> ## Documentation Index
> Fetch the complete documentation index at: https://specterops-bp-2731-onprem-architecture.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> Understand the architecture, components, and data flow of on-premises deployments of BloodHound Enterprise.

<img noZoom src="https://mintcdn.com/specterops-bp-2731-onprem-architecture/cSg9r7u_qWc5sQQj/assets/enterprise-edition-pill-tag.svg?fit=max&auto=format&n=cSg9r7u_qWc5sQQj&q=85&s=d27b3f5d9c71cdbac144a37e7633395b" alt="Applies to BloodHound Enterprise only" width="225" height="45" data-path="assets/enterprise-edition-pill-tag.svg" />

On-premises deployments of BloodHound Enterprise give you full control over your deployment infrastructure while maintaining the same powerful identity security capabilities as the SaaS version.

## Deployment architecture

An on-premises deployment of BloodHound Enterprise centers on a dedicated host that runs the application stack and one or more separate collector hosts that gather identity data from your environment.

<Note>
  The following diagram shows where the components run and how collected data moves toward BloodHound Enterprise. The sections that follow the diagram describe the components and data flow in more detail.
</Note>

<img src="https://mintcdn.com/specterops-bp-2731-onprem-architecture/hohXO9JfN4-k74qe/images/on-premises/on-prem-architecture-diagram.drawio.svg?fit=max&auto=format&n=hohXO9JfN4-k74qe&q=85&s=4cffa4513ff3c89e6fb217bce954e214" alt="A diagram showing the architecture of an on-premises deployment of BloodHound Enterprise" width="1726" height="811" data-path="images/on-premises/on-prem-architecture-diagram.drawio.svg" />

<AccordionGroup>
  <Accordion title="Who initiates the connection?">
    Data flows toward BloodHound Enterprise, but the collector initiates every session. The collector pulls data from your environment and then sends the results to BloodHound Enterprise.
  </Accordion>

  <Accordion title="Does this create inbound risk for domain controllers?">
    No. The inbound rules in an on-premises deployment apply to the BloodHound Enterprise host, not to your domain controllers.

    Communication with domain controllers is outbound from a collector that you own, using services and ports that your domain controllers already expose. From a firewall perspective, this typically looks like read-only collector traffic to domain services plus a single HTTPS (`443`) egress path to BloodHound Enterprise.
  </Accordion>
</AccordionGroup>

### Core components

All on-premises deployments include the following core application components:

| Component                 | Purpose                                                                                    |
| ------------------------- | ------------------------------------------------------------------------------------------ |
| **BloodHound Enterprise** | Application server, REST API, user interface (UI), graph analysis, and collector ingestion |
| **PostgreSQL 18.x**       | Database server for application data and graph storage                                     |

### Deployment-specific components

Embedded cluster deployments include the following infrastructure and management components:

| Component                                     | Purpose                                                                                                                                                                                                              |
| --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **k0s Kubernetes distribution**               | Bundled Kubernetes distribution that runs BloodHound Enterprise on your Linux host                                                                                                                                   |
| **Embedded ingress controller**               | Exposes the BloodHound Enterprise application endpoint and terminates HTTPS for the configured FQDN by default                                                                                                       |
| **Installation Wizard**                       | Host-local web UI that completes configuration and runs <Tooltip tip="Automated checks that verify your Kubernetes cluster is ready for a BloodHound Enterprise installation or upgrade.">preflight checks</Tooltip> |
| **SpecterOps - BloodHound Enterprise Portal** | Hosted portal that provides installer access, generates deployment-specific installation commands, and tracks online installations and updates                                                                       |

### Data collectors

Collectors run separately from the BloodHound Enterprise host and gather configuration data from your identity infrastructure:

| Collector                 | Target Environment                                      | Data Collected                                                                              |
| ------------------------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| **SharpHound Enterprise** | Active Directory                                        | AD objects, relationships, ACLs, sessions                                                   |
| **AzureHound Enterprise** | Azure / Entra ID                                        | Azure AD objects, role assignments, resource relationships                                  |
| **OpenHound**             | Other identity providers, platforms, and custom sources | Varies by source; data collected and converted into BloodHound Enterprise-compatible graphs |

## Data flow

Data flows through the system in the following sequence:

1. **Collection** - Collectors gather configuration data from Active Directory, Entra ID, or other identity sources
2. **Transmission** - Data is transmitted over encrypted HTTPS/TLS to the BloodHound Enterprise API
3. **Processing** - The BloodHound Enterprise API processes and stores data in PostgreSQL
4. **Analysis** - Graph analysis identifies privilege relationships and Attack Paths
5. **Visualization** - Results are displayed in the BloodHound Enterprise UI

<Note>
  Collectors have zero local storage of collected data. All data is transmitted directly to the BloodHound Enterprise host and stored in PostgreSQL.
</Note>