TheHive — Gestion d'incidents & Cases

# docker-compose.yml
version: "3.8"
services:
  cassandra:
    image: cassandra:4
    environment:
      - CASSANDRA_CLUSTER_NAME=thehive
    volumes:
      - cassandra_data:/var/lib/cassandra
  elasticsearch:
    image: elasticsearch:7.17.9
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    volumes:
      - es_data:/usr/share/elasticsearch/data
  thehive:
    image: strangebee/thehive:5
    depends_on:
      - cassandra
      - elasticsearch
    ports:
      - "9000:9000"
    environment:
      - JVM_OPTS=-Xms512m -Xmx512m
    volumes:
      - ./thehive.conf:/etc/thehive/application.conf
      - thehive_data:/opt/thp/thehive/data
  cortex:
    image: thehiveproject/cortex:3
    ports:
      - "9001:9001"
    volumes:
      - cortex_data:/var/db/cortex
volumes:
  cassandra_data:
  es_data:
  thehive_data:
  cortex_data:

# Accès : http://localhost:9000
# Compte par défaut : admin@thehive.local / secret

# /etc/thehive/application.conf
db {
  provider: janusgraph
  janusgraph {
    storage {
      backend: cql
      hostname: ["cassandra"]
      cql.cluster-name: thehive
    }
    index.search {
      backend: elasticsearch
      hostname: ["elasticsearch"]
      index-name: thehive
    }
  }
}
storage {
  provider: localfs
  localfs.location: /opt/thp/thehive/data
}
# Cortex integration
cortex {
  servers = [
    {
      name = local
      url = "http://cortex:9001"
      auth {
        type = bearer
        key = "CORTEX_API_KEY"
      }
    }
  ]
}

Organisation
 Case incident
     Tasks actions  raliser
        Task logs journal
     Observables IOC
        IP domain hash URL
        Analyseurs Cortex
     Alertes vnements sources

API_KEY"votre_api_key"
BASE_URL"http://localhost:9000"
# Test connexion
curl -H "Authorization: Bearer $API_KEY" 
  $BASE_URL/api/v1/user/current

curl -X POST 
  -H "Authorization: Bearer $API_KEY" 
  -H "Content-Type: application/json" 
  -d 
    "title" "Suspicious PowerShell execution"
    "description" "SIEM alert - encoded PowerShell detected on WS-042"
    "severity" 2
    "tlp" 2
    "tags" "powershell" "windows" "lateral-movement"
    "tasks" 
      "title" "Isoler le poste WS-042"
      "title" "Analyser les logs PowerShell"
      "title" "Vérifier les connexions réseau"
    
   
  $BASE_URL/api/v1/case

curl -X POST 
  -H "Authorization: Bearer $API_KEY" 
  -H "Content-Type: application/json" 
  -d 
    "dataType" "ip"
    "data" "185.220.101.45"
    "tlp" 2
    "tags" "c2" "suspicious"
    "message" "IP source de la connexion PowerShell"
   
  $BASE_URL/api/v1/case/CASE_ID/observable

curl -X POST 
  -H "Authorization: Bearer $API_KEY" 
  -H "Content-Type: application/json" 
  -d 
    "type" "siem"
    "source" "elastic"
    "sourceRef" "alert-20260530-001"
    "title" "Brute Force SSH détecté"
    "severity" 2
    "artifacts" 
      "dataType" "ip" "data" "10.0.0.50"
      "dataType" "ip" "data" "192.168.1.10"
    
   
  $BASE_URL/api/v1/alert

# Analyseurs populaires à activer dans Cortex
 Abuse_Finder        # WHOIS, abus contact
 AbuseIPDB           # Réputation IP
 VirusTotal_v3       # Hash, IP, URL, domain
 Shodan              # Infos host
 MaxMind_GeoIP       # Géolocalisation IP
 Urlscan_io          # Analyse URL
 MISP                # Cross-référence MISP

Case > Observable > Analyze
Slectionner analyseurs > Run
Rsultats visibles dans lobservable

# /var/ossec/integrations/custom-thehive.py
import json, requests, sys
def send_alert(alert, api_key, url):
    headers = {"Authorization": f"Bearer {api_key}"}
    payload = {
        "title": f"Wazuh Alert: {alert['rule']['description']}",
        "severity": 2,
        "tags": ["wazuh", f"rule-{alert['rule']['id']}"],
        "artifacts": [{"dataType": "ip", "data": alert.get("agent", {}).get("ip", "")}]
    }
    requests.post(f"{url}/api/v1/alert", json=payload, headers=headers)
alert = json.loads(sys.stdin.read())
send_alert(alert, "API_KEY", "http://thehive:9000")

<!-- /var/ossec/etc/ossec.conf -->
<integration>
  <name>custom-thehive</name>
  <level>10</level>
  <alert_format>json</alert_format>
</integration>

Template  "Compromission de compte"
Tasks 
   1 Dsactiver le compte AD compromis
   2 Reset du mot de passe
   3 Analyser les dernires connexions audit logs
   4 Identifier les ressources accdes
   5 Vrifier les rgles de forwarding mail
   6 Notifier lutilisateur et sa hirarchie
   7 Rapport dincident