Skip to content

Latest commit

 

History

History
27 lines (21 loc) · 1.32 KB

README.md

File metadata and controls

27 lines (21 loc) · 1.32 KB
Raw

graylog2thehive

Create alerts in The Hive from your Graylog alerts, to be turned into Hive cases.

Simple Python flask app that runs as a web server, and accepts POST requests from your Graylog notifications.

git clone https://github.com/ReconInfoSec/graylog2thehive.git /opt/graylog2thehive

Get up and running:

  • Configure SSL certificate paths in app.py, or remove all context lines if not using SSL
  • Copy init.d/graylog2thehive.service to /etc/systemd/system/graylog2thehive.service
  • Set your Hive API key in /etc/systemd/system/graylog2thehive.service for the HIVE_SECRET_KEY
  • Set your Hive and Graylog URLs in config.py
  • Optional: app/__init__.py, configure any other IP, hash, URL, or filename fields in place of src_ip and dst_ip to include them as artifacts/observables in your alert
pip install -r requirements.txt
cp init.d/graylog2thehive.service /etc/systemd/system/graylog2thehive.service
systemctl enable graylog2thehive
systemctl start graylog2thehive
  • Runs at https://0.0.0.0:5000, accepts POST requests
    • Point your Graylog Legacy Alarm Callback to https://[YOURSERVER].com:5000/create_alert
    • Point your Graylog HTTP Notification to https://[YOURSERVER].com:5000/create_alert_http