Bloodhound Neo4j Cheatsheet

In the Neo4j console, you can run your own queries to get data out of the Bloodhound database. This will be updated as I go.

Find all computers that have an unsupported Operating System.

MATCH (H:Computer) WHERE H.operatingsystem =~ '.(2000|2003|2008|xp|vista|7).' RETURN H.name, H.operatingsystem

Find all enabled users who are member of a particular group, such as Domain Admins.

MATCH (u:User)-[:MemberOf]->(g:Group {name:'DOMAIN [email protected]<domain>'}) WHERE u.enabled = TRUE return u.name

Find all users that contain a keyword.

MATCH (u:User) WHERE u.name CONTAINS "<keyword>" return u.name, u.displayname, u.description, u.group