C’est La Vie !

Earlier today, we released Mellifera 12.1. Shortly after, we published 3 new Cortex analyzers: WOT, YETI and Cuckoo Sandbox.

It’s time for us to rest. We are closing* TheHive’s code kitchen for most of August 2017 to enjoy all what France has to offer: wine (obviously), literature, beaches, mountains, gorgeous food, and a unique savoir vivre. 

So keep calm and eat croissants. 

7077fd0ed647dcfb44c46cad88680f7d.jpg
Source : Pinterest

See you back soon. Au revoir !

(*) Bear with us as we will be particularly slow to respond to support and feature requests as well as Gitter queries.

WOT? Did You See a Yeti Hugging a Cuckoo?

While many are enjoying the summer holidays, the busy bees of TheHive Project have been working hard lately to develop new Cortex analyzers and review few of those submitted by our growing and thriving user community, bringing the grand total to 27. Yes, you read that right. Cortex can leverage 27 analyzers to help you analyze observables very simply in many different ways.

The latest update to the Cortex-analyzers repository contains 3 new analyzers: Yeti, Cuckoo Sandbox and WOT, described below. And your first step to benefit from them should consist of refreshing your master working copy on your Cortex instance:

$ cd where/your/analyzers/are
$ git pull master

Yeti

YETI is a FOSS platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository.  It is mainly developed by fellow APT busters Thomas Chopitea and Gael Muller (who said France doesn’t produce good software?).

The new Cortex analyzer for this platform lets you make API calls to YETI and retrieve all available information pertaining to a domain, a fully qualified domain name, an IP address, a URL or a hash.

To be able to use the analyzer edit the Cortex configuration file (/etc/cortex/application.conf) and add the following lines:

Yeti {
    # URL of the Yeti server: example: http://120.0.0.1:5000
    url = ""
}

When called from TheHive, the following output is produced:

sc-YETI-short.png

sc-YETI-long.png
TheHive: YETI analyzer — Short and Long Report Samples

CuckooSandox

The Cuckoo Sandbox analyzer has been submitted by Andrea Garavaglia (Thanks!) and you can use it to analyze files and URLs with Cuckoo Sandbox.

By default, we chose to limit analysis to TLP:WHITE and TLP:GREEN observables for OPSEC reasons, in case your Cuckoo server provides Internet access to potentially harmful files. If you want to use it with TLP:AMBER or TLP:RED observables, edit CuckooSanbox_File_analysis.json or CuckooSanbox_URL_analysis.json and change the max_tlp parameter to 2 or 3.

To use the analyzer, edit the Cortex configuration file and add the following lines:

CuckooSandbox {
   url = “http://mycuckoosandbox”
}

When called from TheHive, the following output is produced:

sc-CSB-short.png

sc-CSB-long.png
TheHive: Cuckoo Sandbox Analyzer — Short and Long Report Samples

WOT

The WOT analyzer was also submitted by Andrea Garavaglia (kudos!). Use it to check reputation of a given domain on the Web of Trust service. It takes domains and FQDNs as input.

An API key is needed to use this service, and has to be added in the Cortex configuration file:

WOT {
    # API key of the Web of Trust account
    key=“”
}

When called from TheHive, the following output is produced:

sc-WOT-short.png.png

sc-WOT-long.png.png
TheHive: WOT Analyzer — Short and Long Report Samples

Support

Something does not work as expected? No worries, please join our  user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We are here to help.

 

Mellifera 12.1 Released

About a month ago, we published Mellifera 12 which brought numerous features such as mini-reports on the observable page, custom fields, alert similarity or template selection during alert imports.

Great, palatable recipes, even if they are cooked by fine French chefs, need to be refined over time and may not be as savoury as intended when they are served in their early days. Quality takes time, although smokeware vendors would have you think otherwise.

Mellifera 12.1 (TheHive 2.12.1) has been released to fix a number of outstanding bugs:

  • #249: renaming of users does not work
  • #254: TheHive does not send the file’s name when communicating with Cortex
  • #255: merging an alert into an existing case does not merge the alert description into the case’s description
  • #257: while TheHive does not let you add multiple attachments to a single task log, the UI makes you believe otherwise
  • #259: fix an API inconsistency. GET /api/case/task/:id/log has been fixed.
    And a new API call POST /api/case/task/:taskId/log/_search  has been added, which accepts a “query” in the request body to filter logs of the task.
  • #268: cannot create an alert if the IOC field is set for a single alert’s attribute.
  • #269: closing a case with an open task does not dismiss it from ‘My Tasks’.

