topic Re: How to send data from Splunk to "TheHive"(ticketing tool)? in Getting Data In

How to send data from Splunk to "TheHive"(ticketing tool)?

bagarwal — Fri, 30 Jun 2017 06:15:15 GMT

Hello Everyone,

I am working to integrate "TheHive" i.e. ticketing tool like Demisto with Splunk. I searched in SplunkBase but there is no app available for TheHive.

Can anyone please guide me how I can start with integration or steps need to follow.

Many thanks in advance.

Regards
Binay Agarwal

Re: How to send data from Splunk to "TheHive"(ticketing tool)?

maciep — Fri, 30 Jun 2017 15:46:00 GMT

I don't use TheHive (and never heard of it before), but some ideas...

First, when you say integrate, do you mean send alerts to hive from splunk? Or bring data from hive into splunk for analysis? Or both?

If alerting, it depends on what hive offeres. For example, if there is an API then maybe you can use a webhook. Or if not, but there is someway to automate it, then you could run a script when an alert fires (or an eqivalent custom action). I did find this referenced on their site which seems like it might be a good option.

For analysis, same question but the other way. Do they allow you to get data out of it? Maybe via an API? or is the data stored in database that you can get access to (in which case use dbconnect). Etc. At that point, just use splunk normally to get at the data.

Re: How to send data from Splunk to "TheHive"(ticketing tool)?

bagarwal — Wed, 05 Jul 2017 06:28:31 GMT

Thanks for some valuable information.

To integrate I mean to send data from Splunk to hive and auto incident to be created when any alert triggers.

Re: How to send data from Splunk to "TheHive"(ticketing tool)?

remiseguy — Tue, 30 Jan 2018 22:16:52 GMT

To create alerts in the hive based on Splunk searches you may have a look st https://github.com/remg427/misp42splunk
Although meant to pull and push attributes in MISP you can easily connect to TH

Re: How to send data from Splunk to "TheHive"(ticketing tool)?

Jaseemin — Tue, 31 May 2022 05:12:43 GMT

Any brand new improvements on the entagration of splunk and the hive ??