TheHive

https://docs.strangebee.com/
Admin
TheHive is an open-source security incident response platform designed to help security teams manage...
Tokens:288,770
Snippets:3,304
Trust Score:8.6
Update:3 months ago
Show doc for...
Tokens:
Raw
### Install jq via Package Manager

Source: https://docs.strangebee.com/thehive/operations/backup-restore/backup/hot-backup/hot-backup-standalone-server

Example commands for installing the jq utility on different Linux distributions.

```bash
sudo apt install jq
```

```bash
sudo yum install jq
```

--------------------------------

### Standalone Configuration Sample

Source: https://docs.strangebee.com/thehive/installation/upgrade-from-4.x

Example of a minimal application.conf for a standalone TheHive installation.

```hocon
# TheHive configuration - application.conf
#
#
# This is the default configuration file.
# This is prepared to run with all services locally:
# - Cassandra for the database
# - Elasticsearch for index engine
# - File storage is local in /opt/thp/thehive/files
#
# If this is not your setup, please refer to the documentation at:
# https://docs.thehive-project.org/thehive/
#
#
# Secret key - used by Play Framework
# If TheHive is installed with DEB/RPM package, this is automatically generated
# If TheHive is not installed from DEB or RPM packages run the following
# command before starting thehive:
#   cat > /etc/thehive/secret.conf << _EOF_
#   play.http.secret.key="$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 64 |#   head -n 1)"
#   _EOF_
include "/etc/thehive/secret.conf"


# Database and index configuration
# By default, TheHive is configured to connect to local Cassandra 4.x and a
# local Elasticsearch services without authentication.
db.janusgraph {
  storage {
    backend = cql
    hostname = ["127.0.0.1"]
    # Cassandra authentication (if configured)
    # username = "thehive"
    # password = "password"
    cql {
      cluster-name = thp
      keyspace = thehive
    }
  }
  index.search {
    backend = elasticsearch
    hostname = ["127.0.0.1"]
    index-name = thehive
  }
}

# Attachment storage configuration
# By default, TheHive is configured to store files locally in the folder.
# The path can be updated and should belong to the user/group running thehive service. (by default: thehive:thehive)
storage {
  provider = localfs
  localfs.location = /opt/thp/thehive/files
}

# Define the maximum size for an attachment accepted by TheHive
play.http.parser.maxDiskBuffer = 1GB
# Define maximum size of http request (except attachment)
play.http.parser.maxMemoryBuffer = 10M

# Service configuration
application.baseUrl = "http://localhost:9000"
play.http.context = "/"

# Additional modules
#
# TheHive is strongly integrated with Cortex and MISP.
# Both modules are enabled by default. If not used, each one can be disabled by
# commenting the configuration line.
scalligraph.modules += org.thp.thehive.connector.cortex.CortexModule
scalligraph.modules += org.thp.thehive.connector.misp.MispModule
```

--------------------------------

### Example Java Version Output

Source: https://docs.strangebee.com/cortex/installation-and-configuration/step-by-step-guide

Expected output format after verifying the Java installation.

```text
openjdk version "11.0.12" 2022-07-19
OpenJDK Runtime Environment Corretto-11.0.12.7.1 (build 11.0.12+7-LTS)
OpenJDK 64-Bit Server VM Corretto-11.0.12.7.1 (build 11.0.12+7-LTS, mixed mode)
```

--------------------------------

### Expected Java version output

Source: https://docs.strangebee.com/thehive/configuration/secret

Example output confirming the installation of OpenJDK 11.

```text
openjdk version "11.0.28" 2025-07-15
OpenJDK Runtime Environment Corretto-11.0.28.6.1 (build 11.0.28+6-LTS)
OpenJDK 64-Bit Server VM Corretto-11.0.28.6.1 (build 11.0.28+6-LTS, mixed mode)
```

--------------------------------

### Install TheHive Package

Source: https://docs.strangebee.com/thehive/operations/apt-yum-repositories-end/switch-to-manual-download-installation-thehive

Commands to install the downloaded package file using either apt-get or dpkg.

```bash
sudo apt-get install /tmp/thehive_5.7.3-1_all.deb
```

```bash
sudo dpkg -i /tmp/thehive_5.7.3-1_all.deb
```

--------------------------------

### Start and enable TheHive service

Source: https://docs.strangebee.com/thehive/installation/installation-guide-linux-standalone-server

Starts the service immediately and configures it to launch automatically on system boot.

```bash
sudo systemctl start thehive
sudo systemctl enable thehive
```

--------------------------------

### Install Dependencies for TheHive

Source: https://docs.strangebee.com/thehive/operations/apt-yum-repositories-end/switch-to-manual-download-installation-thehive