This new minor release adds the following enhancements:

  • #267: fix warnings in the DEB package.
  • #272: in alert preview, similar cases are shown regardless of their status. Merged or deleted ones should not appear in that list.

How About the Test VM?

The test VM has not been updated yet. It still contains Mellifera 12 (TheHive 2.12.0). We will update it in September, probably when Mellifera 13 is released. That version will bring the ability to export cases as MISP events.

Download & Get Down to Work

If you have an existing installation of TheHive, please follow the migration guide.

If you are performing a fresh installation, read the installation guide corresponding to your needs and enjoy. Please note that you can install TheHive using an RPM or DEB package, use Docker, install it from a binary or build it from sources.

Support

Something does not work as expected? You have troubles installing or upgrading? No worries, please join our  user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We are here to help.

Train till you Drain: TheHive & Cortex VM

Rejoice folks! You can now play with TheHive & Cortex thanks to the test VM we created. It includes Mellifera 12, the latest major version of TheHive, Cortex 1.1.3, the latest Cortex analyzers with all dependencies and ElasticSearch installed on top of Ubuntu 16.04 with Oracle JRE 8.

The test VM is intended to be used… well… for testing or training purposes. We strongly encourage you to refrain from using it for production.

Get It

You can download the VM from the following location:

https://drive.google.com/file/d/0B3G-Due88gfQYWR6WVlkLWhRemM/view?usp=sharing

To ensure that your download went through nicely, check the file’s SHA256 hash which must be equal to the following value:

17df5989d852583e3046daefb97caadff90d30ecf4402df69cf6036d7ad1cacd

The system’s login is thehive and the associated password is thehive1234.

Use It

You can start using TheHive & Cortex once the VM is started. To access TheHive, point your browser to the following URL:

http://IP_OF_VM:9000

For Cortex, the port is 9999:

http://IP_OF_VM:9999

Configure TheHive

The first time you access TheHive, you’ll need to create the associated database by clicking on the Update Database button as shown below:

Screen_Shot_2017-07-06_at_21_52_46.png
Update TheHive’s Database on First Access

TheHive’s configuration file is located in /etc/thehive/application.conf. For additional configuration, read the docs.

Cortex

TheHive is already configured to use the local Cortex service.

Analyzer and Associated Report Templates

To fully benefit from the analyzers, you should install the associated report templates:

  • download the report template package
  • log in TheHive using an administrator account
  • go to Admin > Report templates menu
  • click on Import templates button and select the downloaded package
Plug it with MISP

The test VM does not contain a MISP instance and none is configured in TheHive’s configuration file.  To play with MISP, you may want to use the VM our good friends at CIRCL provide.  Once you’ve downloaded it or if you have an existing instance, edit /etc/thehive/application.conf and follow the configuration guide.

Restart or Go Mad

After each modification of /etc/thehive/application.conf do not forget to restart the service:

$ sudo service thehive restart

Troubles?

TheHive service logs are located in /var/log/thehive/application.log.

Configure Cortex

All available analyzers are installed with their dependencies, but none is configured. To configure analyzers, edit /etc/cortex/application.conf and follow the configuration guide.

Restart or Go Mad

After each modification of /etc/cortex/application.conf do not forget to restart the service:

$ sudo service cortex restart
Troubles?

Cortex service logs are located in /var/log/cortex/application.log.

Need Help?

Something does not work as expected? No worries, we got you covered. Please join our  user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We are here to help.

 

Correction: July 8, 2017 
An earlier version of this post offered to download the VM from Dropbox but they suspended the associated link due to seemingly heavy traffic. The post was updated to replace the Dropbox link with a Google Drive one.

TheHive4py 1.2.2 is Here

It’s a sunny week in Paris, France (not Texas) barring the tropical rain that washed out the city earlier this morning. And when there’s sun in France, there’s happiness and… coding of course (what else?). The French Chefs of TheHive Project seem to be in a good mood (n’est-ce pas Jérôme ?), thanks to the vitamin D extra charge they got for free from the big star up above.

