---
title: "TheHive — Gestion d'incidents & Cases"
domain: security
subdomain: soc
phase: 03-response
type: snippet
tags: [thehive, soc, incident-response, cortex, soar]
difficulty: intermediate
status: stable
updated: "Sat May 30 2026 00:00:00 GMT+0000 (Coordinated Universal Time)"
---
## Déploiement Docker

```yaml
# docker-compose.yml
version: "3.8"
services:
  cassandra:
    image: cassandra:4
    environment:
      - CASSANDRA_CLUSTER_NAME=thehive
    volumes:
      - cassandra_data:/var/lib/cassandra

  elasticsearch:
    image: elasticsearch:7.17.9
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    volumes:
      - es_data:/usr/share/elasticsearch/data

  thehive:
    image: strangebee/thehive:5
    depends_on:
      - cassandra
      - elasticsearch
    ports:
      - "9000:9000"
    environment:
      - JVM_OPTS=-Xms512m -Xmx512m
    volumes:
      - ./thehive.conf:/etc/thehive/application.conf
      - thehive_data:/opt/thp/thehive/data

  cortex:
    image: thehiveproject/cortex:3
    ports:
      - "9001:9001"
    volumes:
      - cortex_data:/var/db/cortex

volumes:
  cassandra_data:
  es_data:
  thehive_data:
  cortex_data:
```

```
# Accès : http://localhost:9000
# Compte par défaut : admin@thehive.local / secret
```

---

## Configuration application.conf

```hocon
# /etc/thehive/application.conf
db {
  provider: janusgraph
  janusgraph {
    storage {
      backend: cql
      hostname: ["cassandra"]
      cql.cluster-name: thehive
    }
    index.search {
      backend: elasticsearch
      hostname: ["elasticsearch"]
      index-name: thehive
    }
  }
}

storage {
  provider: localfs
  localfs.location: /opt/thp/thehive/data
}

# Cortex integration
cortex {
  servers = [
    {
      name = local
      url = "http://cortex:9001"
      auth {
        type = bearer
        key = "CORTEX_API_KEY"
      }
    }
  ]
}
```

---

## Concepts clés

### Hiérarchie
```
Organisation
└── Case (incident)
    ├── Tasks (actions à réaliser)
    │   └── Task logs (journal)
    ├── Observables (IOC)
    │   ├── IP, domain, hash, URL...
    │   └── Analyseurs Cortex
    └── Alertes (événements sources)
```

### Statuts d'un case

| Statut | Description |
|--------|-------------|
| Open | En cours d'investigation |
| Resolved | Clôturé avec résolution |
| Deleted | Supprimé |

### TLP / PAP

| Code | Signification |
|------|---------------|
| TLP:WHITE | Public |
| TLP:GREEN | Communauté |
| TLP:AMBER | Organisation |
| TLP:RED | Restreint |

---

## API TheHive

### Authentification
```bash
API_KEY="votre_api_key"
BASE_URL="http://localhost:9000"

# Test connexion
curl -H "Authorization: Bearer $API_KEY" \
  $BASE_URL/api/v1/user/current
```

### Créer un case
```bash
curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Suspicious PowerShell execution",
    "description": "SIEM alert - encoded PowerShell detected on WS-042",
    "severity": 2,
    "tlp": 2,
    "tags": ["powershell", "windows", "lateral-movement"],
    "tasks": [
      {"title": "Isoler le poste WS-042"},
      {"title": "Analyser les logs PowerShell"},
      {"title": "Vérifier les connexions réseau"}
    ]
  }' \
  $BASE_URL/api/v1/case
```

### Ajouter un observable
```bash
curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "dataType": "ip",
    "data": "185.220.101.45",
    "tlp": 2,
    "tags": ["c2", "suspicious"],
    "message": "IP source de la connexion PowerShell"
  }' \
  $BASE_URL/api/v1/case/CASE_ID/observable
```

### Créer une alerte (depuis SIEM)
```bash
curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "siem",
    "source": "elastic",
    "sourceRef": "alert-20260530-001",
    "title": "Brute Force SSH détecté",
    "severity": 2,
    "artifacts": [
      {"dataType": "ip", "data": "10.0.0.50"},
      {"dataType": "ip", "data": "192.168.1.10"}
    ]
  }' \
  $BASE_URL/api/v1/alert
```

---

## Cortex — Analyseurs

```bash
# Analyseurs populaires à activer dans Cortex
- Abuse_Finder        # WHOIS, abus contact
- AbuseIPDB           # Réputation IP
- VirusTotal_v3       # Hash, IP, URL, domain
- Shodan              # Infos host
- MaxMind_GeoIP       # Géolocalisation IP
- Urlscan_io          # Analyse URL
- MISP                # Cross-référence MISP
```

### Lancer une analyse depuis TheHive
```
Case > Observable > Analyze
Sélectionner analyseur(s) > Run
Résultats visibles dans l'observable
```

---

## Intégration Wazuh → TheHive

```python
# /var/ossec/integrations/custom-thehive.py
import json, requests, sys

def send_alert(alert, api_key, url):
    headers = {"Authorization": f"Bearer {api_key}"}
    payload = {
        "title": f"Wazuh Alert: {alert['rule']['description']}",
        "severity": 2,
        "tags": ["wazuh", f"rule-{alert['rule']['id']}"],
        "artifacts": [{"dataType": "ip", "data": alert.get("agent", {}).get("ip", "")}]
    }
    requests.post(f"{url}/api/v1/alert", json=payload, headers=headers)

alert = json.loads(sys.stdin.read())
send_alert(alert, "API_KEY", "http://thehive:9000")
```

```xml
<!-- /var/ossec/etc/ossec.conf -->
<integration>
  <name>custom-thehive</name>
  <level>10</level>
  <alert_format>json</alert_format>
</integration>
```

---

## Playbook type (Case template)

```
Template : "Compromission de compte"
Tasks :
  □ 1. Désactiver le compte AD compromis
  □ 2. Reset du mot de passe
  □ 3. Analyser les dernières connexions (audit logs)
  □ 4. Identifier les ressources accédées
  □ 5. Vérifier les règles de forwarding mail
  □ 6. Notifier l'utilisateur et sa hiérarchie
  □ 7. Rapport d'incident
```