在centos中安装thehive的过程

整个过程使用虚拟机在CentOS Linux release 7.2.1511 (Core)安装成功。

安装thehive需要的步骤：

1、安装存储数据的elasticsearch，使用docker安装或者rpm包进行安装

2、安装cortex，创建相关用户账号获取相关API的秘钥供thehive使用

3、安装thehive，调用cortex提供的秘钥获取相关调用接口进行调查

elasticsearch相关命令使用：https://www.cnblogs.com/remainsu/p/elasticsearch-chang-yong-curl-ming-ling.html

一、安装elasticsearch

1.1使用docker进行安装

注意安装时请注意时间同步问题，否者会出现证书相关问题：ntpdate cn.pool.ntp.org

Docker CE:https://docs.docker.com/install/#supported-platforms

Docker Compose:https://docs.docker.com/compose/install/

Git:https://git-scm.com/book/en/v2/Getting-Started-Installing-Git

按照以上步骤完成docker的安装

第一步：

sudo sysctl -w vm.max_map_count=262144

第二步：

yum install -y java-1.8.0-openjdk

第三步，创建在本机上保存数据的目录：

mkdir -p /usr/share/elasticsearch/data

chmod 777 /usr/share/elasticsearch/data

第四步：安装es

docker run \

--name elasticsearch \

--hostname elasticsearch \

--rm \

--publish 127.0.0.1:9200:9200 \

--publish 127.0.0.1:9300:9300 \

--volume /usr/share/elasticsearch/data:/usr/share/elasticsearch/data \

-e "http.host=0.0.0.0" \

-e "transport.host=0.0.0.0" \

-e "xpack.security.enabled=false" \

-e "cluster.name=hive" \

-e "script.inline=true" \

-e "thread_pool.index.queue_size=100000" \

-e "thread_pool.search.queue_size=100000" \

-e "thread_pool.bulk.queue_size=100000" \

docker.elastic.co/elasticsearch/elasticsearch:5.6.0

1.2使用rpm包进行安装

注意安装时请注意时间同步问题，否者会出现证书相关问题：

ntpdate cn.pool.ntp.org

参考：https://github.com/TheHive-Project/TheHiveDocs/blob/master/installation/install-guide.md

第一步：

sudo sysctl -w vm.max_map_count=262144

第二步：

yum install -y java-1.8.0-openjdk

第三步：在/etc/yum/repos.d/创建elasticsearch.repo，加入以下内容：

[elasticsearch-5.x]

name=Elasticsearch repository for 5.x packages

baseurl=https://artifacts.elastic.co/packages/5.x/yum

gpgcheck=1

gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch

enabled=1

autorefresh=1

type=rpm-md

 mkdir -p /etc/yum/repos.d/

 cd /etc/yum/repos.d/

第四步：

  sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

  sudo yum install elasticsearch

第五步：

  cd /etc/elasticsearch/

在/etc/elasticsearch/elasticsearch.yml中加入以下内容：

network.host: 127.0.0.1

script.inline: true

cluster.name: hive

thread_pool.index.queue_size: 100000

thread_pool.search.queue_size: 100000

thread_pool.bulk.queue_size: 100000

 xpack.security.enabled: true

强烈建议避免将此服务暴露给不受信任的区域。

如果Elasticsearch和thehive运行在同一主机上(而不是在docker)，编辑/etc/ Elasticsearch /elasticsearch.yml和设置网络。主机参数为127.0.0.1。thehive使用动态脚本进行部分更新。因此，必须使用script.inline: true来激活它们。

还必须设置集群名称(例如，hive)。线程池队列大小必须设置一个较高的值(100000)。默认大小将容易使队列超载。

第六步：

手动安装xpack:https://artifacts.elastic.co/downloads/packs/x-pack/x-pack-5.6.16.zip

./elasticsearch-plugin install file:///root/x-pack-5.6.16.zip

-> Downloading file:///root/x-pack-5.6.16.zip

[=================================================] 100%  

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@    WARNING: plugin requires additional permissions    @

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

* java.io.FilePermission \\.\pipe\* read,write

* java.lang.RuntimePermission accessClassInPackage.com.sun.activation.registries

* java.lang.RuntimePermission getClassLoader

* java.lang.RuntimePermission setContextClassLoader

* java.lang.RuntimePermission setFactory

* java.net.SocketPermission * connect,accept,resolve

* java.security.SecurityPermission createPolicy.JavaPolicy

* java.security.SecurityPermission getPolicy

* java.security.SecurityPermission putProviderProperty.BC

* java.security.SecurityPermission setPolicy

* java.util.PropertyPermission * read,write

* javax.net.ssl.SSLPermission setHostnameVerifier

See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html

for descriptions of what these permissions allow and the associated risks.

