TheHive connector and action

TheHive connector uses the TheHive (v1) REST API to create cases and alerts. [8.16.0]

Note

If you use this connector with cases, the status values differ in Kibana and TheHive. The status values are not synchronized when you update a case.

Create connectors in Kibana

You can create connectors in Stack Management > Connectors or as needed when you're creating a rule. For example:

Connector configuration

TheHive connectors have the following configuration properties:

Name: The name of the connector.
Organisation: The organisation in TheHive that will contain the cases or alerts.
URL: The instance URL in TheHive.
API key: The API key for authentication in TheHive.

Test connectors

You can test connectors for creating a case or an alert with the run connector API or as you're creating or editing the connector in Kibana. For example:

TheHive actions have the following configuration properties.

Event action

The action that will be performed in TheHive: create a case or an alert.

Title

The title of the incident.

Description

The details about the incident.

Severity

The severity of the incident: LOW, MEDIUM, HIGH or CRITICAL.

Note

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.1 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. While creating an alert, use the Keep severity from rule toggle to create an alert with the rule's severity. If the rule does not have a defined severity, the alert will have the default MEDIUM severity.

TLP

The traffic light protocol designation for the incident: CLEAR, GREEN, AMBER, AMBER+STRICT or RED.

Tags

The keywords or tags for the incident.

Additional comments

Additional information about the incident.

Type

The type of alert.

Source

The source of the alert.

Source reference

A source reference for the alert.

Body The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.1 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

A Json payload specifying additional parameter, such as observables and procedures. For example:

{
  "observables": [
    {
      "dataType": "url",
      "data": "<EXAMPLE_URL>"
    }
  ],
  "procedures": [
    {
      "patternId": "TA0001",
      "occurDate": 1640000000000,
      "tactic": "tactic-name"
    }
  ]
}

Connector networking configuration

Use the Action configuration settings to customize connector networking configurations, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use xpack.actions.customHostSettings to set per-host configurations.

Configure TheHive

To generate an API key in TheHive:

Log in to your TheHive instance.
Open profile tab and select the settings.
Go to API Key.
Click Create if no API key has been created previously; otherwise, you can view the API key by clicking on Reveal.
Copy the API key value to configure the connector in Kibana.