TheHive and Cortex Integration - Add Intelligence to Your SOC!

Подписаться 19 тыс.

Просмотров 16 тыс.

50% 1

Join me as we add intelligence to our SOC! Quickly analyze observables within your cases to discover what needs immediate action. Let's deploy a Host Intrusion Detection System and SIEM with free open source tools. Join me as we explore and learn together.
Check us out: www.opensecure...
Interact with our demo: www.opensecure...
Hire us: www.opensecure...

Опубликовано:

3 окт 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 26

@Sniperrkr 2 года назад

Your videos are "GOLD" keep it up!

@mamtatiwari2872 3 года назад

you deserve 5 Star Rating

@taylorwalton_socfortress 3 года назад

Thanks for watching :)

@comandocibernetico 3 года назад

Worked after I payed attention to the carp! :-) Congratulations!

@taylorwalton_socfortress 3 года назад

awesome! thanks for watching!

@ian230187 2 года назад

Loved this ❤️❤️

@ndapandulaandreas5153 3 года назад

Great tutorial! I’d really like to integrate my The Hive instance with my exchange server via Synapse. Please do a video on it or share some links

@danielkwakuntiamoahaddai4854 Год назад

lets connect Andreas

@younessaitichou5319 2 года назад

Thanks for the great video, I did what u ve done step by step and it worked but I want to secure my instances so as offered by thehive they recommend deploying a reverse proxy. when I did a reverse proxy for both my instances thehive and cortex, the connection between those two breaks and it doesn't show OK status anymore rather than ERROR. Could you help with that please !!!

@fikadumilkesa5327 Год назад

great tutorial. please can you show me how we can install thehive on production enviroment

@novelsync5229 2 года назад

Great tutorial, could you please create video about the hive dashboard of MTTD, MTTR

@taylorwalton_socfortress 2 года назад

I look to get that added...thanks for watching!

@allam8842 11 месяцев назад

Hi! im following all your video relating soc. Everything was working well untill this morning. Today i start the integration part at nano /etc/thehive/application.conf. Unfortunately, it happens to be error since that and my the hive 4 web cannot be access. When i run the systemctl status thehive. It display main process existed. status=255. Im quiet new in this soc field. I hope anyone can help me with it. Btw, I install everything on my ubuntu 23.04

@JoaoVictor-rw9qb 2 года назад

Can you explain for me what is Responders? And the difference between of the Analyzers?

@taylorwalton_socfortress 2 года назад

Analyzers and Responders are autonomous applications managed by and run through the Cortex core engine. Analyzers allow analysts and security researchers to analyze observables and IOCs such as domain names, IP addresses, hashes, files, URLs at scale. While many analyzers are free to use, some require special access while others necessitate a valid service subscription or product license, even though the analyzers themselves are released under an the AGPL (Affero General Public License). Responders are programs that perform different actions and apply to alerts, cases, tasks, task logs, and observables.

@vietpdMKT 2 года назад

i followed the video but i cant connect the cortex with thehive. when I click on about it says Unknown version ( Error)

@imranahmed5524 Год назад

how to find that API KEY ?

@danykarim1414 2 года назад

did not work

@jayavardhanvejendla7311 2 года назад

This is a great video. But I want to integrate the TheHive and Velociraptor tool. Is it possible? If possible, please recommend me some ways to do it.

@taylorwalton_socfortress 2 года назад

Hey, I think your best bet would be to interact with Velociraptor's api via Cortex or Shuffle rather than thehive

@cristianonate4253 3 года назад

Please could you help me with two questions. 1 How to send alerts or information to the hive, so that the hive can process it? 2. The analyzer template management option does not appear in The hive, what would be the reason?

@taylorwalton_socfortress 3 года назад

Hey Cristian, you can follow this recent video to setup ElastAlert ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-7zBGQxqf2G4.html&ab_channel=OpenSecure . ElastAlert can be configured to forward Wazuh alerts to TheHIVE automatically. Im not sure I am completely following with question 2. Analzyer configuration is setup within Cortex. TheHIVE can connect to Cortex's API to run analyzers, but analyzer management is handled within the Cortex UI Hope that helps and thanks for watching!

@FrenchSparda 2 года назад

Great tutorial, unfortunately for me I tried many times and can't integrate miso or cortex to the hive and i don't understand why

@taylorwalton_socfortress 2 года назад

Hey there, can you provide any debug information? Take a look at the /var/log/thehive/application.log and that should provide some detail as to why thehive cannot connect

@FrenchSparda 2 года назад

@@taylorwalton_socfortress hello, thank you, there was some issue with owner on the application.conf file and finally, I'm able to integrate misp with TheHive. Many thanks ;) Just one more question. Do i need to install elasticsearch on each server ? I already have an ELK server setup, but i really don't understand if I need to install elasticsearch on each server or if I must use my elk setup (I'm running each services on different server on my homemade). Sorry for the noob questions ;)

@FrenchSparda 2 года назад

@@taylorwalton_socfortress Finally, i did it ;) many thanks