Cyber Security: thehive install - Revision history

Unknown user at 00:55, 17 July 2023

2023-07-17T00:55:54Z

← Older revision		Revision as of 00:55, 17 July 2023
Line 1:		Line 1:
	~~Overview#~~		Application Stack TheHive dapat di deploy pada standalone server atau sebagai cluster. Aplikasi TheHive bergantung pada:
	Application ~~StackTheHive can be deployed on a~~ standalone server ~~or as a~~ cluster. ~~The application relies on~~:

	* Apache Cassandra ~~to store~~ data (~~Supported version~~: 4.x).		* Apache Cassandra untuk menyimpan data (Versi yang didukung: 4.x).
	* Elasticsearch ~~as indexing engine~~ (~~Supported version~~: 7.x).		* Elasticsearch sebagai mesin pengindeksan (Versi yang didukung: 7.x).
	* A file ~~storage solution is also required~~ ; ~~the local filesystem of the~~ server ~~hosting the application is adequate in the standalone~~ server ~~scenario~~ ; S3 MINIO ~~otherwise~~.		* Sebuah solusi penyimpanan file juga diperlukan; sistem berkas lokal dari server yang menghosting aplikasi memadai dalam skenario server mandiri; S3 MINIO jika ingin lebih enak.

			==Arsitektur The Hive==

	~~Architecture#~~		Setiap lapisan, aplikasi TheHive, mesin Database & indeks, dan penyimpanan file, bersifat independen dan dapat diatur sebagai node atau cluster yang berdiri sendiri. Akibatnya, TheHive dapat diatur dan bekerja dalam arsitektur custer yang kompleks, menggunakan alamat IP virtual dan load balancer.
	~~Each layer~~, TheHive ~~application~~, ~~the~~ Database & ~~index engine~~, ~~and~~ file ~~storage~~, ~~is independant and can be set up as a standalone~~ node or cluster. ~~As a result~~, TheHive ~~could be setup and work in a complex clustered archicteture~~, ~~using~~ virtual ~~IP addresses and~~ load ~~balancers~~.

			==Kebutuhan Hardware==
			Persyaratan perangkat keras bergantung pada jumlah pengguna bersamaan (termasuk integrasi) dan cara mereka menggunakan sistem. Tabel berikut menampilkan ambang aman saat menghosting semua layanan di mesin yang sama:

	~~Standalone server~~		Jumlah User TheHive Cassandra ElasticSearch
	~~Cluster or hybrid architecture~~

	~~Standalone server~~

	~~All applications are installed on the same server.~~

	* Cassandra
	* Elasticsearch
	* Files are store on the filesystem (or MinIO if desired)
	~~TheHive~~
	~~NGINX (optional): to manage HTTPS communications~~

	~~Instructions included in the step-by-step installation guide ends up to install a standalone server.~~


	~~Requirements#~~
	Hardware requirements depends on the number of concurrent users (including integrations) and how they use the system. The following table diplays safe thresholds when hosting all services on the same machine:

	~~Number of users~~ TheHive Cassandra ElasticSearch
	< 10 2 / 2 GB 2 / 2 GB 2 / 2 GB		< 10 2 / 2 GB 2 / 2 GB 2 / 2 GB
	< 20 2-4 / 4 GB 2-4 / 4 GB 2-4 / 4 GB		< 20 2-4 / 4 GB 2-4 / 4 GB 2-4 / 4 GB
	< 50 4-6 / 8 GB 4-6 / 8 GB 4-6 / 8 GB		< 50 4-6 / 8 GB 4-6 / 8 GB 4-6 / 8 GB

	~~Spec~~ yang aman		Pada saat instalasi, biasanya TheHive agak rewel. Spesifikasi yang aman
	* 4 core CPU		* 4 core CPU
	* 16 G RAM		* 16 GB RAM


	~~Tip~~

	~~If you are installing everything on the same server, we recommend at least 4 cores and 16 GB of RAM. And don't forget to set up jvm.options at least for Elasticsearch.~~		==Sistem Operasi==

	~~Operating systems#~~		Sistem operasi yang di dukung,
	~~TheHive has been tested and is supported on the following operating systems:~~

	* Ubuntu 20.04 LTS & 22.04 LTS		* Ubuntu 20.04 LTS & 22.04 LTS
Line 52:		Line 31:
	* Fedora 35 & 37		* Fedora 35 & 37