Continue with installation? [y/N]y

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@        WARNING: plugin forks a native controller        @

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

This plugin launches a native controller that is not subject to the Java

security manager nor to system call filters.

Continue with installation? [y/N]y

-> Installed x-pack

自动安装：

进入：/usr/share/elasticsearch/bin

./elasticsearch-plugin install x-pack

并且破解相关文件（过程见：https://blog.csdn.net/dymkkj/article/details/91043669） ：

/usr/share/elasticsearch/plugins/x-pack/x-pack-5.6.16.jar

第七步：

sudo systemctl enable elasticsearch.service

 sudo systemctl start elasticsearch.service

  sudo systemctl status elasticsearch.service

第八步：更改用户密码

默认用户名密码为： elastic:changeme

curl --user elastic:changeme http://127.0.0.1:9200

{

  "name" : "0Gxn_d0",

  "cluster_name" : "hive",

  "cluster_uuid" : "UC3wm1J-SRO_GwVBnEPxow",

  "version" : {

    "number" : "5.6.16",

    "build_hash" : "3a740d1",

    "build_date" : "2019-03-13T15:33:36.565Z",

    "build_snapshot" : false,

    "lucene_version" : "6.6.1"

  },

  "tagline" : "You Know, for Search"

}

更改密码(https://www.jianshu.com/p/f1b009113e61)：

curl -XPUT -u elastic '127.0.0.1:9200/_xpack/security/user/elastic/_password' -H "Content-Type: application/json" -d '{"password" : "2020@qwerty"}'

curl --user elastic:2020@qwerty http://127.0.0.1:9200

二、安装cortex

yum install https://dl.bintray.com/thehive-project/rpm-stable/thehive-project-release-1.1.0-2.noarch.rpm

yum install cortex

yum install python-pip python2.7-dev python3-pip python3-dev ssdeep libfuzzy-dev libfuzzy2 libimage-exiftool-perl libmagic1 build-essential git libssl-dev

pip3 install cortexutils

sudo systemctl enable cortex.service

sudo systemctl start cortex.service

sudo systemctl status cortex.service

firewall-cmd --zone=public --add-port=9001/tcp --permanent

firewall-cmd --reload

相关配置文件在：/etc/cortex中，需要进行部分修改，以下给出模板：

# Sample Cortex application.conf file

## SECRET KEY

#

# The secret key is used to secure cryptographic functions.

#

# IMPORTANT: If you deploy your application to several  instances,  make

# sure to use the same key.

#这个地方需要添加相关秘钥，具体生成方法请参照官网

play.http.secret.key="XpN0jSW03tWKGQr2MSpI6mizC0oEa8BPY3FgENBgDvCKbk0obep19pDcy2oE7tad"

#http.port = "9001"

## ElasticSearch

search {

  # Name of the index

  index = cortex

  # Address of the ElasticSearch instance

  uri = "http://127.0.0.1:9200"

}

# ElasticSearch cluster name

cluster {

name = hive

}

## Cache

#

# If an analyzer is executed against the same observable, the previous report can be returned without re-executing the

# analyzer. The cache is used only if the second job occurs within cache.job (the default is 10 minutes).

cache.job = 10 minutes

## Authentication

auth {

method.basic = true

# "provider" parameter contains the authentication provider(s). It can be multi-valued, which is useful

# for migration.

# The available auth types are:

# - services.LocalAuthSrv : passwords are stored in the user entity within ElasticSearch). No

#  configuration are required.

# - ad : use ActiveDirectory to authenticate users. The associated configuration shall be done in

#  the "ad" section below.

# - ldap : use LDAP to authenticate users. The associated configuration shall be done in the

#  "ldap" section below.

provider = [local]

ad {

# The Windows domain name in DNS format. This parameter is required if you do not use

# 'serverNames' below.

#domainFQDN = "mydomain.local"

# Optionally you can specify the host names of the domain controllers instead of using 'domainFQDN

# above. If this parameter is not set, TheHive uses 'domainFQDN'.

#serverNames = [ad1.mydomain.local, ad2.mydomain.local]

# The Windows domain name using short format. This parameter is required.

#domainName = "MYDOMAIN"

