Create TheHive integration
TheHive is an open-source security incident management platform. With its robust alerting API, we are able to send Stairwell alerts into TheHive for further triage and disposition.
Prerequisites
- Webhook URI from TheHive
Instructions
Google Cloud Function
By leveraging an existing trigger capability in a cloud provider, we can receive webhooks from Stairwell and push those to TheHive via its API. In this example, you’ll configure Stairwell with the webhook address of https://us-central1-.cloudfunctions.net/?key=.
Function example using Python 3.9
import json
import base64
import requests
import sys
import json
import time
import uuid
from thehive4py.api import TheHiveApi
from thehive4py.models import Alert, AlertArtifact, CustomFieldHelper
def main(request):
# JSON payload from POST from Stairwell webhook
request_json = request.get_json()
key = request.args.get('key')
# You can configure key to be anything you’d like for authentication
if (key == '<RANDOM KEY USED IN URL>'):
print('Authenticated')
print(request_json)
triggerName = request_json["name"]
hiveResult = alertTheHive(triggerName, request_json)
return(hiveResult)
else:
return f'Unknown key'
def alertTheHive(alertTitle, jsonPayload):
THEHIVE_URL = 'http://<YOUR HIVE INSTANCE>:9000'
THEHIVE_API_KEY = '<YOUR HIVE API KEY>'
api = TheHiveApi(THEHIVE_URL, THEHIVE_API_KEY)
# Prepare observables
artifacts = []
for h in jsonPayload['matches']:
artifacts.append(AlertArtifact(dataType='hash', data=h['sha256']))
# Prepare the alert
alertDescription = json.dumps(jsonPayload, indent=2)
sourceRef = str(uuid.uuid4())[0:6]
alert = Alert(title=alertTitle,
tlp=3,
#tags=['TheHive4Py', 'sample'],
description=alertDescription,
type='external',
source='Stairwell',
sourceRef=sourceRef,
artifacts=artifacts
)
# Create the alert
try:
response = api.create_alert(alert)
# Print the JSON response
return(json.dumps(response.json(), indent=4, sort_keys=True))
except AlertException as e:
return("Alert create error: {}".format(e))
Stairwell
- Log into Stairwell
- Select the settings icon
- Select the "Environments" tab
- Scroll to the desired environment and select the "cog" wheel
- Select the "Event Notifications" tab
- Select the "Add New Webhook" options
- Paste the Webhook URI from TheHive
- Click "Create"
Updated 11 months ago