wazuh & thehive integration

[Suat Toksöz]

Hi,

Is it possible to integrate thehive with wazuh-server? After generating alerts on the wazuh-server, move that alerts to thehive application.

Best regards,

Suat Toksöz

Wazuh 3.10.2

Elastic Stack 7.3.2

[David Vidriales]

Hi Suat,

There's currently an opened issue to develop an integration with TheHive (https://github.com/wazuh/wazuh/issues/3680).

In the meantime, you can try to send the alerts from Wazuh to TheHive. This has been explained in the Wazuh slack channel (https://wazuh.slack.com/archives/C0A933R8E/p1571250813320800?thread_ts=1571243231.314300&cid=C0A933R8E).

Here's the explanation just in case you don't use slack (if you want to join our slack channel you just have to fill in your mail in https://wazuh.com/community/join-us-on-slack/):

Yes. It is possible.Wazuh Manager sends its events to ElasticSearch and TheHive can get its information from ElasticSearch thanks to an open software called ElastAlert.ElastAlert will watch for events of interest and generate alerts inside TheHive. Here you can find a very thorough explanation on how to integrate Wazuh, ElasticSearch and TheHive. Hopefully it will answer your question.
https://arnaudloos.com/2019/open-source-sirp-overview/Please, let me know if you have any more questions I can help you with.

Best regards,

David