Install required system utilities before proceeding with the manual installation.

```bash
sudo apt update
sudo apt install wget curl gnupg coreutils
```

```bash
sudo yum update
sudo yum install wget curl gnupg coreutils
```

--------------------------------

### Install Systemd Service

Source: https://docs.strangebee.com/thehive/installation/upgrade-from-5.x

Download and install the systemd service file for TheHive.

```bash
cd /tmp
wget https://raw.githubusercontent.com/TheHive-Project/TheHive/master/package/thehive.service
sudo cp thehive.service /etc/systemd/system/thehive.service
```

--------------------------------

### Start TheHive service

Source: https://docs.strangebee.com/thehive/installation/upgrade-from-5.x

Commands to start TheHive service for package or Docker Compose installations.

```bash
sudo systemctl start thehive
```

```bash
docker compose up -d
```

--------------------------------

### Run the Cortex all-in-one installation script

Source: https://docs.strangebee.com/cortex/installation-and-configuration

Use this script to automate the installation process on a fresh, supported operating system.

```bash
wget -q -O /tmp/install_script.sh https://scripts.download.strangebee.com/latest/sh/install_script.sh ; sudo -v ; bash /tmp/install_script.sh
```

--------------------------------

### Start Cassandra Service on RPM-based Systems

Source: https://docs.strangebee.com/thehive/configuration/secret

Alternative commands for starting the Cassandra service on specific RPM-based distributions.

```bash
sudo systemctl daemon-reload
sudo service cassandra start
```

--------------------------------

### Install Cortexutils Library

Source: https://docs.strangebee.com/cortex/api/how-to-create-a-responder

Commands to install the Python library used for developing responders.

```bash
pip install cortexutils
```

```bash
pip3 install cortexutils
```

--------------------------------

### Install Cassandra on RPM systems

Source: https://docs.strangebee.com/thehive/configuration/secret

Updates the package index and installs the Cassandra package.

```bash
sudo yum update
sudo yum install cassandra
```

--------------------------------

### Install Cassandra on Debian

Source: https://docs.strangebee.com/thehive/configuration/secret

Updates the package index and installs the Cassandra package.

```bash
sudo apt update
sudo apt install cassandra
```

--------------------------------

### Start TheHive services

Source: https://docs.strangebee.com/thehive/installation/upgrade-from-4.x

Commands to reload systemd and start the required dependencies and TheHive service.

```bash
sudo systemctl daemon-reload
```

```bash
sudo systemctl start cassandra
```

```bash
sudo systemctl start elasticsearch
```

```bash
sudo systemctl start thehive
```

--------------------------------

### Install Python Dependencies

Source: https://docs.strangebee.com/cortex/installation-and-configuration/analyzers-responders

Install requirements for all cloned analyzers.

```bash
cd /opt
for I in $(find Cortex-Analyzers -name 'requirements.txt'); do sudo -H pip3 install -r $I || true; done
```

--------------------------------

### Install Package via CLI

Source: https://docs.strangebee.com/cortex/operations/switch-to-manual-download-installation-cortex

Commands to install the downloaded .deb package using apt-get or dpkg.

```bash
sudo apt-get install /tmp/cortex_4.1.0-1_all.deb
```

```bash
sudo dpkg -i /tmp/cortex_4.1.0-1_all.deb
```

--------------------------------

### Install TheHive Package

Source: https://docs.strangebee.com/thehive/operations/apt-yum-repositories-end/switch-to-manual-download-installation-thehive

Commands to install the downloaded RPM package using different package managers.

```bash
sudo yum install /tmp/thehive-5.7.3-1.noarch.rpm
```

```bash
sudo dnf install /tmp/thehive-5.7.3-1.noarch.rpm
```

```bash
sudo rpm -ivh /tmp/thehive-5.7.3-1.noarch.rpm
```

--------------------------------

### Install ca-certificates-java

Source: https://docs.strangebee.com/thehive/configuration/ssl/configure-ssl-jvm

Ensure the necessary package for managing Java CA certificates is installed.

```bash
sudo apt-get install -y ca-certificates-java
```

--------------------------------

### Install Amazon Corretto on RPM systems

Source: https://docs.strangebee.com/thehive/configuration/secret

Commands to import the GPG key, add the repository, and install the JDK on RHEL/CentOS-based systems.

```bash
sudo rpm --import https://yum.corretto.aws/corretto.key &> /dev/null
wget -qO- https://yum.corretto.aws/corretto.repo | sudo tee -a /etc/yum.repos.d/corretto.repo
sudo yum install -y java-11-amazon-corretto-devel > /dev/null
echo JAVA_HOME="/usr/lib/jvm/java-11-amazon-corretto" | sudo tee -a /etc/environment
export JAVA_HOME="/usr/lib/jvm/java-11-amazon-corretto"
```

