ReconInfoSec / graylog2thehive

Create alerts in The Hive from your Graylog alerts, to be turned into Hive cases.

graylog2thehive

Create alerts in The Hive from your Graylog alerts, to be turned into Hive cases.

Simple Python flask app that runs as a web server, and accepts POST requests from your Graylog notifications.

git clone https://github.com/ReconInfoSec/graylog2thehive.git /opt/graylog2thehive

Get up and running:

• Configure SSL certificate paths in app.py, or remove all context lines if not using SSL
• Copy init.d/graylog2thehive.service to /etc/systemd/system/graylog2thehive.service
• Set your Hive API key in /etc/systemd/system/graylog2thehive.service for the HIVE_SECRET_KEY
• Set your Hive and Graylog URLs in config.py
• Optional: app/__init__.py, configure any other IP, hash, URL, or filename fields in place of src_ip and dst_ip to include them as artifacts/observables in your alert

pip install -r requirements.txt
cp init.d/graylog2thehive.service /etc/systemd/system/graylog2thehive.service
systemctl enable graylog2thehive
systemctl start graylog2thehive

• Runs at https://0.0.0.0:5000, accepts POST requests
  • Point your Graylog Legacy Alarm Callback to https://[YOURSERVER].com:5000/create_alert
  • Point your Graylog HTTP Notification to https://[YOURSERVER].com:5000/create_alert_http