Collection doc fixes#296
Conversation
Add the current SharpHound collection methods and align the port check timeout example with the documented flag.
Use the existing automatic domain controller selection phrasing in the SharpHound Enterprise client setup table.
Replace Domain Admin guidance with least-privilege direction and fix the scheduled task script path.
Clarify that data collection schedules can use an existing SharpHound Enterprise or AzureHound Enterprise collector client.
Clarify that collecting AzureHound signInActivity with AuditLog.Read.All requires a Microsoft Entra ID P1 or P2 license.
Add tenant and subscription read actions to the AzureHound Reader role definition and scripted configuration example.
Remove Domain Admin and Protected Users as collection permission steps, explain implicit Domain Admin local admin access, and fix the scheduled task principal example.
Clarify that on-demand scans can use an existing SharpHound Enterprise or AzureHound Enterprise collector client.
|
Warning Review limit reached
More reviews will be available in 50 minutes and 2 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThis PR updates documentation across the BloodHound docs repository to expand Azure role permissions, clarify AzureHound Enterprise support in multiple workflows, refine SharpHound Community Edition gMSA configuration guidance, and correct collection method flags. All changes are documentation-only. ChangesDocumentation Updates for Azure Permissions, Enterprise Features, and Collection Methods
🎯 2 (Simple) | ⏱️ ~10 minutes Possibly Related PRs
Suggested Labels
Suggested Reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/collect-data/enterprise-collection/collection-schedule.mdx (1)
3-3:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winUpdate description to reflect AzureHound Enterprise support.
The frontmatter description mentions only "SharpHound Enterprise collector client" but the prerequisite (line 20) now includes AzureHound Enterprise. Update the description to be inclusive of both collector types.
📝 Proposed fix
-description: Learn how to configure a SharpHound Enterprise collector client to run data collection on a schedule. +description: Learn how to configure a SharpHound Enterprise or AzureHound Enterprise collector client to run data collection on a schedule.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/collect-data/enterprise-collection/collection-schedule.mdx` at line 3, Update the frontmatter "description" value to mention both SharpHound and AzureHound Enterprise collectors (e.g., "Learn how to configure a SharpHound or AzureHound Enterprise collector client to run data collection on a schedule.") so it matches the prerequisite that now references AzureHound Enterprise; modify the description key in the document frontmatter accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/collect-data/ce-collection/create-gmsa-community-edition.mdx`:
- Line 97: Replace both occurrences of the incorrect logon type by updating the
New-ScheduledTaskPrincipal calls: change each instance of the argument
"-LogonType Password" to "-LogonType ServiceAccount" so the scheduled task
principal uses the ServiceAccount logon method appropriate for gMSA-managed
credentials.
---
Outside diff comments:
In `@docs/collect-data/enterprise-collection/collection-schedule.mdx`:
- Line 3: Update the frontmatter "description" value to mention both SharpHound
and AzureHound Enterprise collectors (e.g., "Learn how to configure a SharpHound
or AzureHound Enterprise collector client to run data collection on a
schedule.") so it matches the prerequisite that now references AzureHound
Enterprise; modify the description key in the document frontmatter accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 65783eae-fb66-4917-acca-469f1d324321
📒 Files selected for processing (8)
docs/assets/azurehound-reader-role.jsondocs/collect-data/ce-collection/create-gmsa-community-edition.mdxdocs/collect-data/ce-collection/sharphound-flags.mdxdocs/collect-data/enterprise-collection/collection-schedule.mdxdocs/collect-data/enterprise-collection/create-collector.mdxdocs/collect-data/enterprise-collection/on-demand-scan.mdxdocs/install-data-collector/install-azurehound/azure-configuration.mdxdocs/snippets/hounds/azurehound-entra-id-permissions.mdx
There was a problem hiding this comment.
♻️ Duplicate comments (2)
docs/collect-data/ce-collection/create-gmsa-community-edition.mdx (2)
164-164:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winUpdate gMSA scheduled task principal
-LogonType.Change
-LogonType Passwordto-LogonType ServiceAccountto match the correct logon type for gMSA managed credentials.🔧 Proposed fix
-$principal = New-ScheduledTaskPrincipal -UserID "$($env:USERDOMAIN)\t0_gMSA_SHS$" -LogonType Password -RunLevel Highest +$principal = New-ScheduledTaskPrincipal -UserID "$($env:USERDOMAIN)\t0_gMSA_SHS$" -LogonType ServiceAccount -RunLevel Highest🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/collect-data/ce-collection/create-gmsa-community-edition.mdx` at line 164, Update the New-ScheduledTaskPrincipal invocation that sets $principal to use the correct gMSA logon type: change the -LogonType argument on the New-ScheduledTaskPrincipal call (where $principal is created) from Password to ServiceAccount so the scheduled task principal uses the gMSA ServiceAccount logon type.