--------------------------------

### Install Dependencies for RPM-based Systems

Source: https://docs.strangebee.com/cortex/operations/switch-to-manual-download-installation-cortex

Install required system utilities for Red Hat-based distributions.

```bash
sudo yum update
sudo yum install wget curl gnupg coreutils
```

--------------------------------

### Install Elasticsearch on RPM-based Systems

Source: https://docs.strangebee.com/thehive/configuration/secret

Commands to add the repository and install Elasticsearch via yum.

```bash
sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
```

```bash
echo "[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0" | sudo tee /etc/yum.repos.d/elasticsearch.repo
```

```bash
sudo yum -y update
sudo yum install --enablerepo=elasticsearch elasticsearch
```

--------------------------------

### Install System Dependencies

Source: https://docs.strangebee.com/cortex/installation-and-configuration/analyzers-responders

Install required packages for running analyzers and responders on Debian-based systems.

```bash
sudo apt install -y --no-install-recommends python3-pip python3-dev ssdeep libfuzzy-dev libfuzzy2 libimage-exiftool-perl libmagic1 build-essential git libssl-dev
```

```bash
sudo pip3 install -U pip setuptools
```

--------------------------------

### Install TheHive dependencies on Linux

Source: https://docs.strangebee.com/thehive/installation/installation-guide-linux-standalone-server

Install required system packages for TheHive. Choose the command set corresponding to your Linux distribution.

```bash
sudo apt update
sudo apt install wget curl gnupg coreutils apt-transport-https git ca-certificates ca-certificates-java software-properties-common python3-pip lsb-release unzip
```

```bash
sudo yum update
sudo yum install wget curl gnupg2 coreutils chkconfig python3-pip git unzip
```

--------------------------------

### Get Analyzer Response Schema

Source: https://docs.strangebee.com/thehive/api-docs

Example JSON response structure for a successful GET request to retrieve an analyzer by ID.

```json
{
  "id": "string",
  "name": "string",
  "version": "string",
  "description": "string",
  "dataTypeList": [
    "string"
],
  "cortexIds": [
    "string"
]

}
```

--------------------------------

### Example cassandra.yaml Configuration

Source: https://docs.strangebee.com/thehive/configuration/secret

A sample configuration snippet for the cassandra.yaml file.

```yaml
# content from cassandra.yaml
[..]
cluster_name: 'thp'
data_file_directories:
- '/var/lib/cassandra/data'
commitlog_directory: '/var/lib/cassandra/commitlog'
saved_caches_directory: '/var/lib/cassandra/saved_caches'
hints_directory: '/var/lib/cassandra/hints'
authenticator: PasswordAuthenticator
authorizer: CassandraAuthorizer
[..]

```

--------------------------------

### Service Configuration Examples

Source: https://docs.strangebee.com/thehive/configuration/secret

Various configurations for root domains and custom paths behind reverse proxies.

```text
application.baseUrl = "https://thehive.example.org"
play.http.context = "/"
```

```text
application.baseUrl = "https://thehive.example.org:9000"
play.http.context = "/"
```

```text
application.baseUrl = "https://example.org/thehive"
play.http.context = "/thehive"
```

```text
application.baseUrl = "https://example.org:9000/thehive"
play.http.context = "/thehive"
```

--------------------------------

### Get Pattern Details

Source: https://docs.strangebee.com/thehive/api-docs

Example response object containing the full schema of a retrieved pattern.

```json
{
  * "_id": "string",
  * "_type": "string",
  * "_createdBy": "string",
  * "_updatedBy": "string",
  * "_createdAt": 1640000000000,
  * "_updatedAt": 1640000000000,
  * "patternId": "string",
  * "name": "string",
  * "description": "string",
  * "tactics": [
    * "string"
],
  * "url": "string",
  * "patternType": "string",
  * "capecId": "string",
  * "capecUrl": "string",
  * "revoked": true,
  * "dataSources": [
    * "string"
],
  * "defenseBypassed": [
    * "string"
],
  * "detection": "string",
  * "permissionsRequired": [
    * "string"
],
  * "platforms": [
    * "string"
],
  * "remoteSupport": true,
  * "systemRequirements": [
    * "string"
],
  * "version": "string",
  * "extraData": { }

}
```

--------------------------------

### Initialize the environment

Source: https://docs.strangebee.com/resources/docker-demo

Execute the initialization script to configure certificates, secrets, and environment variables.

```bash
bash ./scripts/init.sh
```

--------------------------------

### Retrieve Custom Fields Response Schema

Source: https://docs.strangebee.com/thehive/api-docs

Example response structure for the GET /api/v1/customField endpoint.

```json
[
  {
    "_id": "string",
    "_type": "string",
    "_createdBy": "string",
    "_updatedBy": "string",
    "_createdAt": 1640000000000,
    "_updatedAt": 1640000000000,
    "name": "string",
    "displayName": "string",
    "group": "string",
    "description": "string",
    "type": "string",
    "options": [
      0
    ],
    "mandatory": true,
    "extraData": { }
  }
]
```

