> ## Documentation Index
> Fetch the complete documentation index at: https://specterops-bp-2735-release-notes.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Use Cortex XSOAR with BloodHound Enterprise

> Learn how to use Cortex XSOAR with BloodHound Enterprise to monitor and manage attack path findings.

<img noZoom src="https://mintcdn.com/specterops-bp-2735-release-notes/2djt2Sp9UeFPjBFr/assets/enterprise-edition-pill-tag.svg?fit=max&auto=format&n=2djt2Sp9UeFPjBFr&q=85&s=f1e5b5b68b628fd10faf78983d19efbf" alt="Applies to BloodHound Enterprise only" width="225" height="45" data-path="assets/enterprise-edition-pill-tag.svg" />

After you configure the integration, Cortex XSOAR begins fetching BloodHound Enterprise attack path findings as incidents. Use the sections below to monitor ingestion, view incidents, and inspect details.

<Tip>See [install and configure](/integrations/cortex-xsoar/configure) for setup steps and fetch interval settings.</Tip>

## Monitor ingestion and logs

You can view instance logs to confirm incidents are being fetched.

<Frame>
  <img src="https://mintcdn.com/specterops-bp-2735-release-notes/JRxjxGtPjT-Lu7sy/images/integrations/cortex-soar/monitor-logs.png?fit=max&auto=format&n=JRxjxGtPjT-Lu7sy&q=85&s=e51fa9b84227e775fac7813130215d8e" alt="Cortex XSOAR instance logs showing incident fetch activity for SpecterOpsBHE integration." width="1450" height="265" data-path="images/integrations/cortex-soar/monitor-logs.png" />
</Frame>

## View incidents

Open the **Incidents** view to see all fetched attack path incidents.

<Tip>Click any incident to open its details.</Tip>

<Frame>
  <img src="https://mintcdn.com/specterops-bp-2735-release-notes/JRxjxGtPjT-Lu7sy/images/integrations/cortex-soar/view-incidents.png?fit=max&auto=format&n=JRxjxGtPjT-Lu7sy&q=85&s=0129c60fb48f11da3025269ccb6ff208" alt="Cortex XSOAR Incidents list showing SpecterOpsBHE attack path incidents." width="1913" height="905" data-path="images/integrations/cortex-soar/view-incidents.png" />
</Frame>

## Incident details

The incident details page includes key information about the attack path and related context:

* Incident name and ID
* Case details
* Quick View side panel with labels containing attack path data

<Frame>
  <img src="https://mintcdn.com/specterops-bp-2735-release-notes/JRxjxGtPjT-Lu7sy/images/integrations/cortex-soar/incident-details.png?fit=max&auto=format&n=JRxjxGtPjT-Lu7sy&q=85&s=66f4664b0bf2552c1586b8f25bca9422" alt="Incident details view showing case details and Quick View labels for attack path data." width="1700" height="911" data-path="images/integrations/cortex-soar/incident-details.png" />
</Frame>

## Work Plan and playbook

Click the **Work Plan** tab to view the playbook. The SpecterOpsBHE playbook runs custom commands to retrieve object-related information and analyze attack paths. You can click each task or script to view its results.

<Frame>
  <img src="https://mintcdn.com/specterops-bp-2735-release-notes/JRxjxGtPjT-Lu7sy/images/integrations/cortex-soar/workplan-playbook.png?fit=max&auto=format&n=JRxjxGtPjT-Lu7sy&q=85&s=581870427b8e344d74b8e55c96b69734" alt="Work Plan view showing the playbook tasks and scripts executed for the incident." width="1688" height="853" data-path="images/integrations/cortex-soar/workplan-playbook.png" />
</Frame>

## DBot panel

Use the DBot panel to review execution context and results. Locate the **root** section and expand it to see underlying data and command outputs related to the incident.

<Frame>
  <img src="https://mintcdn.com/specterops-bp-2735-release-notes/JRxjxGtPjT-Lu7sy/images/integrations/cortex-soar/dbot-panel.png?fit=max&auto=format&n=JRxjxGtPjT-Lu7sy&q=85&s=dd2834e978f6e4dbacf0e4c9fddd2ec3" alt="DBot panel expanded to show root context and command outputs for the incident." width="1682" height="898" data-path="images/integrations/cortex-soar/dbot-panel.png" />
</Frame>