# If 'true', use SSL to connect to the domain controller.

#useSSL = true

}

ldap {

# The LDAP server name or address. The port can be specified using the 'host:port'

# syntax. This parameter is required if you don't use 'serverNames' below.

#serverName = "ldap.mydomain.local:389"

# If you have multiple LDAP servers, use the multi-valued setting 'serverNames' instead.

#serverNames = [ldap1.mydomain.local, ldap2.mydomain.local]

# Account to use to bind to the LDAP server. This parameter is required.

#bindDN = "cn=thehive,ou=services,dc=mydomain,dc=local"

# Password of the binding account. This parameter is required.

#bindPW = "***secret*password***"

# Base DN to search users. This parameter is required.

#baseDN = "ou=users,dc=mydomain,dc=local"

# Filter to search user in the directory server. Please note that {0} is replaced

# by the actual user name. This parameter is required.

#filter = "(cn={0})"

# If 'true', use SSL to connect to the LDAP directory server.

#useSSL = true

}

}

## ANALYZERS

#

analyzer {

  # Absolute path where you have pulled the Cortex-Analyzers repository.

  #放分析器的地方

  #path = ["/opt/Cortex-Analyzers/analyzers"]

  urls = ["https://dl.bintray.com/thehive-project/cortexneurons/analyzers.json"]

  # Sane defaults. Do not change unless you know what you are doing.

  fork-join-executor {

    # Min number of threads available for analysis.

    parallelism-min = 2

    # Parallelism (threads) ... ceil(available processors * factor).

    parallelism-factor = 2.0

    # Max number of threads available for analysis.

    parallelism-max = 4

  }

}

  #放应答器的地方

responder {

path = ["/opt/thehive/responders","/opt/cortex/github-aacgood/Cortex-Analyzers/Responders"]

}

# It's the end my friend. Happy hunting!

进入首页后需要初始化数据库


更新数据库
创建用户名
生成新的组织
使用新组织添加用户
使用新用户获取相关秘钥

获取的秘钥将用于thehive的配置文件中，以便于thehive使用cortex

三、安装thehive

yum install thehive

sudo systemctl enable thehive.service

sudo systemctl start thehive.service

sudo systemctl status thehive.service

firewall-cmd --zone=public --add-port=9000/tcp --permanent

firewall-cmd --reload

安装完后，启动服务前，需要进行配置文件的更改：

# Secret Key

# The secret key is used to secure cryptographic functions.

# WARNING: If you deploy your application on several servers, make sure to use the same key.

#需要更改的地方

play.http.secret.key="PBnMSnyrQZD8sY5J69VL0Nj9jfEs0UJnNd3Pupv5MpA2nmJ9bSmYZAoxlAv4dNQn"

# Elasticsearch

search {

  ## Basic configuration

  # Index name.

  index = the_hive

  # ElasticSearch instance address.

  uri = "http://127.0.0.1:9200/"

  ## Advanced configuration

  # Scroll keepalive.

  #keepalive = 1m

  # Scroll page size.

  #pagesize = 50

  # Number of shards

  #nbshards = 5

  # Number of replicas

  #nbreplicas = 1

  # Arbitrary settings

  #settings {

  #  # Maximum number of nested fields

  #  mapping.nested_fields.limit = 100

  #}

  ## Authentication configuration

#@kindsjay@JamesCullum. Changing the application.conf key "search.username" to "user" and "search.password" to "password #resolved this for me on both RC01 and RC02. Thanks to@ag-michaelfor pointing me towards this fix.

#https://github.com/TheHive-Project/TheHive/issues/1055


# 加es的用户认证，请将"search.username" 更改为 "user" and #"search.password" 更改为 "password"

  #search.username = ""

  #search.password = ""

  ## SSL configuration

  #search.keyStore {

  #  path = "/path/to/keystore"

  #  type = "JKS" # or PKCS12

  #  password = "keystore-password"

  #}

  #search.trustStore {

  #  path = "/path/to/trustStore"

  #  type = "JKS" # or PKCS12

  #  password = "trustStore-password"

  #}

}

# Authentication

auth {

  # "provider" parameter contains authentication provider. It can be multi-valued (useful for migration)

  # available auth types are:

  # services.LocalAuthSrv : passwords are stored in user entity (in Elasticsearch). No configuration is required.

  # ad : use ActiveDirectory to authenticate users. Configuration is under "auth.ad" key

  # ldap : use LDAP to authenticate users. Configuration is under "auth.ldap" key

  # oauth2 : use OAuth/OIDC to authenticate users. Configuration is under "auth.oauth2" and "auth.sso" keys

  provider = [local]