--------------------------------

### Start TheHive service

Source: https://docs.strangebee.com/thehive/operations/backup-restore/restore/hot-restore/restore-hot-backup-standalone-server

Initiates the TheHive service using systemctl.

```bash
sudo systemctl start thehive
```

--------------------------------

### Observable Response JSON Schema

Source: https://docs.strangebee.com/thehive/api-docs

Example JSON structure returned by the Get Observable endpoint.

```json
{
  "_id": "string",
  "_type": "string",
  "_createdBy": "string",
  "_updatedBy": "string",
  "_createdAt": 1640000000000,
  "_updatedAt": 1640000000000,
  "dataType": "string",
  "data": "string",
  "startDate": 1640000000000,
  "attachment": {
    "_id": "string",
    "_type": "string",
    "_createdBy": "string",
    "_updatedBy": "string",
    "_createdAt": 1640000000000,
    "_updatedAt": 1640000000000,
    "name": "string",
    "hashes": [
      "string"
],
    "size": 0,
    "contentType": "string",
    "id": "string",
    "path": "string",
    "extraData": { },
    "external": true
},
  "tlp": 0,
  "tlpLabel": "string",
  "pap": 0,
  "papLabel": "string",
  "tags": [
    "string"
],
  "ioc": true,
  "sighted": true,
  "sightedAt": 1640000000000,
  "reports": { },
  "message": "string",
  "extraData": { },
  "ignoreSimilarity": true,
  "external": true
}
```

--------------------------------

### Display available entrypoint options

Source: https://docs.strangebee.com/thehive/configuration/thehive-docker-entrypoint-settings

Use this command to list all supported configuration flags for the TheHive Docker image.

```bash
docker run --rm strangebee/thehive:<thehive_version> -h
```

--------------------------------

### Get Audit Stream Response Schema

Source: https://docs.strangebee.com/thehive/api-docs

Example JSON structure for the response returned when retrieving an audit stream.

```json
[
  {
    "base": {
      "_id": "string",
      "_type": "string",
      "_createdBy": "string",
      "_updatedBy": "string",
      "_createdAt": 1640000000000,
      "_updatedAt": 1640000000000,
      "action": "string",
      "requestId": "string",
      "rootId": "string",
      "details": { },
      "objectId": "string",
      "objectType": "string",
      "object": { },
      "context": { },
      "mainAction": true
},
    "summary": {
      "property1": {
        "property1": 0,
        "property2": 0
},
      "property2": {
        "property1": 0,
        "property2": 0
}
}
}

]
```

--------------------------------

### Get User API Key Response

Source: https://docs.strangebee.com/thehive/api-docs

Example of a successful plain text response containing the user API key.

```text
GbxDw3j3qXi5MMCJmLEetMn5ilIjjWtZ
```

--------------------------------

### Get Similar Observables Response

Source: https://docs.strangebee.com/thehive/api-docs

Example response structure for retrieving similar observables between an alert and another alert or case.

```json
[
  {
    "_id": "string",
    "_type": "string",
    "_createdBy": "string",
    "_updatedBy": "string",
    "_createdAt": 1640000000000,
    "_updatedAt": 1640000000000,
    "dataType": "string",
    "data": "string",
    "startDate": 1640000000000,
    "attachment": {
      "_id": "string",
      "_type": "string",
      "_createdBy": "string",
      "_updatedBy": "string",
      "_createdAt": 1640000000000,
      "_updatedAt": 1640000000000,
      "name": "string",
      "hashes": [
        "string"
      ],
      "size": 0,
      "contentType": "string",
      "id": "string",
      "path": "string",
      "extraData": { },
      "external": true
    },
    "tlp": 0,
    "tlpLabel": "string",
    "pap": 0,
    "papLabel": "string",
    "tags": [
      "string"
    ],
    "ioc": true,
    "sighted": true,
    "sightedAt": 1640000000000,
    "reports": { },
    "message": "string",
    "extraData": { },
    "ignoreSimilarity": true,
    "external": true
  }
]
```

--------------------------------

### Instance Initialization Note

Source: https://docs.strangebee.com/resources/iaas/azure/infra-as-code/ug-secops-instances

The initialization script automatically detects existing data on persistent disks to determine whether to perform an initial setup or a restore operation.

```text
The instance initialization script will automatically detect if the persistent disks already contain data and will behave accordingly (initial setup or restore).
```

