Skip to content
Andy Robbins edited this page Aug 8, 2016 · 4 revisions

CSV Ingestion

Export-BloodHoundCSV takes the custom tagged PowerView object types from Get-BloodHoundData and exports the data to one custom CSV file per object type (sessions, local admin, domain trusts, etc.). For user session data without a logon domain, by default the global catalog is used to attempt to deconflict what domain the user may be located in. If the user exists in more than one domain in the forest, a series of weights is used to modify the attack path likelihood. If you want to skip this global catalog deconfliction approach, specify the -SkipGCDeconfliction flag. The *-CSVFolder C:\Temp* parameter will modify the folder that the files are output to, and -CSVPrefix domainX will prepend the specified flag to the beginning of each output file. An example use case would be Get-BloodHoundData | Export-BloodHoundCSV which would output data to group_memberships.csv, local_admins.csv, trusts.csv, and user_sessions.csv.

To upload the .csv files to BloodHound, use the "Upload Data" button on the right size, then select the .csv's file you would like to upload:

CSV ingestion