Awesome
canaries2thehive
Create alerts in The Hive from your Thinkst Canary alerts, to be turned into Hive cases.
Simple Python flask app that runs as a web server, and accepts POST requests from your canaries notifications.
This script supports either a single instance of TheHive 3, or multiple organisations (leveraging multi tenancy feature) in TheHive 4.
git clone https://github.com/ReconInfoSec/canaries2thehive.git /opt/canaries2thehive
Get up and running:
- Configure SSL certificate paths in
app.py, or remove all context lines if not using SSL - Copy
init.d/canaries2thehive.serviceto/etc/systemd/system/canaries2thehive.service - Add your Hive API keys in JSON format to
/opt/canaries2thehive/app/keys.json - Set your Hive URL in
config.py:HIVE_URL - Optional:
app/__init__.py, configure any other IP, hash, URL, or filename fields in place of CanaryIP, SourceIP, and CanaryName to include them as artifacts/observables in your alert
pip3 install -r requirements.txt
cp init.d/canaries2thehive.service /etc/systemd/system/
systemctl enable canaries2thehive
systemctl start canaries2thehive
- Runs at https://0.0.0.0:5000, accepts POST requests
- Point your Canary webhook to
https://[YOURSERVER].com:5000/create_alert
- Point your Canary webhook to