--------------------------------

### Three-Node Cluster Configuration

Source: https://docs.strangebee.com/thehive/configuration/akka

Specific configuration examples for a three-node cluster setup. Ensure the seed-nodes list is identical across all nodes.

```hocon
akka {
    cluster.enable = on
    actor {
      provider = cluster
    }
    remote.artery {
      canonical {
          hostname = "10.1.2.1"
          port = 2551
      }
    }
    # seed node list contains at least one active node
    cluster.seed-nodes = [ "akka://application@10.1.2.1:2551", "akka://application@10.1.2.2:2551", "akka://application@10.1.2.3:2551" ]
}
```

```hocon
akka {
    cluster.enable = on
    actor {
    provider = cluster
    }
    remote.artery {
    canonical {
        hostname = "10.1.2.2"
        port = 2551
    }
    }
    # seed node list contains at least one active node
    cluster.seed-nodes = [ "akka://application@10.1.2.1:2551", "akka://application@10.1.2.2:2551", "akka://application@10.1.2.3:2551" ]
}
```

```hocon
akka {
    cluster.enable = on
    actor {
    provider = cluster
    }
    remote.artery {
    canonical {
        hostname = "10.1.2.3"
        port = 2551
    }
    }
    # seed node list contains at least one active node
    cluster.seed-nodes = [ "akka://application@10.1.2.1:2551", "akka://application@10.1.2.2:2551", "akka://application@10.1.2.3:2551" ]
}
```

--------------------------------

### Hello world function example

Source: https://docs.strangebee.com/thehive/api-docs/docs.yaml

A basic implementation of the required 'handle' function that logs a message and returns a string.

```javascript
function handle(input, context) {
  console.log("Hello from TheHive");
  return "Hello world";
}
```

--------------------------------

### Bootstrap Cortex with cloud-init

Source: https://docs.strangebee.com/resources/iaas/azure/cortex

Automate disk partitioning, formatting, and application initialization using a cloud-config file.

```yaml
#cloud-config 
disk_setup:
  /dev/disk/azure/scsi1/lun0:
    table_type: gpt
    layout: True
    overwrite: True
  /dev/disk/azure/scsi1/lun1:
    table_type: gpt
    layout: True
    overwrite: True
fs_setup:
  - device: /dev/disk/azure/scsi1/lun0
    partition: none
    filesystem: ext4
  - device: /dev/disk/azure/scsi1/lun1
    partition: none
    filesystem: ext4
random_seed:
    file: /dev/urandom
    command: ["pollinate", "--server=https://entropy.ubuntu.com/"]
    command_required: true
runcmd:
    - /opt/cortex/ops/scripts/ops-cortex-init.sh /dev/sdh /dev/sdi
```

--------------------------------

### Verify Cortex installation

Source: https://docs.strangebee.com/cortex/installation-and-configuration/step-by-step-guide

Checks the installed version of Cortex to confirm successful installation.

```bash
cortex --version
```

--------------------------------

### Example elasticsearch.yml configuration

Source: https://docs.strangebee.com/thehive/installation/installation-guide-linux-standalone-server

A sample configuration file showing common settings for a standalone Elasticsearch instance.

```yaml
# content from /etc/elasticsearch/elasticsearch.yml
[..]
cluster.name: hive
thread_pool.search.queue_size: 100000
path.logs: "/var/log/elasticsearch"
path.data: "/var/lib/elasticsearch"
xpack.security.enabled: true
[..]

```

--------------------------------

### Download TheHive Package via wget

Source: https://docs.strangebee.com/thehive/operations/apt-yum-repositories-end/switch-to-manual-download-installation-thehive

Download the installation package, checksum, and signature files using wget.

```bash
wget -O /tmp/thehive_5.7.3-1_all.deb https://thehive.download.strangebee.com/5.7/deb/thehive_5.7.3-1_all.deb
wget -O /tmp/thehive_5.7.3-1_all.deb.sha256 https://thehive.download.strangebee.com/5.7/sha256/thehive_5.7.3-1_all.deb.sha256
wget -O /tmp/thehive_5.7.3-1_all.deb.asc https://thehive.download.strangebee.com/5.7/asc/thehive_5.7.3-1_all.deb.asc
```

```bash
wget -O /tmp/<file_name>.deb https://thehive.download.strangebee.com/<major.minor_version>/deb/<file_name>.deb
wget -O /tmp/<file_name>.deb.sha256 https://thehive.download.strangebee.com/<major.minor_version>/sha256/<file_name>.deb.sha256
wget -O /tmp/<file_name>.deb.asc https://thehive.download.strangebee.com/<major.minor_version>/asc/<file_name>.deb.asc
```

--------------------------------

### Install Elasticsearch on RHEL/CentOS

Source: https://docs.strangebee.com/cortex/installation-and-configuration/step-by-step-guide

