Thehive: HIVE/Splunk Feature Request_

[SivaPrem]

# _HIVE/Splunk Feature Request_

Request Type

Feature Request

Work Environment

| Question | Answer
|---------------------------|--------------------
| OS version (server) | Debian, Ubuntu, ...

Problem Description

Hello All,
We are process of Evaluating HIVE for our SOC team

We use Splunk as our SIEM and we would like to know if an integration with the Hive and Splunk Platform possible ??

Using Splunk to send alerts to HIVE ...

Can you please help us in this , if some other members of thegroup have tried this ??

Thank You

[saadkadhi]

We have considered bridging Splunk and TheHive through the former's ability
to make API calls but decided against it. Instead we are currently working
on a method that grabs Splunk alerts sent to a mailbox, parse them, and
send them to TheHive as alerts thanks to TheHive4py. We have chosen email
because we have other event sources that can use that vector to send
alerts/notifications so this minimizes the code we have to produce and
maintain.

But if anyone is willing to make a Splunk app or a HOWTO to bridge Splunk
and TheHive, please step in and we'll help to the best of our abilities.

[bullerdude]

We currently have scripts that parse emails in exchange mailbox via the web API and then generate the cases in The Hive using thehive4py.

We should be able to contribute then to GitHub; it should be easy to add an additional parser for Splunk.

[fl0wc0ntr0l]

Our team has a Splunk app in-progress for theHive. I can clean it up and anonymize it so it can fully expose theHive's API to Splunk if you're interested. We use it to generate Alerts in theHive based on Splunk results.

One thing I will note is that you will want to use the Alerts API as opposed to the Cases API, especially if your alerts are noisy. We tried it and it's a nightmare to deal with a large amount of cases on a day to day basis.

Edit: looks like the only thing you will have to modify before install is the auth that the requests.post() uses. I should have this cleaned up and working for you by the end of the week.

Second edit: submitted the package to SplunkBase and I will update this comment again if/when it gets approved.

[saadkadhi]

@bullerdude that would be great and we may help for the Splunk alert parser.

@amateur-professional thanks a heap. Let us know the outcome and where we can find the info once validated so we'll link/advertise it.

[SivaPrem]

@saadkadhi : Thank you very much for the amazing work and timely response , The app by @amateur-professional is now published in Splunk-base in the name "Create The HIVE alert"

@bullerdude : Thank you for your time and timely response

@amateur-professional : Thank you very much for your work to develop the app , I think its published in SplunkBase .. Gonna try to now

[ghost]

@bullerdude : any chance you can share a sanitized version of those scripts? Really looking to do what you're doing.

Thanks!

[fl0wc0ntr0l]

@saadkadhi The app is now available in Splunkbase at this location: https://splunkbase.splunk.com/app/3642/

[saadkadhi]

Hi @amateur-professional, thanks a lot for your contribution. We have tweeted it yesterday:
https://twitter.com/TheHive_Project/status/883367307795410944

I am going to link to it in the docs.

@bullerdude, as @dredfu wrote, we'll be interested as well. Thanks!

[SivaPrem]

@amateur-professional @saadkadhi : We tried configuring the App in Splunk and we have some issues , it redirects us to perform setup which is missing , Can you advise me on how to orrect it

Thank you

[fl0wc0ntr0l]

@SivaPrem I will look into this shortly. It should not need any extra configuration - but I did have to re-write the app somewhat to be compatible with Splunk version 6.6 which is not what we are using in production, so much of the reworking was largely theoretical.

That said - it is not really supposed to be a standalone app. It is a custom Alert Action that you can add as an action to any Splunk Alert. You should be adding the action to alerts, not using it as a different Splunk App.

Initial research indicates you may have to manually set these variables in app.conf if they don't already match this:

[install]
state = enabled
is_configured = true

Most likely a future release will stop the app from showing up in the global dropdown menu to avoid this confusion.

[SivaPrem]

@amateur-professional : Thank you very much and I wait for your new version, Meanwhile I will check the app.conf and update you on this , Thanks again for your efforts

[fl0wc0ntr0l]

@SivaPrem were you ever able to verify that the Alert Action works correctly?

[BrevilleBro]

@saadkadhi and @dredfu ; here is a sanitised version of the script we are running https://github.com/UNIT777/Email2TheHive

We will be working on this script in the near future to make it modular.