After updating CortexUtils and the analyzers, and releasing Mellifera 12, a new, major version of TheHive, why stop there when you can update TheHive4py as well?

Version 1.2.2 of the Python API client for TheHive is now available. It mainly fixes issues related to missing Python dependencies and adds support for creating alerts containing files for Python 3.

To update your existing package:

$ sudo pip install thehive4py --upgrade

If you are just getting started with TheHive4py, you can forgo the --upgrade at the end of the command above.

Houston? Are you There?

Shall you encounter any difficulty, please join our  user forum, contact us on Gitter, or send us an email at support@thehive-project.org. As usual, we’ll be more than happy to help!

 

Mellifera 12: The MAGA Edition

TheHive Project French Chefs are very happy to announce Mellifera 12, a brand new, all shiny, major version of TheHive.

This MAGA (Make Analysis Great Again) edition of your (soon to be?) favorite Security Incident Response Platform (SIRP) contains an awful lot of changes and improvements. While you can read the full changelog while waiting in line for your burger at HopDoddy or for your turn for the latest Disney attraction, we’d like to concentrate on a few features that would make you enjoy Digital Forensics & Incident Response like never before 🙂

Go Short or Go North

The Observables tab can now display the short (a.k.a. mini) reports produced by analyzers. Whenever you run an analysis (or many), the mini-reports will be shown as soon as the corresponding analyzer jobs have successfully finished. That way, you no longer have to click on each observable to access the short report.

sc-Mellifera12-#131.png
Short Reports shown on the Observables Tab

In fact, you don’t even have to click on the observable to access the long reports. You must simply click on the corresponding short report and the long one will be displayed on top of the observables tab as shown in the following screencast. Ain’t that nifty?

 

sc-Mellifera12-#191-2.png
A Single Click on the Short Report Shows the Long One

The short reports have been also improved to follow a taxonomy. To get to this stage, we had to review all 24 analyzers and their flavors, add new functionality to the CortexUtils Python library and improve the analyzers to add a summary section to their JSON output which Mellifera 12 interprets and displays according to a color code as described in our previous post. Please make sure to read it as it contains important information on how to update your cortexutils version and the analyzers as well as the report templates.

Is This Alert New or What?

Mellifera 12 introduces an important feature pertaining to alerts. To put it simply, whenever you receive a new alert from MISP, email, SIEM or any other source that you have connected with TheHive, the alert preview page will tell you if there are similarities with existing cases and if so, Mellifera 12 will let you import the new alert in the existing case and any updates made to that alert (think of an ongoing MISP event) will be automatically added to the case.

sc-mellifera12-#232.png
Alert Preview Page with the new Similar cases Section

Template this, Template that

In addition to the ‘similarity’ feature outlined above, Mellifera 12 lets you choose the case template to use when importing a new alert instead of having to use only a specific case template per alert type/source.

sc-mellifera12-#232-2.png
Choose the Template You’d Like to Use to Import an Alert

Custom Fields

We heard our community and implemented a feature that was requested by several users: custom fields.

So you’d like to add a business impact to a specific type of cases? Or a set of TTPs? Or a Threat Actor? Or specify a Business Unit? No problem! Ask an admin to create a custom field, associate it with a case template and there you go.

sc-mellifera12-#12-customfields2.png
Add a Custom Field

Unlike metrics, custom fields must not be filled to close a case. You can also supercharge a case with custom fields that have not been associated to a case template. We currently support four types of custom fields: strings, numbers, booleans and dates. And you can create lists of acceptable values to limit your analysts’ choices to legitimate data.

Other New Features

Mellifera 12 gives you the ability to reopen closed tasks. And when viewing the related cases tab of the current case, you’ll see the resolution status of the ones that were closed (false positive, true positive, indeterminate). External links will also be opened in a new tab.  Moreover, files included in alerts are no longer limited to 32 KB so you have no longer an excuse to avoid sending user email reports with their attachments to TheHive 😉

Download & Get Down to Work

If you have an existing installation of TheHive, please follow the migration guide.

If you are performing a fresh installation, read the installation guide corresponding to your needs and enjoy. Please note that you can install TheHive using an RPM or DEB package, use Docker, install it from a binary or build it from sources.

Support

Something does not work as expected? You have troubles installing or upgrading? No worries, please join our  user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We are here to help.