	~~StrangeBee also provides an official Docker image.~~		Jika kita menggunakan salah satu OS di atas, kita dapat menjalankan script berikut,

	~~Installation guides#~~
	~~Too much in a hurry to read ?~~



	~~If you are using one of the supported operating systems~~, ~~use our all-in-one installation~~ script:

	apt update		apt update
	wget -q -O /tmp/install.sh https://archives.strangebee.com/scripts/install.sh ; sudo -v ; bash /tmp/install.sh		wget -q -O /tmp/install.sh https://archives.strangebee.com/scripts/install.sh ; sudo -v ; bash /tmp/install.sh

	~~This script helps with the installation process on a fresh and supported OS ; the program also run successfully if the conditions in terms of hardware requirements are met.~~

	~~Akan~~ tampil pada layar, informasi berikut,		Jika semua syarat di penuhi maka akan tampil pada layar, informasi berikut,

	TheHive & Cortex installation script, for Linux operating systems with DEB or RPM packages.		TheHive & Cortex installation script, for Linux operating systems with DEB or RPM packages.
Line 94:		Line 65:

	---		---

	1) Setup proxy settings		1) Setup proxy settings
	2) Install TheHive		2) Install TheHive
Line 102:		Line 73:
	Select an option:		Select an option:

			Untuk intalasi TheHive pilih no 2. Kita perlu menunggu beberapa jam sampai proses instalasi selesai.

	~~Pilih~~ no 2. Kita perlu menunggu beberapa jam sampai proses instalasi selesai.

	Cek status		Cek status
Line 162:		Line 131:
	username admin@thehive.local		username admin@thehive.local
	password secret		password secret

Unknown user at 00:32, 17 July 2023

2023-07-17T00:32:35Z

@@ Line 160: / Line 160: @@
 Menggunakan
-  username admin
+  username admin@thehive.local
- password sesuai dengan /etc/thehive/secret.conf
+  password secret

Unknown user at 00:26, 17 July 2023

2023-07-17T00:26:58Z

@@ Line 1: / Line 1: @@
 Overview#
 Application StackTheHive can be deployed on a standalone server or as a cluster. The application relies on:
@@ Line 67: / Line 66: @@
 This script helps with the installation process on a fresh and supported OS ; the program also run successfully if the conditions in terms of hardware requirements are met.
+Akan tampil pada layar, informasi berikut,
   TheHive & Cortex installation script, for Linux operating systems with DEB or RPM packages.
@@ Line 115: / Line 104: @@
 Use a dedicated server#

Unknown user at 21:16, 16 July 2023

2023-07-16T21:16:19Z

← Older revision		Revision as of 21:16, 16 July 2023
Line 77:		Line 77:

	For each release, DEB, RPM and ZIP binary packages are built and provided. Discover how to install TheHive quickly by following our installation guides:		For each release, DEB, RPM and ZIP binary packages are built and provided. Discover how to install TheHive quickly by following our installation guides:


			TheHive & Cortex installation script, for Linux operating systems with DEB or RPM packages.
			This script supports the installtion of TheHive on x86_64 and ARM servers, and Cortex on x86_64 only.

			Following install options are available:
			- Configure proxy settings
			- Install TheHive 5.1 (x86_64 or ARM)
			- Install Cortex (running Analyzers and Responders with Docker) (x86_64 only)
			- Install Cortex (running Analyzers and Responders on the host -- Not recommended, supported on Ubuntu and Debian ONLY) (x86_64 only)

			This script has sucessfully been tested on freshly installed Operating Systems:
			- Fedora 35 & 37
			- RHEL 8.5
			- Ubuntu 20.04 LTS & 22.04 LTS
			- Debian 11

			Requirements:
			- 4vCPU
			- 16 GB of RAM

			Usage:

			$ wget -q -O /tmp/install.sh https://archives.strangebee.com/scripts/install.sh ; sudo -v ; bash /tmp/install.sh

			Maintained by: ©StrangeBee - https://www.strangebee.com

			---

			1) Setup proxy settings
			2) Install TheHive
			3) Install Cortex (run Neurons with docker)
			4) Install Cortex (run Neurons locally)
			5) Quit
			Select an option:





