Github collector for OpenHound
About
OpenHound is a standardized framework for building and running OpenGraph collectors and converters. It is built in Python and powered by the Data Load Tool (DLT) library, giving you a consistent workflow to collect, process, and convert data from any source into BloodHound-compatible graphs.
The openhound-github extension collects resources from Github organizations and transforms these into useable nodes and edges for BloodHound.
GitHub App JWT issuer
Enterprise GitHub App credentials accept either client_id or app_id as the
JWT issuer. When both are configured, client_id is preferred. At least one
identifier must be supplied together with key_path and enterprise_name.
GitHub Enterprise Server endpoints
GitHub.com is the default deployment and does not require endpoint configuration.
To collect from GitHub Enterprise Server, set both API endpoints in config.toml:
[sources.github]
rest_api_url = "https://ghe.example/api/v3"
graphql_url = "https://ghe.example/api/graphql"
Both values must be provided together when overriding the GitHub.com defaults.
Endpoint URLs must use HTTPS and share the same origin. GitHub App
credentials.api_uri may override only the path on that same origin.
Enterprise SCIM and hybrid correlations
A token with enterprise SCIM access is used to collect both /scim/v2/enterprises/{enterprise}/Users and /scim/v2/enterprises/{enterprise}/Groups. The collector emits normalized SCIM_Organization, SCIM_User, and SCIM_Group nodes plus SCIM_Contains, SCIM_MemberOf, and SCIM_Provisioned relationships. Install the BloodHound SCIM extension alongside this extension to register the shared SCIM kinds.
SOURCES__GITHUB__EMIT_LEGACY_SCIM_CORRELATIONS=true temporarily reproduces GitHound-style Okta-to-SCIM correlation relationships. It defaults to false because a dedicated hybrid correlator should own IdP-to-SCIM matching; GitHub remains authoritative for GitHub's SCIM resources and target-system provisioning relationships.
Enterprise roles, including the built-in members role, are emitted through GH_HasRole and granular enterprise capability relationships. Only capability relationships with a confirmed privilege path are traversable; descriptive permissions such as GH_WriteEnterpriseSso remain non-traversable.
Getting Started
Follow the OpenHound docs to get started:
Metadata
Release files for openhound-github 0.6.7
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| openhound_github-0.6.7.tar.gz | 3.6 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| openhound_github-0.6.7-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 3.8 MB
Release files / openhound_github-0.6.7.tar.gz
| Download URL | openhound_github-0.6.7.tar.gz |
|---|---|
| Size | 3.6 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
46a9fa3cfba2ff792e56a3919b8dd957a7963a79dd3fd3c47b77bd5b0c2102a3
|
|
BLAKE2b-256 checksum How to use checksums |
149ac3722cd6c6079a1a9b49a3d1d03d0e3afd1f7aceefa5471de140aeed22b3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.12.7 {"installer":{"name":"uv","version":"0.12.7","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / openhound_github-0.6.7-py3-none-any.whl
| Download URL | openhound_github-0.6.7-py3-none-any.whl |
|---|---|
| Size | 148.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
aed11423c058b25994268bbd4c336c7b89e37591ab6a529abc14bcd7af98e73e
|
|
BLAKE2b-256 checksum How to use checksums |
edf92718876d675fe680e6d8344edfa4286204110b9f3ce5f0d595435c43f58c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.12.7 {"installer":{"name":"uv","version":"0.12.7","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