  # By default, basic authentication is disabled. You can enable it by setting "method.basic" to true.

  #method.basic = true

  ad {

    # The Windows domain name in DNS format. This parameter is required if you do not use

    # 'serverNames' below.

    #domainFQDN = "mydomain.local"

    # Optionally you can specify the host names of the domain controllers instead of using 'domainFQDN

    # above. If this parameter is not set, TheHive uses 'domainFQDN'.

    #serverNames = [ad1.mydomain.local, ad2.mydomain.local]

    # The Windows domain name using short format. This parameter is required.

    #domainName = "MYDOMAIN"

    # If 'true', use SSL to connect to the domain controller.

    #useSSL = true

  }

  ldap {

    # The LDAP server name or address. The port can be specified using the 'host:port'

    # syntax. This parameter is required if you don't use 'serverNames' below.

    #serverName = "ldap.mydomain.local:389"

    # If you have multiple LDAP servers, use the multi-valued setting 'serverNames' instead.

    #serverNames = [ldap1.mydomain.local, ldap2.mydomain.local]

    # Account to use to bind to the LDAP server. This parameter is required.

    #bindDN = "cn=thehive,ou=services,dc=mydomain,dc=local"

    # Password of the binding account. This parameter is required.

    #bindPW = "***secret*password***"

    # Base DN to search users. This parameter is required.

    #baseDN = "ou=users,dc=mydomain,dc=local"

    # Filter to search user in the directory server. Please note that {0} is replaced

    # by the actual user name. This parameter is required.

    #filter = "(cn={0})"

    # If 'true', use SSL to connect to the LDAP directory server.

    #useSSL = true

  }

  oauth2 {

    # URL of the authorization server

    #clientId = "client-id"

    #clientSecret = "client-secret"

    #redirectUri = "https://my-thehive-instance.example/index.html#!/login"

    #responseType = "code"

    #grantType = "authorization_code"

    # URL from where to get the access token

    #authorizationUrl = "https://auth-site.com/OAuth/Authorize"

    #tokenUrl = "https://auth-site.com/OAuth/Token"

    # The endpoint from which to obtain user details using the OAuth token, after successful login

    #userUrl = "https://auth-site.com/api/User"

    #scope = "openid profile"

  }

  # Single-Sign On

  sso {

    # Autocreate user in database?

    #autocreate = false

    # Autoupdate its profile and roles?

    #autoupdate = false

    # Autologin user using SSO?

    #autologin = false

    # Attributes mappings

    #attributes {

    #  login = "sub"

    #  name = "name"

    #  groups = "groups"

    #  #roles = "roles"

    #}

    # Name of mapping class from user resource to backend user ('simple' or 'group')

    #mapper = group

    # Default roles for users with no groups mapped ("read", "write", "admin")

    #defaultRoles = []

    #groups {

    #  # URL to retreive groups (leave empty if you are using OIDC)

    #  #url = "https://auth-site.com/api/Groups"

    #  # Group mappings, you can have multiple roles for each group: they are merged

    #  mappings {

    #    admin-profile-name = ["admin"]

    #    editor-profile-name = ["write"]

    #    reader-profile-name = ["read"]

    #  }

    #}

  }

}

# Maximum time between two requests without requesting authentication

session {

  warning = 5m

  inactivity = 1h

}

# Max textual content length

play.http.parser.maxMemoryBuffer= 1M

# Max file size

play.http.parser.maxDiskBuffer = 1G

# Cortex

# TheHive can connect to one or multiple Cortex instances. Give each

# Cortex instance a name and specify the associated URL.

#

# In order to use Cortex, first you need to enable the Cortex module by uncommenting the next line

play.modules.enabled += connectors.cortex.CortexConnector

#需要更改的地方

cortex {

  "LOCAL CORTEX" {

    url = "http://127.0.0.1:9001"

    key ="ZN4hcdcFSJP3DmfCvYZsjGC9GyOrKj7j"

