BloodHound: a high-value mark is a tag

The mark is data on the node

BloodHound can show a node as high value. That mark is a tag in the database you are looking at. Some tags come from the collector’s rules for the lab domain. Some were checked by the person who imported the zip. The mark is not a timestamp of an action, and it is not a sentence that someone reached the object.

A node without the mark is not “safe.” The tag only says whether this database labeled it. Absence of the tag is not a finding that the object is unprivileged.

The tag belongs to the database you opened

A mark you added after import lives in that database. A second zip, loaded fresh, does not automatically carry your checkbox. If the note says high value, name the zip or the database. Do not copy the tag onto a picture from a collection that does not show it.

The object id still identifies the node. The tag is extra. Do not replace the id with the words “high value.”

What to file

File the object id, the display name, the zip or database name, and the words “high-value tag: present” or “not marked.” If a person checked the box, say who. Do not file an incident, a disable, or a ticket number the tag does not contain.

Worked case: a lab computer marked for the exercise

In the database loaded from lab-dconly-thursday.zip, the operator marked LAB-APP-04 high value so the exercise could see a tagged computer. A draft says LAB-APP-04 was attacked because it is high value.

The note quotes the object id, the name, the zip, and “high-value tag: present, checked for the exercise.” There is no event time and no ticket. The tag stays a label. The attack sentence is removed.

zip: lab-dconly-thursday.zip
name: LAB-APP-04
high-value tag: present, checked for the exercise
event time: none on the tag
write: tag plus zip
not: the computer was attacked