Connecting to TheHive
A TheHive Connection lets Magic Suite reach your TheHive server with an API key. Magic Suite connects to TheHive directly, so the server must be reachable from the internet.
Before you start
- Allow our servers to reach TheHive: their public IP range is 46.249.212.128/27
- Have an API key for a TheHive user who can see the organisation you want to use
Creating the Connection
- In Admin, open Connections, then click Create
- Choose TheHive as the type
- Enter a name and, optionally, a description. We recommend Default as the name of the first Connection of each type
- Fill in:
- URL: your TheHive server's address, replacing the placeholder, such as https://thehive.example.com/. If TheHive is served under a path, include it, as https://example.com/thehive/
- API Key: the TheHive API key. There is no User Name
- Configuration: see Configuration below
- Click Test Connection, then Save
If Test Connection says TheHive refused the API key, check the API Key and the Organisation setting. If it cannot connect at all, check the URL, and IgnoreCertificateErrors for a server with a self-signed certificate.
Configuration
The Configuration is JSON, and most TheHive Connections can leave it empty. Set only what you need: a setting you leave out takes its default.
| Setting | What it does | Default |
|---|---|---|
| Organisation | The organisation in TheHive to work in. Leave it out to use the API key's default organisation. | The API key's default organisation |
| IgnoreCertificateErrors | true accepts the server's certificate without checking it, for a self-hosted TheHive with a self-signed or internal certificate. This is less secure. | false |
For example, to work in an organisation called SOC:
{
"Organisation": "SOC"
}Tip: Connections, Tools, Configure a Connection fills in the Configuration with a form, with help on every setting (coming in version 4.8).
Using it in reports
There are no TheHive macros yet. They will be listed here when they are added.