    }

  #"CORTEX-SERVER-ID" {

  #  url = ""

  #  key = ""

  #  # HTTP client configuration (SSL and proxy)

  #  ws {}

  #}

}

# MISP

# TheHive can connect to one or multiple MISP instances. Give each MISP

# instance a name and specify the associated Authkey that must  be used

# to poll events, the case template that should be used by default when

# importing events as well as the tags that must be added to cases upon

# import.

# Prior to configuring the integration with a MISP instance, you must

# enable the MISP connector. This will allow you to import events to

# and/or export cases to the MISP instance(s).

#play.modules.enabled += connectors.misp.MispConnector

misp {

  # Interval between consecutive MISP event imports in hours (h) or

  # minutes (m).

  interval = 1h

  #"MISP-SERVER-ID" {

  #  # MISP connection configuration requires at least an url and a key. The key must

  #  # be linked with a sync account on MISP.

  #  url = ""

  #  key = ""

  #

  #  # Name of the case template in TheHive that shall be used to import

  #  # MISP events as cases by default.

  #  caseTemplate = "<Template_Name_goes_here>"

  #

  #  # Optional tags to add to each observable  imported  from  an  event

  #  # available on this instance.

  #  tags = ["misp-server-id"]

  #

  #  ## MISP event filters

  #  # MISP filters is used to exclude events from the import.

  #  # Filter criteria are:

  #  # The number of attribute

  #  max-attributes = 1000

  #  # The size of its JSON representation

  #  max-size = 1 MiB

  #  # The age of the last publish date

  #  max-age = 7 days

  #  # Organization and tags

  #  exclusion {

  #    organisation = ["bad organisation", "other organisations"]

  #    tags = ["tag1", "tag2"]

  #  }

  #

  #  ## HTTP client configuration (SSL and proxy)

  #  # Truststore to use to validate the X.509 certificate of the MISP

  #  # instance if the default truststore is not sufficient.

  #  # Proxy can also be used

  #  ws {

  #    ssl.trustManager.stores = [ {

  #      path = /path/to/truststore.jks

  #    } ]

  #    proxy {

  #      host = proxy.mydomain.org

  #      port = 3128

  #    }

  #  }

  #

  #  # MISP purpose defines if this instance can be used to import events (ImportOnly), export cases (ExportOnly) or both (ImportAndExport)

  #  # Default is ImportAndExport

  #  purpose = ImportAndExport

  #} ## <-- Uncomment to complete the configuration

}

同样需要初始化

祝好运！

最后编辑于 ：
©著作权归作者所有,转载或内容合作请联系作者
  • 人面猴
    序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
    沈念sama阅读 203,271评论 5赞 476
  • 死咒
    序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
    沈念sama阅读 85,275评论 2赞 380
  • 救了他两次的神仙让他今天三更去死
    文/潘晓璐 我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
    开封第一讲书人阅读 150,151评论 0赞 336
  • 道士缉凶录：失踪的卖姜人
    文/不坏的土叔 我叫张陵，是天一观的道长。 经常有香客问我，道长，这世上最难降的妖魔是什么？ 我笑而不...
    开封第一讲书人阅读 54,550评论 1赞 273
  • 港岛之恋（遗憾婚礼）
    正文 为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
    茶点故事阅读 63,553评论 5赞 365
  • 恶毒庶女顶嫁案：这布局不是一般人想出来的
    文/花漫 我一把揭开白布。 她就那样静静地躺着，像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上，一...
    开封第一讲书人阅读 48,559评论 1赞 281
  • 城市分裂传说
    那天，我揣着相机与录音，去河边找鬼。 笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。 我是一名探鬼主播，决...
    沈念sama阅读 37,924评论 3赞 395
  • 双鸳鸯连环套：你想象不到人心有多黑
    文/苍兰香墨 我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
    开封第一讲书人阅读 36,580评论 0赞 257
  • 万荣杀人案实录
    序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
    沈念sama阅读 40,826评论 1赞 297
  • 护林员之死
    正文 独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋 以下内容为张勋视角 年9月15日...
    茶点故事阅读 35,578评论 2赞 320
  • 白月光启示录
    正文 我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。 大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
    茶点故事阅读 37,661评论 1赞 329
  • 活死人
    序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
    沈念sama阅读 33,363评论 4赞 318
  • 日本核电站爆炸内幕
    正文 年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
    茶点故事阅读 38,940评论 3赞 307
  • 男人毒药：我在死后第九天来索命
    文/蒙蒙 一、第九天 我趴在偏房一处隐蔽的房顶上张望。 院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
    开封第一讲书人阅读 29,926评论 0赞 19
  • 一桩弑父案，背后竟有这般阴谋
    文/苍兰香墨 我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。 一阵脚步声响...
    开封第一讲书人阅读 31,156评论 1赞 259
  • 情欲美人皮
    我被黑心中介骗来泰国打工， 没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。 一个月前我还...
    沈念sama阅读 42,872评论 2赞 349
  • 代替公主和亲
    正文 我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。 传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
    茶点故事阅读 42,391评论 2赞 342