Getting Data In
Highlighted

How to send data from Splunk to "TheHive"(ticketing tool)?

Path Finder

Hello Everyone,

I am working to integrate "TheHive" i.e. ticketing tool like Demisto with Splunk. I searched in SplunkBase but there is no app available for TheHive.

Can anyone please guide me how I can start with integration or steps need to follow.

Many thanks in advance.

Regards
Binay Agarwal

0 Karma
Highlighted

Re: How to send data from Splunk to "TheHive"(ticketing tool)?

Champion

I don't use TheHive (and never heard of it before), but some ideas...

First, when you say integrate, do you mean send alerts to hive from splunk? Or bring data from hive into splunk for analysis? Or both?

If alerting, it depends on what hive offeres. For example, if there is an API then maybe you can use a webhook. Or if not, but there is someway to automate it, then you could run a script when an alert fires (or an eqivalent custom action). I did find this referenced on their site which seems like it might be a good option.

For analysis, same question but the other way. Do they allow you to get data out of it? Maybe via an API? or is the data stored in database that you can get access to (in which case use dbconnect). Etc. At that point, just use splunk normally to get at the data.

0 Karma
Highlighted

Re: How to send data from Splunk to "TheHive"(ticketing tool)?

Path Finder

Thanks for some valuable information.

To integrate I mean to send data from Splunk to hive and auto incident to be created when any alert triggers.

0 Karma
Highlighted

Re: How to send data from Splunk to "TheHive"(ticketing tool)?

New Member

To create alerts in the hive based on Splunk searches you may have a look st https://github.com/remg427/misp42splunk
Although meant to pull and push attributes in MISP you can easily connect to TH

0 Karma