All Fresh CortexUtils, New Cortex Analyzers

Ahead of the imminent release of Mellifera 12 (TheHive 2.12.0), a new, major (as in MAJOR) version of your (soon to be?) favorite Security Incident Response Platform, we’ve made rather significant changes to Cortex analyzers and released a new version of the CortexUtils Python library.

TL;DR

If you are in a hurry:

$ sudo pip install cortexutils --upgrade
$ cd where/your/analyzers/are
$ git pull master

Adjust the Cortex configuration for the new MISP 2.0 analyzer and for Hippocampe as shown below if you are using these analyzers then import the corresponding report templates into TheHive:

  • download the updated package
  • log in TheHive using an administrator account
  • go to Admin > Report templates menu
  • click on Import templates button and select the downloaded package

CortexUtils 1.2.0

CortexUtils has been updated to include a new function called build_taxonomy() which is required for analyzers relying on the Python library we released to make their development development easier.

Mini-Reports in The Observable Tabs

Starting from Mellifera 12 (TheHive 2.12.0), mini-reports will be displayed in the observable tab in each case as soon as an analysis has been completed. Now analyzers compute their short/mini reports and put them in the summary section of their JSON output, ready for consumption. TheHive 2.12.0 and up will no longer create them on-the-fly.

Taxonomy

The mini-reports of all the analyzers have been updated to comply with a taxonomy that is similar to the one we were already using for VirusTotal:  VT:Score="14/56”.  A “maliciousness” level was already included in TheHive’s analyzer templates and we used a specific color to display each level. This level is now produced directly by the analyzers:

  • info / blue: the analyzer produced an information, and the short report is shown in blue color in TheHive.
  • safe / green : the analyzer did not find anything suspicious or the analyzed observable is safe (according to the analyzer). TheHive displays the short report in green color.
  • suspicious / orange : the analyzer found that the observable is either suspicious or warrants further investigation. The short report is orange colored in TheHive.
  • malicious / red : the analyzer found that the observable is malicious. The short report is displayed by TheHive in red color as show below:

sc-short-VT.png

The short report is built with the summary() function of an analyzer. The build_taxonomy() of cortexutils mentioned earlier should help building it.

MISP 2.0

The MISP analyzer has been updated to version 2.0 and includes new functionality submitted by our long-term contributor Nils Kuhnert from CERT-Bund (thanks a heap!). Unlike the previous version, v 2.0 will let you search for an observable in multiple MISP servers at the same time.

The analyzer accepts a truckload of datatypes as input. To make it work, install the pymisp Python library. It should already have been installed if you are just updating your current analyzers. You will also have to change Cortex configuration file (application.conf) for this new version:

MISP {
 url=["https://mymispserver_1", "https://mymispserver_2"]
 key=["mykey_1", "mykey_2" ]
 certpath=["", ""]
 name=["MISP_SERVER_NAME_1", "MISP_SERVER_NAME_2"]
}

Important note: You have to adjust your existing configuration to match the one shown above. The certpath variable can be left blank if you are not using a self-signed certificate.

When called from TheHive, the following output is produced:

sc-short-MISP.png

sc-MISP-long.png
TheHive: MISP 2.0 Analyzer – Short and Long Report Samples

The short report will show the number of unique events found in all MISP servers while the long report will show information of each matching event in each MISP server.

CERTatPassiveDNS

The CERTatPassiveDNS analyzer is a new submission by Nils (thanks again). It lets you check the CERT.at PassiveDNS service for a given domain or hostname. It takes domains and FQDN as input.

Access to the CERT.at service is allowed to trusted partners only. If you think you qualify, please contact CERT.at. You do not need to add specific information into the Cortex configuration file to benefit from this analyzer as it calls the whois system command to perform the pDNS requests.

When called from TheHive, the following output is produced:

sc-certatpdns-short.png

 

sc-long-CERTatPassiveDNS_1_0.png
TheHive: CERTatPassiveDNS Analyzer – Short and Long Report Samples

 

Miscellaneous

The latest version of the Cortex-analyzers repository also include the following bug fixes and improvements:

Running Into Trouble?

Shall you encounter any difficulty, please join our  user forum, contact us on Gitter, or send us an email at support@thehive-project.org. We will be more than happy to help!

Correction: July 6, 2017 
An earlier version of this post mispelled Nils Kuhnert’s last name.