-
Notifications
You must be signed in to change notification settings - Fork 19
Description
Hi !
I might found an issue when importing an MSSQLHound collection in Bloodhound CE. Here is a quick recap of the issue (with Claude Opus 4.5).
Description
When importing MSSQLHound data into a BloodHound database that already contains SharpHound data, the ingest fails with a constraint violation error.
The issue occurs because the MERGE statement creates a new node with label MSSQL_Base and then tries to add the Computer label, which violates the uniqueness constraint on Computer.objectid when the computer was already collected by SharpHound.
MSSQHound and Sharphound were used from a non-domain-joined machine.
Error message
time=2026-02-03T11:13:26.235Z level=ERROR message="Ingest task failed" task_id=2 file=mssql-bloodhound-20260127-180831.zip err="update nodes by error on statement (unwind $p as p merge (n:MSSQL_Base ) set n += p, n:MSSQL_Base, n:Computer, n:Base;): Neo4jError: Neo.ClientError.Schema.ConstraintValidationFailed (Node(99) already exists with label Computer and property objectid = 'S-1-5-21-REDACTED-147982')"
Steps to reproduce
- Run SharpHound collection from a non-domain-joined machine
- Ingest SharpHound data into BloodHound
- Run MSSQLHound collection from a non-domain joined machine
- Attempt to ingest MSSQLHound data into BloodHound
Expected behavior
MSSQLHound should merge with existing Computer nodes rather than attempting to create new ones. The MSSQL properties and labels should be added to the existing node.
Suggested fix
The query should MERGE on the existing Computer node instead of creating a new one:
MERGE (n:Computer {objectid:p.objectid})
SET n += p, n:MSSQL_Base, n:BaseEnvironment
- BloodHound CE version: v8.5.2
- Collection order: SharpHound first, then MSSQLHound
- Both collections run from non-domain joined machines
Best regards,