BloodHound: a path diagram is a map, not an event

The picture is a graph of collected facts

Each node is an object the collection recorded: a user, a group, a computer. Each arrow is one relationship the collector stored, such as membership, a local-admin right, or a logon seen at collection time. The layout on screen is how the tool arranged those facts. It is not a timeline, and the order of arrows is not the order of anything a person did.

A path is one chain the tool could draw from that data. “Shortest” means fewest arrows in the model. It does not mean someone chose that chain, or that it is the only chain.

An edge is a relationship, not a use of it

A membership edge means the account was a member when the directory was read. A control edge means a right existed on an object. A session edge means a logon was observed in the data that was collected, not that the person is still signed in, and not that the logon was misused.

Nothing on the diagram is a record of a file being changed, a password being reset, or a sign-in succeeding. Those facts, if you need them, come from the audit log or the sign-in log, cited separately.

What goes under the picture

Keep the collection time in UTC, the collection method in a few words, and the list of edges with both object names. Say whether the picture is one path the tool drew or a count of many. If the data did not include workstation logons, say that session edges were not in this collection.

Do not write “compromised,” “used,” or “disable these accounts” from the picture alone. The sentence the picture supports is: these relationships were present in this collection.

Worked case: a chain that never became an incident

The lab graph, collected from directory data at 2026-11-03T09:00Z, draws Riley to the group Lab-File-Admins by membership, and that group to LAB-FILE-02 by local admin. No session edge is on the picture. A draft calls it “Riley accessed the file server this morning.”

The note quotes the two edges, both object names, and the collection time. It says the membership and the admin right were in the directory data. It does not say Riley signed in, opened a file, or should be disabled. The follow-up, if anyone wants that, is a sign-in or file-audit record, which this diagram does not contain.

Snippet

collected: 2026-11-03T09:00Z  source: directory data only
Riley --membership--> Lab-File-Admins --local admin--> LAB-FILE-02
supports: those two relationships were present
does not support: a sign-in, a file change, or a disable

Diagram

A path diagram versus an event

The picture is a map of rights and memberships at collection time.

What you may write

Nodes. The object names on the path

Edges. The relationship type printed on each arrow

When. The collection time, not “this morning” as an action

What you may not write

Use. That someone traversed the path

Now. That a session edge is still live

Action. That the accounts should be disabled

Check yourself

1. What does a BloodHound path diagram establish?

2. A session edge is on the diagram. Which reading fits?

3. Why is “shortest path” not a story of what happened?