and converters. It is built in Python and powered by the Data Load Tool (DLT) library, giving you a consistent workflow to collect, process, and convert data from any source into BloodHound-compatible graphs.

The openhound-github extension collects resources from Github organizations and transforms these into useable nodes and edges for BloodHound.

GitHub App JWT issuer

Enterprise GitHub App credentials accept either client_id or app_id as the JWT issuer. When both are configured, client_id is preferred. At least one identifier must be supplied together with key_path and enterprise_name.

GitHub Enterprise Server endpoints

GitHub.com is the default deployment and does not require endpoint configuration. To collect from GitHub Enterprise Server, set both API endpoints in config.toml:

[sources.github]
rest_api_url = "https://ghe.example/api/v3"
graphql_url = "https://ghe.example/api/graphql"

Both values must be provided together when overriding the GitHub.com defaults. Endpoint URLs must use HTTPS and share the same origin. GitHub App credentials.api_uri may override only the path on that same origin.

Enterprise SCIM and hybrid correlations

A token with enterprise SCIM access is used to collect both /scim/v2/enterprises/{enterprise}/Users and /scim/v2/enterprises/{enterprise}/Groups. The collector emits normalized SCIM_Organization, SCIM_User, and SCIM_Group nodes plus SCIM_Contains, SCIM_MemberOf, and SCIM_Provisioned relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.

SOURCES__GITHUB__EMIT_LEGACY_SCIM_CORRELATIONS=true temporarily reproduces GitHound-style Okta-to-SCIM correlation relationships. It defaults to false because a dedicated hybrid correlator should own IdP-to-SCIM matching; GitHub remains authoritative for GitHub's SCIM resources and target-system provisioning relationships.

Enterprise roles, including the built-in members role, are emitted through GH_HasRole and granular enterprise capability relationships. Only capability relationships with a confirmed privilege path are traversable; descriptive permissions such as GH_WriteEnterpriseSso remain non-traversable.

Optional privileged collection

The collector runs successfully with the documented read-only permission set. Some higher-fidelity relationships require optional non-read-only permissions because GitHub exposes the supporting read APIs behind privileged permission names:

• Organization Members: write enables external group mapping collection for IdP-synced teams, which allows the converter to emit SCIM_Provisioned edges from SCIM_Group to GH_Team. This is useful when the organization uses team synchronization with an external identity provider; if no GitHub teams are linked to external groups, this permission does not add graph data.
• Classic PAT scope manage_runners:enterprise enables enterprise self-hosted runner group and runner collection. This is useful when the enterprise has enterprise-scoped runner groups or runners, especially runner groups shared into organizations; if all runners are organization- or repository-scoped, this scope does not add graph data.
• Repository Administration: read enables deploy key collection. GitHub exposes repository deploy keys through an administration-scoped read endpoint, and the collector emits GH_DeployKey nodes only when that endpoint is accessible.

If these optional permissions are not granted, OpenHound skips the affected resources and continues collecting the rest of the GitHub environment.

Classic personal access token inventory

With GitHub Enterprise Cloud credentials, the collector uses the enterprise credential inventory export to collect classic personal access tokens. It requests the full inventory, stores every CSV row and its original field values in the enterprise_credential_inventory resource, and currently models only classic PAT rows. The export contains credential metadata, including owners, scopes, authorization details, and token hashes used for audit correlation. It does not contain plaintext PAT values. Limit access to the raw output to people who need the credential inventory.

The enterprise GitHub App needs Enterprise credentials: read permission. When collecting with a classic PAT instead of an app installation, that token needs the read:enterprise scope. If an enterprise app also has credentials.pat_token configured, the app remains the primary export credential. The collector retries once with the PAT only when GitHub rejects the app's export creation for authorization. It does not switch credentials after an export starts or when GitHub reports a rate limit.

Rate-limit retry warnings identify the affected method and API path.

The CSV download is streamed, but the parsed export is held in memory as one raw record; very large enterprises may need a chunked raw-resource design.

GitHub limits the number of exports an enterprise can start per day. When the last successful export was downloaded within the past 24 hours, the collector downloads it again before trying to start a new export. If GitHub reports that the saved export is gone, the collector starts a new one and polls until its CSV is ready. GitHub may still reject a new export when its limit is reached. The raw record's as_of value and each PAT node's inventory_as_of value show when that snapshot was taken. An unavailable or denied export is logged and does not stop other resources from collecting.

Classic PAT nodes include the owner, scopes, lifecycle dates, credential state, direct enterprise authorization, and total authorization count. Organization edges record authorizations reported in the export. The export does not enumerate repositories accessible to a classic PAT, so this collection does not emit classic PAT-to-repository access edges. Potential repository access can be derived from the token owner's repository roles and the token's scopes, subject to organization policy and SSO authorization; it is not a direct grant reported by the export. GitHub Enterprise Server and organization-only configurations skip this resource.

Getting Started

Follow the OpenHound GitHub collector docs to get started:

• GitHub collector overview
• Configure the collector
• Configure an organization GitHub App
• Configure an enterprise GitHub App
• Configure a personal access token