TheHive is a security incident response platform that can be used to triage and enrich alerts from your security systems. Unfortunately it doesn’t have a mechanism for alerting you if there is a new event. One way to solve this is to use Elastalert.
Elastalert is a alerting tool for Elasticsearch data. It performs queries and can send the results into other systems, one of which is email.
- Install elastalert using the documentation
- Edit /etc/elastalert/config.yaml to use TheHive’s Elasticsearch database
- Create the elastalert (elastalert_status) index in Elasticsearch
- In the rules sub directory create the file thehive-email-alert.yaml
- Add the following content and save
# Alert when the rate of events exceeds a threshold # (Optional) # Elasticsearch host # es_host: elasticsearch.example.com # (Optional) # Elasticsearch port # es_port: 14900 # (OptionaL) Connect with SSL to Elasticsearch #use_ssl: True #es_username: someusername #es_password: somepassword # (Required) # Rule name, must be unique name: TheHive New Alert Email # (Required) # Type of alert. # the frequency rule type alerts when num_events events occur with timeframe time type: frequency # (Required) # Index to search, wildcard supported index: the_hive_* timestamp_field: date timestamp_type: unix_ms # (Required, frequency specific) # Alert when this many documents matching the query occur within a timeframe num_events: 1 # (Required, frequency specific) # num_events must occur within this amount of time to trigger an alert timeframe: minutes: 15 aggregation: minutes: 15 aggregation_key: "title" # (Required) # A list of Elasticsearch filters used for find events # These filters are joined with AND and nested in a filtered query # For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html #filter: #- query: # query_string: # query: "*" # (Required) # The alert is use when a match is found alert: - "email" # (required, email specific) # a list of email addresses to send alerts to email: - "myemailaddress@example.com" from_addr: "thehivealerts@mythehiveserver.com" smtp_host: "smtp.example.com" email_reply_to: "myoperationsteam@example.com" alert_subject_args: - "title" alert_subject: "New TheHive case: {0}"
6. Test it works by running
elastalert-test-rule --config /etc/elastalert/config.yaml /etc/elastalert/rules/thehive-email-alert.yaml --days 7 --alert
7. Start Elastalert
systemctl start elastalert