119-119:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winUpdate gMSA scheduled task principal
-LogonType.Change
-LogonType Passwordto-LogonType ServiceAccount. For gMSA accounts,ServiceAccountis the appropriate logon type that Task Scheduler uses for managed credentials, as confirmed by the past review.🔧 Proposed fix
- $ap = New-ScheduledTaskPrincipal -UserID "$($env:USERDOMAIN)\t0_gMSA_SHS$" -LogonType Password -RunLevel Highest + $ap = New-ScheduledTaskPrincipal -UserID "$($env:USERDOMAIN)\t0_gMSA_SHS$" -LogonType ServiceAccount -RunLevel Highest🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/collect-data/ce-collection/create-gmsa-community-edition.mdx` at line 119, Update the New-ScheduledTaskPrincipal invocation to use the correct logon type for gMSA by changing the -LogonType value: locate the call to New-ScheduledTaskPrincipal (the line creating $ap) and replace -LogonType Password with -LogonType ServiceAccount so the scheduled task uses the ServiceAccount logon type appropriate for gMSA accounts.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@docs/collect-data/ce-collection/create-gmsa-community-edition.mdx`:
- Line 164: Update the New-ScheduledTaskPrincipal invocation that sets
$principal to use the correct gMSA logon type: change the -LogonType argument on
the New-ScheduledTaskPrincipal call (where $principal is created) from Password
to ServiceAccount so the scheduled task principal uses the gMSA ServiceAccount
logon type.
- Line 119: Update the New-ScheduledTaskPrincipal invocation to use the correct
logon type for gMSA by changing the -LogonType value: locate the call to
New-ScheduledTaskPrincipal (the line creating $ap) and replace -LogonType
Password with -LogonType ServiceAccount so the scheduled task uses the
ServiceAccount logon type appropriate for gMSA accounts.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 10bea64f-3d0f-4323-a9d9-41cd41664c2f
⛔ Files ignored due to path filters (3)
docs/assets/sharphound-gmsa-directory-structure.pngis excluded by!**/*.pngdocs/assets/sharphound-gmsa-powershell-env-commands.pngis excluded by!**/*.pngdocs/assets/sharphound-gmsa-powershell-script.pngis excluded by!**/*.png
📒 Files selected for processing (2)
docs/collect-data/ce-collection/create-gmsa-community-edition.mdxdocs/collect-data/enterprise-collection/collection-schedule.mdx
✅ Files skipped from review due to trivial changes (1)
- docs/collect-data/enterprise-collection/collection-schedule.mdx
jeff-matthews
left a comment
jeff-matthews
left a comment
There was a problem hiding this comment.
Thanks for the PR @martinsohn!
Approved, with one tiny punctuation suggestion.
Co-authored-by: Jeff Matthews <jmatthews@specterops.io>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/collect-data/ce-collection/create-gmsa-community-edition.mdx`:
- Around line 155-157: Convert the plain-text line "Modify the scheduled task to
run as the gMSA account with PowerShell" into a proper subsection heading (so it
appears in the TOC and page structure) and replace the awkward phrase "Either
using:" with a tighter phrase such as "Use one of the following methods:" so the
flow is clear; locate these strings in the document to apply the changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ce2d9b8e-544b-4f0f-ab47-94ee7cc64099
📒 Files selected for processing (1)
docs/collect-data/ce-collection/create-gmsa-community-edition.mdx
2 participants
This PR fixes several data collection documentation inaccuracies and aligns collector guidance with current SharpHound behavior.
docs/collect-data/ce-collection/sharphound-flags.mdx, adding missing methods and correcting the port check timeout flag example.docs/collect-data/ce-collection/create-gmsa-community-edition.mdx, removing Domain Admin as a recommended path and pointing users toward explicit local admin assignment or least-privilege delegation.docs/collect-data/ce-collection/create-gmsa-community-edition.mdx, including consistentDOMAIN\t0_gMSA_SHS$placeholder usage and a workingSet-ScheduledTaskPowerShell example.docs/collect-data/enterprise-collection/create-collector.mdxto say SharpHound automatically selects a Domain Controller for LDAP queries.docs/collect-data/enterprise-collection/collection-schedule.mdxanddocs/collect-data/enterprise-collection/on-demand-scan.mdx.docs/assets/azurehound-reader-role.jsonand the scripted config example indocs/install-data-collector/install-azurehound/azure-configuration.mdxwith tenant and subscription read actions. Collection without them will work, but the implicit permissions are undocumented by Microsoft, and they should be explicitly granted for assurance.docs/snippets/hounds/azurehound-entra-id-permissions.mdxanddocs/install-data-collector/install-azurehound/azure-configuration.mdx, including the Entra ID P1/P2 license requirement forAuditLog.Read.All.Summary by CodeRabbit