Fix nodes missing reserved name/displayname properties (#19)#20
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linked Issue
Closes #19
Root Cause
BloodHound's OpenGraph schema reserves the lowercase
nameanddisplaynameproperties for a node's label, tooltip, and search index. The collector set a camelCasedisplayNameon the KeyCredential node — which the ingestor treats as an ordinary custom property, not the reserved label — and never setname. Key-material nodes set onlyKeyTypeand raw key parameters, so they had no label property at all and rendered unlabeled.Fix Description
displayNamewith the reserved lowercasenameanddisplayname, both set to the credentialIdentifier, falling back toUnknown-<n>when the identifier is empty (mirroring the existing id fallback).nameanddisplaynamefrom the already-populatedKeyTypeproperty, defaulting toUnknown Key Materialwhen no type matched.The
KeyTypeproperty and all key parameter properties are left unchanged, so the only behavioral change is the addition of correct label properties.How Verified
Static: every node now sets a non-empty lowercase
name(KeyCredential nodes fromIdentifier/fallback at the new L62-L69; key-material nodes fromKeyType/fallback after the detection chain), so each node has a searchable label.go build ./...,go vet ./..., andgofmt -l parse.go(no output) all pass.Test Coverage
None:
ParseResultsconsumes*ldap.Entryvalues populated from a live directory and a parsedmsDS-KeyCredentialLinkblob; constructing those fixtures is non-trivial and there is no existing test harness in the repo. The change only adds reserved label properties.Scope of Change
parse.go