[SivaPrem]

@amateur-professional : I tried today as you mentioned for the aap.conf and it didn't work for us , when i tried to configure the app , it directed me to perform setup and then i had the page not found

[fl0wc0ntr0l]

Again - this is not a standalone app. This is an alert action. Do not use it like a regular Splunk app.

Here's exactly how the alert action works in pseudo:

get config from the UI specified when the alert was created
open the results file specified in the payload
iterate through the CSV in the results file
    create a dict using the header row and the current row of the CSV
    add info to the dict from the configuration payload
    upload that information to theHive using the URL from the configuration payload to make an alert
exit once no rows are left in the CSV of results

In order for this alert action to work, you would need to guarantee the following:

1. ALL of your field names in Splunk are valid observable types in theHive.
2. The configuration is completely filled out on the Splunk Alert Action. Not filling out any form except the tags will cause the API to reject the submission, as quite a lot of them are required fields.
3. Your credentials in the script to use basic auth for theHive must match a valid user in theHive with write access, at a minimum.

Using this alert action properly looks like this:

[SivaPrem]

@amateur-professional : Thank you very much for the info.. I will work on this today and update you .. good day to you

[fl0wc0ntr0l]

No problem.

I do hope it works for you - we're huge fans of this integration on our side. This makes for a very seamless connection between Splunk and theHive, in my opinion.

[fl0wc0ntr0l]

v0.4.3 has been released for anyone wondering - this fixes some issues with HTML and savedsearches.conf.spec, and has been verified as working by at least one party via private communication.

[binarysmuggler]

@amateur-professional : Thank you for publishing this integration app to SplunkBase. We have installed it in our environment but are having difficulties with the alert configuration. Should we be seeing a configuration UI for the alert action? I see the create_thehive_alert.html under the .../create_thehive_alert/default/data/ui/alerts directory.

Below is what we see in a custom search/alert in Splunk. No options for setting title, severity, TLP, etc. We are running Splunk 6.5.0. Any thoughts?

[fl0wc0ntr0l]

Hi @binarysmuggler ,

You should absolutely be seeing a configuration UI in that window. If I remember correctly we had a similar issue on first install of the app and the culprit was incorrect file permissions for files in the app.

However, I should mention that the app was designed explicitly for Splunk 6.6+ and 6.5 was not considered for compatibility purposes. I'm afraid I probably can't help you very much aside from that.

[remg427]

Hi,
I have downloaded the app from splunkbase
Great job done there
This is small bug with the icon
in alert_actions.conf, it is
icon_path = thehive_logo_small.png
while in appserver/static/appIcon.png
so when selecting the alert_action, the small icon is broken but still works

[remg427]

@binarysmuggler
in Splunk 6.5 it looks like that you have no option when you add the alert_action thehive...but if you save and come back to edit the alert actions, then you get the form to pass the parameters

[novitski]

Hello, thank you for great job.

I installed the hive app on splunk 7.1 and i have some difficulte with alert configuration.

Her what i see:

Is some one tested the app with version 7.1 ?

Thanks

[fl0wc0ntr0l]

Hi @novitski ,

We have unfortunately moved away from the Hive as an incident response and case management solution (not by my choice, obviously). Therefore I really have not been developing or testing this alert action with any other editions of Splunk other than what is published on Splunkbase.

If you like I can publish the code as a Github project and you can fork your own version, adapting it for 7.1, but currently the project is really on ice with no plans for further development.

[remg427]

Hi you may test https://github.com/remg427/misp42Splunk there is one alert action to push in thehive_project. It has been developed on Splunk 7 and works on 6.5
If you ihave ssue on this on, I can help
Rémi

Le 15 février 2018 11:40:54 GMT+01:00, novitski [e-mail] a écrit :

Hello, thank you for great job.

I installed the hive app on splunk 7.1 and i have some difficulte with
alert configuration.

Her what i see:

Is some one tested the app with version 7.1 ?

Thanks

--
You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
https://github.com/TheHive-Project/TheHive/issues/252#issuecomment-365889029

--
Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma brièveté.

[txdpscs]

Hi @amateur-professional,

Sorry to hear you are no longer using theHive.

Would it be possible for you to put the source here on Github so the community can take over the development and/or have the freedom to modify and/or borrow from the source code?

[fl0wc0ntr0l]

Hi @txdpscs,

Yes, I can do that; I've uploaded the codebase today and any interested parties can fork it and continue development on their own. It can be found at this repo.