	Use a dedicated server#		Use a dedicated server#

Unknown user at 21:14, 16 July 2023

2023-07-16T21:14:19Z

← Older revision		Revision as of 21:14, 16 July 2023
Line 62:		Line 62:
	If you are using one of the supported operating systems, use our all-in-one installation script:		If you are using one of the supported operating systems, use our all-in-one installation script:

			apt update
	wget -q -O /tmp/install.sh https://archives.strangebee.com/scripts/install.sh ; sudo -v ; bash /tmp/install.sh		wget -q -O /tmp/install.sh https://archives.strangebee.com/scripts/install.sh ; sudo -v ; bash /tmp/install.sh

	This script helps with the installation process on a fresh and supported OS ; the program also run successfully if the conditions in terms of hardware requirements are met.		This script helps with the installation process on a fresh and supported OS ; the program also run successfully if the conditions in terms of hardware requirements are met.

Line 69:		Line 71:
	Once executed, several options are available:		Once executed, several options are available:

	Setup proxy settings ; will configure everything on the host to work with a HTTP proxy, and custom CA certificate.		* Setup proxy settings ; will configure everything on the host to work with a HTTP proxy, and custom CA certificate.
	Install TheHive ; use this option to install TheHive 5 and its dependencies		* Install TheHive ; use this option to install TheHive 5 and its dependencies
	Install Cortex and all its dependencies to run Analyzers & Responders as Docker ~~Iiages~~		* Install Cortex and all its dependencies to run Analyzers & Responders as Docker Images
	Install Cortex and all its dependencies to run Analyzers & Responders on the host (Debian and Ubuntu ONLY)		* Install Cortex and all its dependencies to run Analyzers & Responders on the host (Debian and Ubuntu ONLY)

	For each release, DEB, RPM and ZIP binary packages are built and provided. Discover how to install TheHive quickly by following our installation guides:		For each release, DEB, RPM and ZIP binary packages are built and provided. Discover how to install TheHive quickly by following our installation guides:

Unknown user: /* Pranala Menarik */

2023-07-11T01:45:15Z

Pranala Menarik

← Older revision		Revision as of 01:45, 11 July 2023
Line 117:		Line 117:
	==Pranala Menarik==		==Pranala Menarik==

	* [[Cyber Security]		* [[Cyber Security]]

Unknown user at 01:45, 11 July 2023

2023-07-11T01:45:01Z

← Older revision		Revision as of 01:45, 11 July 2023
Line 3:		Line 3:
	Application StackTheHive can be deployed on a standalone server or as a cluster. The application relies on:		Application StackTheHive can be deployed on a standalone server or as a cluster. The application relies on:

	Apache Cassandra to store data (Supported version: 4.x).		* Apache Cassandra to store data (Supported version: 4.x).
			* Elasticsearch as indexing engine (Supported version: 7.x).
			* A file storage solution is also required ; the local filesystem of the server hosting the application is adequate in the standalone server scenario ; S3 MINIO otherwise.

	~~Elasticsearch as indexing engine (Supported version: 7.x).~~

	~~A file storage solution is also required ; the local filesystem of the server hosting the application is adequate in the standalone server scenario ; S3 MINIO otherwise.~~

	~~Using Lucene~~

	~~Since version 5.1, TheHive does NOT support Lucene backend as index engine any more.~~

	~~Lucene was an option to handle the data index with TheHive 4.1.x ; to migrate your index to Elasticsearch, follow this guide.~~

	Architecture#		Architecture#
Line 21:		Line 14:
	Standalone server		Standalone server
	Cluster or hybrid architecture		Cluster or hybrid architecture

	Standalone server		Standalone server

	All applications are installed on the same server.		All applications are installed on the same server.

	Cassandra		* Cassandra
	Elasticsearch		* Elasticsearch
	Files are store on the filesystem (or MinIO if desired)		* Files are store on the filesystem (or MinIO if desired)
	TheHive		TheHive
	NGINX (optional): to manage HTTPS communications		NGINX (optional): to manage HTTPS communications

Unknown user: Created page with "Installation & configuration guides# Overview# Application StackTheHive can be deployed on a standalone server or as a cluster. The application relies on: Apache Cassandra t..."

