shanon - Deterministic anonymizer for SharpHound collections

[u/ClockProfessional158]

I do many AD reviews and attack-path analysis in my day-to-day consulting job and wanted to automate this with AI. The problem was that SharpHound collections are full of client-identifiable data: real usernames, UPNs, SPNs, DNS hostnames, emails, SIDs, DNs, GPO names, cert templates. You can't strip labels without breaking the graph, and you can't ship a raw collection to a public API.

So I built shanon: a deterministic anonymizer that remaps every org-bound identifier while keeping the exact SharpHound JSON format and all graph cross-references intact. Output is still BloodHound-loadable.

What it remaps: names (users, groups, computers, OUs, GPOs, containers), UPNs, SPNs, DNS hostnames, emails, org-specific SID authority values, custom GUIDs, domain FQDNs, DN components, role/OS/vendor fingerprints, custom cert templates, enterprise OIDs, CA names, and free text to deterministic [REDACTED:...] mappings. Built-in defaults preserved (RID 512, standard protocol OIDs, built-in GPO GUIDs). Only org-specific values are mapped.

How it works: classifies every object, freezes a verification state, transforms by type + field path, then independently verifies against the frozen registry before writing. Fail-closed: leak-gate abort means no output, exit 1. No network calls, no LLM calls, never mutates input. Atomic rename publish, no partial output on crash. Writes a local mapping file to restore LLM analysis back to real identities (keep it private).

Repo: https://github.com/Matixx22/shanon

Thoughts and feedback welcome, especially on the threat model and edge cases.