11 best open source thehive projects.

We have collection of more than 1 Million open source products ranging from Enterprise product to small libraries in all platforms. We aggregate information from all open source repositories. Search and find the best for your needs. Check out projects section.

Displaying 1 to 11 from 11 results

TheHive - TheHive: a Scalable, Open Source and Free Security Incident Response Platform

Javascript

TheHive is a scalable 3-in-1 open source and free Security Incident Response Platform designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. It is the perfect companion to MISP. You can synchronize it with one or multiple MISP instances to start investigations out of MISP events. You can also export an investigation's results as a MISP event to help your peers detect and react to attacks you've dealt with. Additionally, when TheHive is used in conjunction with Cortex, security analysts and researchers can easily analyze tens if not hundred of observables. Collaboration is at the heart of TheHive. Multiple analysts can work on the same case simultaneously. For example, an analyst may deal with malware analysis while another may work on tracking C2 beaconing activity on proxy logs as soon as IOCs have been added by their coworker. Using TheHive's live stream, everyone can keep an eye on what's happening on the platform, in real time.

misp security-incidents analyzer iocs thehive digital-forensics incident-response rest api investigations analyst dfir free free-software open-source platform misp-events cortex agplv3

PatrowlManager - PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform

HTML

To try PatrOwl, install it by reading the Installation Guide and the User Guide. Fully-Developed in Python, PatrOwl is composed of a Front-end application PatrowlManager (Django) communicating with one or multiple PatrowlEngines micro-applications (Flask) which perform the scans, analyze the results and format them in a normalized way. It remains incredibly easy to customize all components. Asynchronous tasks and engine scalability are supported by RabbitMQ and Celery. The PatrowlManager application is reachable using the embedded WEB interface or using the JSON-API. PatrowlEngines are only available through generic JSON-API calls (see Documentation).

api ioc automation incident-response orchestration secops scans threat-hunting vulnerabilities thehive vulnerability-detection vulnerability-management vulnerability-scanners security-scanner security-automation security-tools threat-intelligence patrowl

Cortex - Powerful Observable Analysis Engine

Scala

Cortex, an open source and free software, has been created by TheHive Project for this very purpose. Observables, such as IP and email addresses, URLs, domain names, files or hashes, can be analyzed one by one or in bulk mode using a Web interface. Analysts can also automate these operations thanks to the Cortex REST API. By using Cortex, you won't need to rewrite the wheel every time you'd like to use a service or a tool to analyze an observable and help you investigate the case at hand. Leverage one of the several analyzers it contains and if you are missing a tool or a service, create a suitable program easily and make it available for the whole team (or better, for the whole community) thanks to Cortex.

response dfir analysis analyzer thehive engine information rest api security-incidents digital-forensics iocs observable free free-software open-source

Cortex-Analyzers - Cortex Analyzers Repository

Python

The following repository is used by TheHive Project to develop and store Cortex analyzers. Analyzers can be written in any programming language supported by Linux such as Python, Ruby, Perl, etc. Refer to the How to Write and Submit an Analyzer page for details on how to write and submit one.

thehive analyzer cortex free free-software open-source observable ioc json incident-response digital-forensics dfir cyber-threat-intelligence enrichment

Hippocampe - Threat Feed Aggregation, Made Easy

Python

Hippocampe is a threat feed aggregator. It gives your organisation a threat feed 'memory' and lets you query it easily through a REST API or from a Web UI. If you have a Cortex server, there's already an analyzer to query Hippocampe. And if you use TheHive as a security incident response platform, you can customize the JSON output produced by the analyzer to your taste or use the report template that we kindly provide. Hippocampe aggregates feeds from the Internet in an Elasticsearch cluster. It has a REST API which allows to search into its 'memory'. It is based on a Python script which fetchs URLs corresponding to feeds, parses and indexes them.

threat-score threatintel feed intel aggregator thehive open-source free free-software

TheHive4py - Python API Client for TheHive

Python

TheHive4py is a Python API client for TheHive, a scalable 3-in-1 open source and free security incident response platform designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. TheHive4py allows analysts to send alerts to TheHive out of different sources. Those alerts can then be previewed and imported into cases using pre-defined templates.

thehive incident-response digital-forensics free-software open-source dfir free api-client api

TheHiveDocs - Documentation of TheHive

TheHive is a scalable 4-in-1 open source and free security incident response platform designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. Thanks to Cortex, our powerful free and open source analysis engine, you can analyze (and triage) observables at scale using more than 80 analyzers. Additionally and starting from TheHive 3.1.0, you can actively respond to threats and interact with your constituency and other parties thanks to Cortex responders.

misp security-incidents iocs thehive cortex administration-guide analyzer rest api incident-response digital-forensics analyst dfir free free-software documentation open-source platform

dockerfiles - 🌊 Dockerfiles for apps I use

Dockerfile

🌊 Dockerfiles for apps I use

gopkg echoip jq quicksand wfuzz dockerfile ysoserial tor squid fi6s cve-2018-15473 goproxy socksproxy misp whatweb thehive cortex manalyze

PatrowlDocs - PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform

HTML

PatrOwl is a scalable, free and open-source solution for orchestrating Security Operations. PatrowlManager is the Front-end application for managing the assets, reviewing risks on real-time, orchestrating the operations (scans, searches, API calls, ...), aggregating the results, relaying alerts on third parties (ex: Incident Response platform like TheHive, SIEM, ...) and providing the reports and dashboards. PatrowlEngines is the engine framework and the supported list of engines performing the operations (scans, searches, API calls, ...) on due time.

api ioc automation incident-response orchestration secops threat-hunting thehive cortex vulnerability-detection vulnerability-management vulnerability-scanners security-scanner security-automation security-tools threat-intelligence patrowl

PatrowlEngines - PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform

Python

PatrOwl is a scalable, free and open-source solution for orchestrating Security Operations. PatrowlEngines is the engine framework and the supported list of engines performing the operations (scans, searches, API calls, ...) on due time. The engines are managed by one or several instance of PatrowlManager.