2023-07-11T00:35:25Z

Created page with "Installation & configuration guides# Overview# Application StackTheHive can be deployed on a standalone server or as a cluster. The application relies on: Apache Cassandra t..."

New page

Installation & configuration guides#
Overview#
Application StackTheHive can be deployed on a standalone server or as a cluster. The application relies on:

Apache Cassandra to store data (Supported version: 4.x).

Elasticsearch as indexing engine (Supported version: 7.x).

A file storage solution is also required ; the local filesystem of the server hosting the application is adequate in the standalone server scenario ; S3 MINIO otherwise.

Using Lucene

Since version 5.1, TheHive does NOT support Lucene backend as index engine any more.

Lucene was an option to handle the data index with TheHive 4.1.x ; to migrate your index to Elasticsearch, follow this guide.

Architecture#
Each layer, TheHive application, the Database & index engine, and file storage, is independant and can be set up as a standalone node or cluster. As a result, TheHive could be setup and work in a complex clustered archicteture, using virtual IP addresses and load balancers.

Standalone server
Cluster or hybrid architecture
Standalone server

All applications are installed on the same server.

Cassandra
Elasticsearch
Files are store on the filesystem (or MinIO if desired)
TheHive
NGINX (optional): to manage HTTPS communications

Instructions included in the step-by-step installation guide ends up to install a standalone server.

Requirements#
Hardware requirements depends on the number of concurrent users (including integrations) and how they use the system. The following table diplays safe thresholds when hosting all services on the same machine:

Number of users TheHive Cassandra ElasticSearch
< 10 2 / 2 GB 2 / 2 GB 2 / 2 GB
< 20 2-4 / 4 GB 2-4 / 4 GB 2-4 / 4 GB
< 50 4-6 / 8 GB 4-6 / 8 GB 4-6 / 8 GB

Spec yang aman
* 4 core CPU
* 16 G RAM

Tip

If you are installing everything on the same server, we recommend at least 4 cores and 16 GB of RAM. And don't forget to set up jvm.options at least for Elasticsearch.

Operating systems#
TheHive has been tested and is supported on the following operating systems:

* Ubuntu 20.04 LTS & 22.04 LTS
* Debian 11
* RHEL 8
* Fedora 35 & 37

StrangeBee also provides an official Docker image.

Installation guides#
Too much in a hurry to read ?

If you are using one of the supported operating systems, use our all-in-one installation script:

wget -q -O /tmp/install.sh https://archives.strangebee.com/scripts/install.sh ; sudo -v ; bash /tmp/install.sh
This script helps with the installation process on a fresh and supported OS ; the program also run successfully if the conditions in terms of hardware requirements are met.

Once executed, several options are available:

Setup proxy settings ; will configure everything on the host to work with a HTTP proxy, and custom CA certificate.
Install TheHive ; use this option to install TheHive 5 and its dependencies
Install Cortex and all its dependencies to run Analyzers & Responders as Docker Iiages
Install Cortex and all its dependencies to run Analyzers & Responders on the host (Debian and Ubuntu ONLY)
For each release, DEB, RPM and ZIP binary packages are built and provided. Discover how to install TheHive quickly by following our installation guides:

Use a dedicated server#
TheHive can be used on virtual or physical servers.

Our step-by-step guide let you prepare, install and configure TheHive and its prerequisites for Debian and RPM packages based Operating Systems, as well as for other systems and using our binary packages.

TheHive supports beeing installed in virtualized environments:

Using VMware
Using Proxmox virtual machines or containers (lxc)
Use Docker #
An Official Docker image publicly available. Follow our installation guide for Docker to use it in production.

Use Kubernetes #
TheHive is now compatible with Kubernetes - follow the related guide here.

Configuration Guides#
The configuration files are stored in the /etc/thehive folder:

application.conf contains all parameters and options
logback.xml is dedicated to log management
/etc/thehive
├── application.conf
├── logback.xml
└── secret.conf

A separate secret.conf file is automatically created by DEB or RPM packages. This file contains a secret that should be used by one instance.

The configuration should only contain the necessary information to start the application:

database and indexing
File storage
Connectors enabled
Other service parameters
All other settings are available in the application WebUI.

==Referensi==

* https://docs.strangebee.com/thehive/setup/#update-from-thehive-3x

==Pranala Menarik==

* [[Cyber Security]