Skip to content

BED-7975: Add support for log upload & download (support bundles)#17

Draft
StranDutton wants to merge 2 commits into
mainfrom
feature/BED-7975-support-bundle-upload
Draft

BED-7975: Add support for log upload & download (support bundles)#17
StranDutton wants to merge 2 commits into
mainfrom
feature/BED-7975-support-bundle-upload

Conversation

@StranDutton
Copy link
Copy Markdown

@StranDutton StranDutton commented Jun 2, 2026

Resolves BED-7975.

DRAFT - not ready for review

Draft Status:

  • Awaiting BED-8266 (GET /api/v2/clients/management endpoint) to confirm final response field names and enum values.
  • Currently designed against assumed response shape pending BHE API confirmation.

Implements support for collecting and uploading OpenHound logs to BloodHound Enterprise as a support bundle.
The collector now polls for management operations, creates zipped bundles of platform and job logs, and uploads them when triggered by BHE administrators.

Changes:

New support bundle module (src/openhound/core/support_bundle.py):

  • Log collection and zipping functionality that creates bundles in the format <collector_name>_support_bundle_YYYY-MM-DD-HH-MM-SS.zip per acceptance criteria

Management API models (updated src/openhound/core/clients/models/jobs.py):

  • New ManagementOperation, ManagementAvailable, and enum classes (ManagementOperationType, ManagementOperationStatus) to model the /api/v2/clients/management endpoint response

Client methods (updated src/openhound/core/clients/bloodhound_enterprise.py):

  • New management_available property and upload_support_bundle() method for uploading zips with Content-Type: application/zip

Poll loop integration (updated src/openhound/scheduler/service.py):

  • Management operations are now checked first before collection jobs, with support bundle uploads executing synchronously to prevent concurrent job processing

Included test coverage (updated tests/test_bhe_job_scheduling.py):

  • validate log collection, zip creation, upload flow, error handling, and poll sequence ordering

Also added AGENTS.md so there's more awareness about the required branch naming convention.

Technical Details:

  • Support bundle uploads block job processing until complete
  • Temporary zip files are cleaned up regardless of upload success or failure
  • Glob patterns capture platform logs (openhound.log*) and job logs (ext_.log)
  • Falls through gracefully to job processing if management endpoint is unavailable or disabled

- Add management polling via GET /api/v2/clients/management before each
  job poll cycle so management operations take priority over collections.
- Add support_bundle module: collect_log_files() gathers openhound.log
  and ext_*.log files; create_support_bundle() zips them with a
  timestamped filename (<name>_support_bundle_%Y-%m-%d-%H-%M-%S.zip).
- Add upload_support_bundle() on BloodHoundEnterprise client, POSTing
  the zip to POST /api/v2/clients/management/artifacts.
- Add ManagementOperationType and ManagementOperationStatus as StrEnums
  (values confirmed via BED-8268 DB migration CHECK constraints).
- Add ManagementOperation and ManagementAvailable Pydantic models with
  optional nullable fields from the DB schema (requested_by_user_id,
  started_at, completed_at, execution_time).
- Add check_management() and _send_support_bundle() to scheduler Service.
- Extend _poll() to check management before jobs; management errors are
  logged and swallowed so job collection continues uninterrupted.
- Add 14 new tests covering management polling, poll ordering, log
  collection, bundle creation, upload, and cleanup.

TODO(BED-8266): Confirm response field names once GET /api/v2/clients/management
is fully implemented in BHE.
@StranDutton StranDutton self-assigned this Jun 2, 2026
@StranDutton StranDutton added the enhancement New feature or request label Jun 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant