Solutions

Usage instructions for the official Azure distribution of TheHive

The image can be used to set up a shiny-new TheHive install or to launch an instance with existing data and configuration (for update / migration / restore purposes).

Introduction

  • Based on the official Ubuntu 18.04 image from Canonical
  • The image is updated whenever a new TheHive version is released - no need to bother updating TheHive anymore, just launch a new instance as if it were a container!
  • TheHive data is stored on a dedicated disk, not in the root filesystem. With that in mind, you must attach a persistent data disk on LUN 0 at launch (30 GB recommended).
  • The underlying Ubuntu OS is hardened to comply with CSL1 (that's Common Sense Level 1!) minus the network filtering. There are no iptables surprises inside the image to avoid conflicting behavior with security groups.

Run context

  • TheHive app runs as unprivileged user thehive and is available on port http 9000 (that's http and NOT https). Needless to say we encourage you never to open that port outside your virtual network and use a public-facing load balancer and / or reverse proxy to handle the TLS sessions with end-users. Since many TheHive users also run Cortex and MISP instances alongside and since the right load balancer / reverse proxy is obviously the one you know best, we elected not to include yet another one in this image.
  • A cronjob for user thehive runs every night (@daily) to backup the application configuration to the data volume (/var/lib/elasticsearch/thehive/). If you wish to launch a new instance from existing data, this job must have run at least once after the initial install in order to restore the application's configuration as well.

Launching an instance with no existing data (new TheHive install)

  1. Launch an instance from the image and attach a data disk on LUN 0.
  2. SSH into the instance with a sudoer user.
  3. Initialize and format the additional data disk (LUN O).
  4. Launch the application initialization script with the target data disk name as argument. Example: /opt/thehive/ops/scripts/ops-thehive-init.sh /dev/sdh (the script will automatically mount the LUN 0 disk at /dev/sdh)
  5. That's it! TheHive is now available on port 9000. You can create the admin account on the first connection to the app.

Alternatively, you can easily perform steps 3 and 4 by providing a cloud-init bootstrap script at launch. In the following example, we:

  • partition and format the data disk attached on LUN 0
  • improve the random seed with pollinate (because we will generate a secret key in the initialisation process)
  • and finally we launch the initialisation script with the target data disk mapping name as argument (/dev/sdh) - the script will automatically mount the LUN 0 disk at /dev/sdh
#cloud-config 
disk_setup:
  /dev/disk/azure/scsi1/lun0:
    table_type: gpt
    layout: True
    overwrite: True
fs_setup:
  - device: /dev/disk/azure/scsi1/lun0
    partition: none
    filesystem: ext4
random_seed:
    file: /dev/urandom
    command: ["pollinate", "--server=https://entropy.ubuntu.com/"]
    command_required: true
runcmd:
    - /opt/thehive/ops/scripts/ops-thehive-init.sh /dev/sdh

You can also provision the whole thing using Terraform - check our GitHub repository for sample initialisation code.

Launching an instance with existing data (TheHive update, migration, restore)

  1. Launch an instance from the image and attach an existing TheHive data disk on LUN 0 (we recommend you always create a disk snapshot first).
  2. SSH into the instance with a sudoer user.
  3. Launch the TheHive restore script with the data disk name as argument, which is /dev/sdh if you are using the default setup. Example: /opt/thehive/ops/scripts/ops-thehive-restore.sh /dev/sdh.
  4. That's it! TheHive is now available on port 9000 (or on the custom port you had configured) with all your existing configuration, users and data.

Alternatively, you can easily perform step 3 by providing a cloud-init bootstrap script at launch. In the following example, we:

  • launch the restore script with the data disk name as argument (/dev/sdh)
#cloud-config 
runcmd:
    - /opt/thehive/ops/scripts/ops-thehive-restore.sh /dev/sdh

You can also provision the whole thing using Terraform - check our GitHub repository for sample update / migration / restore code.