How to send data from Splunk to "TheHive"(ticketing tool)?

[bagarwal]

Hello Everyone,

I am working to integrate "TheHive" i.e. ticketing tool like Demisto with Splunk. I searched in SplunkBase but there is no app available for TheHive.

Can anyone please guide me how I can start with integration or steps need to follow.

Many thanks in advance.

Regards
Binay Agarwal

[remiseguy]

To create alerts in the hive based on Splunk searches you may have a look st https://github.com/remg427/misp42splunk
Although meant to pull and push attributes in MISP you can easily connect to TH

[maciep]

I don't use TheHive (and never heard of it before), but some ideas...

First, when you say integrate, do you mean send alerts to hive from splunk? Or bring data from hive into splunk for analysis? Or both?

If alerting, it depends on what hive offeres. For example, if there is an API then maybe you can use a webhook. Or if not, but there is someway to automate it, then you could run a script when an alert fires (or an eqivalent custom action). I did find this referenced on their site which seems like it might be a good option.

For analysis, same question but the other way. Do they allow you to get data out of it? Maybe via an API? or is the data stored in database that you can get access to (in which case use dbconnect). Etc. At that point, just use splunk normally to get at the data.

[bagarwal]

Thanks for some valuable information.

To integrate I mean to send data from Splunk to hive and auto incident to be created when any alert triggers.

[Jaseemin]

Any brand new improvements on the entagration of splunk and the hive ??