Skip to content

Latest commit

 

History

History
28 lines (21 loc) · 1.31 KB

README.md

File metadata and controls

28 lines (21 loc) · 1.31 KB
Raw

canaries2thehive

Create alerts in The Hive from your Thinkst Canary alerts, to be turned into Hive cases.

Simple Python flask app that runs as a web server, and accepts POST requests from your canaries notifications.

This script supports either a single instance of TheHive 3, or multiple organisations (leveraging multi tenancy feature) in TheHive 4.

git clone https://github.com/ReconInfoSec/canaries2thehive.git /opt/canaries2thehive

Get up and running:

  • Configure SSL certificate paths in app.py, or remove all context lines if not using SSL
  • Copy init.d/canaries2thehive.service to /etc/systemd/system/canaries2thehive.service
  • Add your Hive API keys in JSON format to /opt/canaries2thehive/app/keys.json
  • Set your Hive URL in config.py: HIVE_URL
  • Optional: app/__init__.py, configure any other IP, hash, URL, or filename fields in place of CanaryIP, SourceIP, and CanaryName to include them as artifacts/observables in your alert
pip3 install -r requirements.txt
cp init.d/canaries2thehive.service /etc/systemd/system/
systemctl enable canaries2thehive 
systemctl start canaries2thehive
  • Runs at https://0.0.0.0:5000, accepts POST requests
    • Point your Canary webhook to https://[YOURSERVER].com:5000/create_alert