# 使用 Homebrew 安装 kubehound 查看 kubehound 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。 ## 安装 ```sh sudo av install brew:kubehound ``` 其他安装命令: ### macOS - Homebrew (100%): ```sh brew install kubehound ``` 证据: local Homebrew formula metadata ## 软件包事实 - **软件包键:** brew:kubehound - **软件包管理器:** Homebrew - **软件包管理器页面:** - **版本:** 1.6.7 - **来源摘要:** Tool for building Kubernetes attack paths - **主页:** - **仓库:** - **上游文档:** - **许可证:** Apache-2.0 - **源码归档:** - **最后更新:** 2026-07-27T21:58:45+02:00 - **已生成:** 2026-08-04T22:13:35+00:00 ## 可执行文件 - kubehound (cli) - kubehound (别名) ## 构建依赖 - go ## 安装行为 - post-install 钩子: 未定义 - Bottle: 可用 于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## 版本和新鲜度 - 页面生成时间: 2026-08-04 - 管理器版本: 1.6.7 - 管理器更新时间: 2026-07-27 - 本地数据: OK - 上游仓库: https://github.com/DataDog/KubeHound - 检测到的最新版本: v1.6.7 (当前) ## 项目历史与用法 KubeHound is Datadog's open source Kubernetes attack-graph tool. It collects cluster data, computes attack paths, and stores them in a graph database so defenders and red teams can reason about multi-hop compromise paths instead of isolated findings. ### 项目历史 The public GitHub repository was created on May 15, 2023. Datadog Security Labs announced KubeHound on October 2, 2023, describing it as a new open source project for visualizing attack paths in Kubernetes deployments. Datadog's 2023 Security Labs review says KubeHound was an internal project used by the adversary emulation team before it was open sourced. The documentation presents KubeHound as a graph of pods, nodes, identities, permissions, and attack techniques. ### 采用历史 KubeHound is narrower than general Kubernetes admin tools, but it entered package-manager culture quickly enough to appear in Homebrew. That packaging matters for security teams because the tool is meant to run from an analyst workstation against a selected kubeconfig context. The project's adoption signal is strongest in Kubernetes security circles: official docs, Datadog Security Labs posts, and conference material frame it as a way to prioritize security work by graph reachability rather than scanner output volume. ### 使用方式 KubeHound can select a target cluster through kubectx or through a KUBECONFIG environment variable. It ingests data from the Kubernetes API server, computes attack paths, stores results in JanusGraph, and supports graph queries through Gremlin or the KubeHound DSL. The documentation says KubeHound can identify more than 25 attacks, including container escape and lateral movement techniques, and can answer questions such as whether a path exists from a specific container to a node or cluster-admin role. ### 为什么软件包爱好者会关心 KubeHound is package-nerd interesting because it brings graph-security analysis into a CLI that can be installed from Homebrew beside kubectl and kubectx. It represents the Kubernetes security tooling trend from static lists toward attack-path modeling. ### 时间线 - 2023-05-15: Public GitHub repository created - 2023-10-02: Datadog Security Labs announced KubeHound as an open source project - 2024-01-04: Datadog's Security Labs review described KubeHound as open sourced from an internal adversary-emulation project - 2025-11-14: v1.6.7 release published ### Related projects - kubectx is documented as one way to select the target Kubernetes cluster. - JanusGraph and Gremlin are the graph database and query ecosystem used for attack-path storage and analysis. - The KubeHound documentation includes an attack reference for Kubernetes attack techniques. ### 来源 - - - - - - ## 安全说明 infrastructure mutation or orchestration signal. - **Geiger 风险:** orange / 中 - infrastructure mutation or orchestration signal ## 源数据库详情 - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** kubehound - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## 相关链接 - [Cloud CLI packages](https://pkg.so/zh-hans/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Secret-risk packages](https://pkg.so/zh-hans/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://pkg.so/zh-hans/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://pkg.so/zh-hans/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [go](https://pkg.so/zh-hans/brew/go/) - Build dependency declared by Homebrew. - [kubescape](https://pkg.so/zh-hans/brew/kubescape/) - Shares pkgdb curated category or tags: cli, kubernetes, security. - [kube-bench](https://pkg.so/zh-hans/brew/kube-bench/) - Shares pkgdb curated category or tags: cli, kubernetes, security. - [kubeseal](https://pkg.so/zh-hans/brew/kubeseal/) - Shares pkgdb curated category or tags: cli, kubernetes, security. - [ksops](https://pkg.so/zh-hans/brew/ksops/) - Shares pkgdb curated category or tags: cli, kubernetes, security. - [checkov](https://pkg.so/zh-hans/brew/checkov/) - Shares pkgdb curated category or tags: cli, kubernetes, security. - [terrascan](https://pkg.so/zh-hans/brew/terrascan/) - Shares pkgdb curated category or tags: cli, kubernetes, security. - [gator](https://pkg.so/zh-hans/brew/gator/) - Shares pkgdb curated category or tags: cli, kubernetes, security. - [roxctl](https://pkg.so/zh-hans/brew/roxctl/) - Shares pkgdb curated category or tags: cli, kubernetes, security. - [bounceback](https://pkg.so/zh-hans/brew/bounceback/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, red, red-team, security, team. ## Combined YAML source View the package source record on GitHub. [combined/kubehound.yml](https://github.com/mxcl/pkgdb/blob/main/combined/kubehound.yml) ## 来源 - pkg.so package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - cross-ecosystem install command graph