Command to install Elasticsearch using the configured repository.

```bash
sudo yum install --enablerepo=elasticsearch elasticsearch
```

--------------------------------

### Cloud-init Bootstrap Script

Source: https://docs.strangebee.com/resources/iaas/azure/thehive

A cloud-init configuration to partition disks, set application base URLs, and launch the initialization script.

```yaml
#cloud-config 
disk_setup:
  /dev/disk/azure/scsi1/lun0:
    table_type: gpt
    layout: True
    overwrite: True
  /dev/disk/azure/scsi1/lun1:
    table_type: gpt
    layout: True
    overwrite: True
fs_setup:
  - device: /dev/disk/azure/scsi1/lun0
    partition: auto
    filesystem: ext4
  - device: /dev/disk/azure/scsi1/lun1
    partition: auto
    filesystem: ext4
write_files:
    - path: /opt/strangebee/ops/templates/nomad/tasks/thehive/application.conf.d/service.conf
      content: |
          application.baseUrl="https://thehive.mydomain.com/thehive"
          play.http.context="/thehive"
    - path: /opt/strangebee/ops/templates/nomad/tasks/cortex/application.conf.d/service.conf
      content: |
          play.http.context="/cortex"
runcmd:
    - [ /opt/strangebee/ops/scripts/ops-launch.sh, "-t 1", "-c 0", "-p /dev/sdh", "-d /dev/sdi" ]
```

--------------------------------

### GET /api/v1/logout

Source: https://docs.strangebee.com/thehive/api-docs/docs.yaml

Logs the user out of the current session using a GET request.

```APIDOC
## GET /api/v1/logout

### Description
Logs the user out of the current session.

### Method
GET

### Endpoint
/api/v1/logout

### Response
#### Success Response (200)
- No content returned.
```

--------------------------------

### GET /api/analyzer/type/:dataType

Source: https://docs.strangebee.com/cortex/api/api-guide

Gets a list of analyzers that can run on a given datatype.

```APIDOC
## GET /api/analyzer/type/:dataType

### Description
Gets a list of analyzers that can run on the given datatype. Requires analyze or orgAdmin role.

### Method
GET

### Endpoint
/api/analyzer/type/:dataType
```

--------------------------------

### Initialize demo data

Source: https://docs.strangebee.com/resources/docker-demo

Executes the initialization script to configure organizations, users, integrations, and sample data.

```bash
bash ./scripts/test_init_applications.sh
```

--------------------------------

### Install Cortex Helm chart

Source: https://docs.strangebee.com/cortex/installation-and-configuration/deploy-cortex-on-kubernetes

Deploys a new Cortex release using the default configuration.

```bash
helm install <release_name> strangebee/cortex
```

--------------------------------

### Install Docker on Linux

Source: https://docs.strangebee.com/cortex/installation-and-configuration/step-by-step-guide

Commands to install Docker engine on Debian/Ubuntu and RHEL/CentOS systems.

```bash
. /etc/os-release
curl -fsSL https://download.docker.com/linux/${ID}/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/${ID} ${VERSION_CODENAME:-$UBUNTU_CODENAME} stable" | sudo tee /etc/apt/sources.list.d/docker.list
sudo apt update
sudo apt install docker-ce
```

```bash
. /etc/os-release
sudo yum remove -yq docker \
          docker-client \
          docker-client-latest \
          docker-common \
          docker-latest \
          docker-latest-logrotate \
          docker-logrotate \
          docker-engine
sudo dnf -yq install dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/${ID}/docker-ce.repo
sudo dnf install -yq docker-ce docker-ce-cli containerd.io docker-compose-plugin
```

--------------------------------

### Backup Configuration File

Source: https://docs.strangebee.com/thehive/installation/upgrade-from-4.x

Create a backup of the existing application.conf file before making changes.

```bash
sudo cp /etc/thehive/application.conf /etc/thehive/application.conf.bak
```

--------------------------------

### Import GPG Key

Source: https://docs.strangebee.com/thehive/installation/upgrade-from-5.x

Import the official TheHive release key into the local GPG keyring.

```bash
gpg --import /opt/strangebee.gpg
```

--------------------------------

### Get Pattern Endpoint Definition

Source: https://docs.strangebee.com/thehive/api-docs/docs.yaml

OpenAPI definition for the GET /api/v1/pattern/{patternId} endpoint.

```yaml
/api/v1/pattern/{patternId}:
  get:
    tags:
    - Att&ck
    operationId: Get Pattern
    parameters:
    - name: patternId
      in: path
      required: true
      schema:
        description: The _id of the entity or its 'name' (depends of the entity)
        examples:
        - ~354
        type: string
    responses:
      '200':
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OutputPattern'
```

