Workbooks in Microsoft Sentinel provide interactive dashboards that help you review and investigate data.
The BloodHound Enterprise integration includes workbooks that visualize attack path data, audit logs, posture trends, and Tier Zero asset exposure.
You can also use Microsoft Sentinel’s incident management capabilities to triage and track remediation of BloodHound Enterprise findings.
Dashboards
Explore the following dashboards to review BloodHound Enterprise data in Microsoft Sentinel.
Attack Path Overview
Use this dashboard for high-level attack path trends across environments:
- Total attack paths by environment
- Exposure-oriented metrics such as expected compromise indicators
- Tier distribution context
- Environment filtering for focused analysis
Attack Path Details
Use this dashboard to investigate individual paths and prioritize remediation:
- Timeline and state changes for path findings
- Affected principals and related objects
- Exposure and impact context
- Remediation-linked context for triage
Audit Logs
Use this dashboard to monitor security-relevant operational changes:
- Create/update/delete activity timeline
- Actor and object context
- Environment-level filtering
Posture
Use this dashboard to monitor posture and progress over time:
- Posture trend metrics
- Service/control health indicators
- Environment-to-environment comparison
Tier Zero Assets
Use this dashboard to prioritize highest-impact exposure:
- Tier Zero principal inventory
- Exposure-oriented prioritization indicators
- Relationship context for critical assets
Work with incidents
Analytics Rules generate incidents from BloodHound Enterprise findings in custom log tables.
- In Microsoft Sentinel, open Incidents.
- Filter by BloodHound-related product/source fields.
- Triage, assign, and track remediation in your incident workflow.
Use incidents for operational ownership and dashboards for trend/coverage analysis.
Multi-environment analysis
Use environment filters across dashboards to compare business units, regions, or segmented environments.
- View one environment in isolation.
- Compare multiple environments side-by-side.
- Reduce noise by excluding non-relevant environments.
Data scope and freshness
Dashboard and incident views reflect connector configuration choices:
- Environment and finding-type selection
- Polling cadence
- Initial lookback window (
Lookup Days)
- Deduplication behavior favoring latest event state
