> ## Documentation Index
> Fetch the complete documentation index at: https://specterops-bp-2638-jira-forge.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Use Cortex XSOAR with BloodHound Enterprise

> Learn how to use Cortex XSOAR with BloodHound Enterprise to monitor and manage attack path findings.

<img noZoom src="https://mintcdn.com/specterops-bp-2638-jira-forge/5Uew_kPPp8q6O153/assets/enterprise-edition-pill-tag.svg?fit=max&auto=format&n=5Uew_kPPp8q6O153&q=85&s=de7dea31a6fd154646847bc416c5d8fa" alt="Applies to BloodHound Enterprise only" width="225" height="45" data-path="assets/enterprise-edition-pill-tag.svg" />

After you configure the integration, Cortex XSOAR begins fetching BloodHound Enterprise attack path findings as incidents. Use the sections below to monitor ingestion, view incidents, and inspect details.

<Tip>See [install and configure](/integrations/cortex-xsoar/configure) for setup steps and fetch interval settings.</Tip>

## Monitor ingestion and logs

You can view instance logs to confirm incidents are being fetched.

<Frame>
  <img src="https://mintcdn.com/specterops-bp-2638-jira-forge/r3ZjrR04lYGBYc5W/images/integrations/cortex-soar/monitor-logs.png?fit=max&auto=format&n=r3ZjrR04lYGBYc5W&q=85&s=e397567f90acfeb545c45de2203882b4" alt="Cortex XSOAR instance logs showing incident fetch activity for SpecterOpsBHE integration." width="1450" height="265" data-path="images/integrations/cortex-soar/monitor-logs.png" />
</Frame>

## View incidents

Open the **Incidents** view to see all fetched attack path incidents.

<Tip>Click any incident to open its details.</Tip>

<Frame>
  <img src="https://mintcdn.com/specterops-bp-2638-jira-forge/r3ZjrR04lYGBYc5W/images/integrations/cortex-soar/view-incidents.png?fit=max&auto=format&n=r3ZjrR04lYGBYc5W&q=85&s=9878380e220e882e0cab43efb39cce67" alt="Cortex XSOAR Incidents list showing SpecterOpsBHE attack path incidents." width="1913" height="905" data-path="images/integrations/cortex-soar/view-incidents.png" />
</Frame>

## Incident details

The incident details page includes key information about the attack path and related context:

* Incident name and ID
* Case details
* Quick View side panel with labels containing attack path data

<Frame>
  <img src="https://mintcdn.com/specterops-bp-2638-jira-forge/r3ZjrR04lYGBYc5W/images/integrations/cortex-soar/incident-details.png?fit=max&auto=format&n=r3ZjrR04lYGBYc5W&q=85&s=903879a81c62cd695eddd6025d201778" alt="Incident details view showing case details and Quick View labels for attack path data." width="1700" height="911" data-path="images/integrations/cortex-soar/incident-details.png" />
</Frame>

## Work Plan and playbook

Click the **Work Plan** tab to view the playbook. The SpecterOpsBHE playbook runs custom commands to retrieve object-related information and analyze attack paths. You can click each task or script to view its results.

<Frame>
  <img src="https://mintcdn.com/specterops-bp-2638-jira-forge/r3ZjrR04lYGBYc5W/images/integrations/cortex-soar/workplan-playbook.png?fit=max&auto=format&n=r3ZjrR04lYGBYc5W&q=85&s=9791ef079a03b0792f472196574b8f06" alt="Work Plan view showing the playbook tasks and scripts executed for the incident." width="1688" height="853" data-path="images/integrations/cortex-soar/workplan-playbook.png" />
</Frame>

## DBot panel

Use the DBot panel to review execution context and results. Locate the **root** section and expand it to see underlying data and command outputs related to the incident.

<Frame>
  <img src="https://mintcdn.com/specterops-bp-2638-jira-forge/r3ZjrR04lYGBYc5W/images/integrations/cortex-soar/dbot-panel.png?fit=max&auto=format&n=r3ZjrR04lYGBYc5W&q=85&s=fc7887ef89d71d89fec0a305da6654db" alt="DBot panel expanded to show root context and command outputs for the incident." width="1682" height="898" data-path="images/integrations/cortex-soar/dbot-panel.png" />
</Frame>