--------------------------------

### Execute TheHive migration command

Source: https://docs.strangebee.com/thehive/installation/migration

Run the migration tool from the installation directory. It is recommended to execute this as the user running TheHive service.

```bash
  /opt/thehive/bin/migrate
```

--------------------------------

### Configure System User and Permissions

Source: https://docs.strangebee.com/thehive/installation/upgrade-from-5.x

Create a dedicated system user and set appropriate file permissions for TheHive.

```bash
sudo addgroup thehive
sudo adduser --system thehive
sudo chown -R thehive:thehive /opt/thehive
sudo mkdir /etc/thehive
sudo touch /etc/thehive/application.conf
sudo chown root:thehive /etc/thehive
sudo chgrp thehive /etc/thehive/application.conf
sudo chmod 640 /etc/thehive/application.conf
```

--------------------------------

### Install Elasticsearch on Debian/Ubuntu

Source: https://docs.strangebee.com/cortex/installation-and-configuration/step-by-step-guide

Commands to add the Elasticsearch repository and install the package on Debian-based systems.

```bash
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch |  sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" |  sudo tee /etc/apt/sources.list.d/elastic-8.x.list 
sudo apt install elasticsearch   
```

--------------------------------

### Configure TheHive with cloud-init

Source: https://docs.strangebee.com/resources/iaas/aws/thehive

Use this cloud-config block to automate volume mapping, filesystem creation, and application initialization during instance launch.

```yaml
#cloud-config
bootcmd:
    - [ /usr/sbin/nvme-to-block-mapping ]
fs_setup:
    - filesystem: ext4
      device: '/dev/sdh'
      partition: auto
      overwrite: false
    - filesystem: ext4
      device: '/dev/sdi'
      partition: auto
      overwrite: false
    - filesystem: ext4
      device: '/dev/sdj'
      partition: auto
      overwrite: false
runcmd:
    - [ /opt/thehive/ops/scripts/ops-thehive-init.sh, /dev/sdh, /dev/sdi, /dev/sdj ]
```

--------------------------------

### Create TheHive Keyspace and Role

Source: https://docs.strangebee.com/thehive/installation/deploying-a-cluster

Initialize the keyspace for TheHive and grant necessary permissions to a dedicated role.

```sql
CREATE KEYSPACE thehive WITH replication = {'class': 'NetworkTopologyStrategy', 'replication_factor': '3' } AND durable_writes = 'true';

```

```sql
CREATE ROLE thehive WITH LOGIN = true AND PASSWORD = 'PASSWORD';
GRANT ALL PERMISSIONS ON KEYSPACE thehive TO 'thehive';

```

--------------------------------

### Verify Java Installation

Source: https://docs.strangebee.com/cortex/installation-and-configuration/step-by-step-guide

Checks the installed Java version to ensure the environment is correctly configured.

```bash
java -version
```

--------------------------------

### Install Required System Packages

Source: https://docs.strangebee.com/cortex/installation-and-configuration/step-by-step-guide

Installs necessary dependencies for Cortex on Debian or RPM-based systems.

```bash
apt install wget curl gnupg coreutils apt-transport-https git ca-certificates ca-certificates-java software-properties-common python3-pip lsb-release unzip
```

```bash
yum install wget curl gnupg2 coreutils chkconfig python3-pip git unzip
```

--------------------------------

### Start Elasticsearch service

Source: https://docs.strangebee.com/thehive/installation/deploying-a-cluster

Command to initialize the Elasticsearch service on each node.

```bash
service elasticsearch start
```

--------------------------------

### Initialize TheHive via shell script

Source: https://docs.strangebee.com/resources/iaas/aws/thehive

Run this command on the instance to initialize the application with the specified EBS block device names.

```bash
/opt/thehive/ops/scripts/ops-thehive-init.sh /dev/sdh /dev/sdi /dev/sdj
```

--------------------------------

### Start the Cortex service

Source: https://docs.strangebee.com/cortex/installation-and-configuration/step-by-step-guide

Initiates the Cortex service using systemd after configuration is complete.

```bash
sudo systemctl start cortex
```

--------------------------------

### Install Custom CA on Debian

Source: https://docs.strangebee.com/cortex/installation-and-configuration/ssl

Commands to install a custom certificate authority on Debian-based systems.

```bash
apt-get install -y ca-certificates-java
mkdir /usr/share/ca-certificates/extra
cp mycustomcert.crt /usr/share/ca-certificates/extra
dpkg-reconfigure ca-certificates
service cortex restart
```

--------------------------------

### Get Admin Index Status

Source: https://docs.strangebee.com/thehive/api-docs/docs.yaml

Retrieves the current status of the index via a GET request.

```yaml
  /api/v1/admin/index/status:
    get:
      tags:
      - Admin
      operationId: Get index status
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsObject'
```

