Getting Data In

How to send data from Splunk to "TheHive"(ticketing tool)?

bagarwal
Path Finder

Hello Everyone,

I am working to integrate "TheHive" i.e. ticketing tool like Demisto with Splunk. I searched in SplunkBase but there is no app available for TheHive.

Can anyone please guide me how I can start with integration or steps need to follow.

Many thanks in advance.

Regards
Binay Agarwal

0 Karma

remiseguy
New Member

To create alerts in the hive based on Splunk searches you may have a look st https://github.com/remg427/misp42splunk
Although meant to pull and push attributes in MISP you can easily connect to TH

0 Karma

maciep
Champion

I don't use TheHive (and never heard of it before), but some ideas...

First, when you say integrate, do you mean send alerts to hive from splunk? Or bring data from hive into splunk for analysis? Or both?

If alerting, it depends on what hive offeres. For example, if there is an API then maybe you can use a webhook. Or if not, but there is someway to automate it, then you could run a script when an alert fires (or an eqivalent custom action). I did find this referenced on their site which seems like it might be a good option.

For analysis, same question but the other way. Do they allow you to get data out of it? Maybe via an API? or is the data stored in database that you can get access to (in which case use dbconnect). Etc. At that point, just use splunk normally to get at the data.

0 Karma

bagarwal
Path Finder

Thanks for some valuable information.

To integrate I mean to send data from Splunk to hive and auto incident to be created when any alert triggers.

Jaseemin
Engager

Any brand new improvements on the entagration of splunk and the hive ?? 

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...