here is my rule in /etc/elastalert/rules # hive.yaml # Elastalert rule to forward IDS alerts from Security Onion to a specified TheHive instance. I have deployed hive and elastalert in docker but I cannot configure them properly to integrate such that hive receives alerts automatically from elastalert. @AFD14: Hello everyone!



Most of my time on checking the capabilities of thehive was actually spent on trying to debug custom analyzers/responders I have written in Cortex.

2. Here we learned some prerequisites to install hive and how to install hive step by step for better understanding. I have also tried using a new version of Cortex and had the same results. # es_host: elasticsearch es_port: 9200 name: TheHive - New IDS Alert! I have put the API key and specified the cortex URL (localhost:9001) and uncommented the play.modules line.

Hive is built on Hadoop core as it uses Mapreduce for execution. The analyzers are working in Cortex, but they are not showing up in the hive when I want to analyze an Observable.


Much easy to retrieve the data and do processing of Big Data. Below the dial on the thermostat there are 3 buttons. This is a guide to Hive Installation.
I am using TheHive 3.4.2-1 and Cortex 2.1.3-1.

Does anyone know where I can find the application.conf in the context of a docker install? Make sure the status light on the receiver has turned green at this point and you are then free to exit the install screen on the app/web. @christiaanvaken: @Mark-E-IT Cortex uses analyzers in Docker containers these days. Recommended Articles. Hive 2 Thermostat: 1. We recommend that you install Hive Active Heating™ in the order shown in the diagram below.

@DarrenSykes I found Cortex to be a significant overhead.

I was wondering if its possible to have another service and link thehive to that one.

Push and hold down the button on the left and the button in the middle (Back arrow and Menu) at the same time. I was thinking to have microservices for such a thing. I am just getting started.

Any help would be much appreciated.

You will get a warning when you use the old way. This is the simplest route and should ensure a quick and efficient setup.