--------------------------------

### Get CaseTemplate Endpoint

Source: https://docs.strangebee.com/thehive/api-docs/docs.yaml

GET request definition for retrieving a case template by its ID or name.

```yaml
/api/v1/caseTemplate/{caseTemplateNameOrId}:
    get:
      tags:
      - CaseTemplate
      operationId: Get CaseTemplate
      parameters:
      - name: caseTemplateNameOrId
        in: path
        required: true
        schema:
          description: The _id of the entity or its 'name' (depends of the entity)
          examples:
          - ~354
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OutputCaseTemplate'
        '400':
          description: BadRequest
          content:
            application/json:
              schema:
                type: object
                required:
                - type
                - message
                properties:
                  type:
                    type: string
                  message:
```

--------------------------------

### Install dependencies for RPM-based systems

Source: https://docs.strangebee.com/thehive/configuration/secret

Use this command to install required dependencies on RHEL or Fedora systems.

```bash
sudo yum update
sudo yum install wget curl gnupg2 coreutils chkconfig python3-pip git unzip
```

--------------------------------

### Configure Root Domain Base URL

Source: https://docs.strangebee.com/thehive/configuration/update-service-configuration

Examples for setting the base URL and context path when TheHive is served from the root domain.

```text
application.baseUrl = "https://thehive.example.org"
play.http.context = "/"
```

```text
application.baseUrl = "https://thehive.example.org:9000"
play.http.context = "/"
```

--------------------------------

### User creation response example

Source: https://docs.strangebee.com/cortex/api/api-guide

The JSON object returned upon successful user creation.

```json
{
  "id": "demo",
  "organization": "demo",
  "name": "Demo org Admin",
  "roles": [
    "read",
    "analyze",
    "orgadmin"
  ],
  "status": "Ok",
  "createdAt": 1526050123286,
  "createdBy": "superadmin",
  "hasKey": false,
  "hasPassword": false
}
```

--------------------------------

### Install dependencies for DEB-based systems

Source: https://docs.strangebee.com/thehive/configuration/secret

Use this command to install required dependencies on Debian or Ubuntu systems.

```bash
sudo apt update
sudo apt install wget curl gnupg coreutils apt-transport-https git ca-certificates ca-certificates-java software-properties-common python3-pip lsb-release unzip
```

--------------------------------

### Manage Cassandra Service

Source: https://docs.strangebee.com/thehive/installation/deploying-a-cluster

Command to start the Cassandra service on a node.

```bash
service cassandra start

```

--------------------------------

### Configure TheHive application.conf

Source: https://docs.strangebee.com/thehive/configuration/configure-authentication-cassandra-elasticsearch

Example configuration block for enabling basic authentication in TheHive's index settings.

```hocon
[..]
# Database and index configuration
db.janusgraph {
    storage {
        [..]
    }
    index.search {
        [..]
        # Elasticsearch authentication
        elasticsearch {
            http {
                auth {
                    type = basic
                    basic {
                        username = "thehive"
                        password = "<thehive_user_password>"
                    }
                }
            }
        }
    }
}
[..]
```

--------------------------------

### Create Custom Analyzer Folders

Source: https://docs.strangebee.com/cortex/installation-and-configuration/analyzers-responders

Set up a dedicated directory structure for custom analyzers and responders.

```bash
cd /opt
sudo mkdir -p Custom-Analyzers/{analyzers,responder}
sudo chown -R cortex:cortex /opt/Cortex-Analyzers 
```

--------------------------------

### Get Alert Feeders API Schema

Source: https://docs.strangebee.com/thehive/api-docs/docs.yaml

Defines the GET operation for retrieving all registered alert feeders.

```yaml
/api/v1/connector/alert-feeder:
    get:
      tags:
      - Alert Feeder
      description: Get all the currently registered feeders.
      operationId: Get alert feeders
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OutputAlertFeeder'
```

--------------------------------

### Get Task Endpoint Definition

Source: https://docs.strangebee.com/thehive/api-docs/docs.yaml

GET request configuration for retrieving details of a specific task by its ID.

```yaml
/api/v1/task/{taskId}:
  get:
    tags:
    - Task
    operationId: Get Task
    parameters:
    - name: taskId
      in: path
      required: true
      schema:
        description: The _id of the entity or its 'name' (depends of the entity)
        examples:
        - ~354
        type: string
    responses:
      '200':
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OutputTask'
      '400':
        description: BadRequest
        content:
          application/json:
            schema:
              type: object
              required:
              - type
              - message
              properties:
                type:
                  type: string
                message:
                  type: string
      '401':
        description: AuthenticationError
        content:
          application/json:
            schema:
              type: object
              required:
              - type
              - message
              properties:
                type:
                  type: string
                message:
```
Tokens:
Raw