🌶 THEHIVE

THEHIVE BASICS#

KEY CONCEPTS#

Case            Investigation container
Task            Action items within case
Observable      IOCs (IPs, domains, hashes, etc.)
Alert           External notification (can become case)
Template        Predefined case structure

CASE MANAGEMENT#

CREATE CASE#

# GUI: Cases > New Case
# API:
POST /api/case
{
  "title": "Incident Title",
  "description": "Description",
  "severity": 2,
  "tlp": 2,
  "pap": 2,
  "tags": ["phishing", "malware"]
}

SEVERITY LEVELS#

1 = Low
2 = Medium
3 = High
4 = Critical

TLP (Traffic Light Protocol)#

0 = White (public)
1 = Green (community)
2 = Amber (organization)
3 = Red (restricted)

PAP (Permissible Actions Protocol)#

0 = White (full disclosure)
1 = Green (passive analysis)
2 = Amber (active analysis)
3 = Red (no external analysis)

TASKS#

CREATE TASK#

POST /api/case/{caseId}/task
{
  "title": "Analyze malware sample",
  "description": "Detailed analysis steps",
  "status": "Waiting",
  "flag": false,
  "group": "Analysis"
}

TASK STATUS#

Waiting
InProgress
Completed
Cancel

OBSERVABLES#

TYPES#

ip              IP address
domain          Domain name
url             URL
mail            Email address
mail_subject    Email subject
hash            File hash
filename        File name
fqdn            Fully qualified domain name
uri_path        URI path
user-agent      User agent string
registry        Registry key
other           Other

ADD OBSERVABLE#

POST /api/case/{caseId}/artifact
{
  "dataType": "ip",
  "data": "192.168.1.100",
  "message": "Suspicious IP from logs",
  "tlp": 2,
  "ioc": true,
  "sighted": true,
  "tags": ["malicious", "c2"]
}

BULK ADD#

POST /api/case/{caseId}/artifact/_bulk
[
  {"dataType": "ip", "data": "1.2.3.4"},
  {"dataType": "domain", "data": "evil.com"},
  {"dataType": "hash", "data": "abc123..."}
]

ALERTS#

CREATE ALERT#

POST /api/alert
{
  "title": "Suspicious Activity Detected",
  "description": "Alert details",
  "type": "siem",
  "source": "Splunk",
  "sourceRef": "SPL-12345",
  "severity": 2,
  "tlp": 2,
  "artifacts": [
    {"dataType": "ip", "data": "10.0.0.1"}
  ]
}

PROMOTE TO CASE#

POST /api/alert/{alertId}/createCase

MERGE INTO CASE#

POST /api/alert/{alertId}/merge/{caseId}

CORTEX ANALYZERS#

COMMON ANALYZERS#

VirusTotal          Check file/URL/hash reputation
AbuseIPDB           IP reputation
URLhaus             URL reputation
OTX_Query           AlienVault OTX lookup
MISP                MISP correlation
Shodan              Shodan search
Cuckoo              Sandbox analysis
Yara                YARA rule matching
FileInfo            File metadata
Hippocampe          Feed correlation

RUN ANALYZER#

POST /api/connector/cortex/job
{
  "cortexId": "cortex1",
  "artifactId": "observableId",
  "analyzerId": "VirusTotal_GetReport_3_0"
}

RESPONDERS#

COMMON RESPONDERS#

Mailer              Send email notification
MISP                Export to MISP
Block IP            Firewall block
DNS Sinkhole        Add to sinkhole
Velociraptor        Collect from endpoint

RUN RESPONDER#

POST /api/connector/cortex/action
{
  "cortexId": "cortex1",
  "objectType": "case_artifact",
  "objectId": "observableId",
  "responderId": "Mailer_1_0"
}

API AUTHENTICATION#

API KEY#

# Header
Authorization: Bearer YOUR_API_KEY

# Query
?key=YOUR_API_KEY

COMMON QUERIES#

GET CASES#

POST /api/case/_search
{
  "query": { "status": "Open" }
}

GET ALERTS#

POST /api/alert/_search
{
  "query": { "status": "New" }
}

GET OBSERVABLES#

POST /api/case/artifact/_search
{
  "query": {
    "_parent": { "_type": "case", "_query": { "_id": "caseId" } }
  }
}

SEARCH SYNTAX#

# Field equals
{ "field": "value" }

# Contains
{ "_string": "searchterm" }

# Range
{ "_between": { "_field": "severity", "_from": 2, "_to": 4 } }

# AND
{ "_and": [ {"field1": "value1"}, {"field2": "value2"} ] }

# OR
{ "_or": [ {"field1": "value1"}, {"field2": "value2"} ] }

WEBHOOKS#

CONFIGURE WEBHOOK#

# Settings > Webhooks
# Trigger on case/task/alert events

WEBHOOK PAYLOAD#

{
  "objectType": "case",
  "objectId": "caseId",
  "operation": "Update",
  "details": { ... }
}

INTEGRATIONS#

MISP#

# Export case observables to MISP
# Import MISP events as alerts

SIEM#

# Create alerts from SIEM
# Splunk, Elastic, QRadar adapters

SOAR#

# Trigger playbooks
# Shuffle, Demisto integration

PYTHON CLIENT#

INSTALLATION#

pip install thehive4py

EXAMPLE#

from thehive4py.api import TheHiveApi
from thehive4py.models import Case, CaseTask, CaseObservable

api = TheHiveApi('http://thehive:9000', 'API_KEY')

# Create case
case = Case(title='Test', description='Test case', severity=2)
response = api.create_case(case)
case_id = response.json()['id']

# Add observable
observable = CaseObservable(dataType='ip', data='1.2.3.4')
api.create_case_observable(case_id, observable)

# Add task
task = CaseTask(title='Investigate')
api.create_case_task(case_id, task)

TEMPLATES#

CASE TEMPLATE#

{
  "name": "Phishing Investigation",
  "displayName": "Phishing",
  "severity": 2,
  "tlp": 2,
  "tasks": [
    {"title": "Analyze email headers"},
    {"title": "Check URLs in sandbox"},
    {"title": "Identify affected users"}
  ],
  "customFields": {
    "phishing-type": {"string": "credential"}
  }
}

QUICK REFERENCE#

# Case management
POST /api/case                       # Create case
GET /api/case/{id}                   # Get case
PATCH /api/case/{id}                 # Update case

# Observables
POST /api/case/{id}/artifact         # Add observable
GET /api/case/artifact/{id}          # Get observable

# Alerts
POST /api/alert                      # Create alert
POST /api/alert/{id}/createCase      # Promote to case

# Cortex
POST /api/connector/cortex/job       # Run analyzer
POST /api/connector/cortex/action    # Run responder