TheHive is a popular open-source SIRP (Security Incident Response Platform). Wazuh can forward selected alerts to TheHive's REST API as new cases using the custom integration framework.
1. Get a TheHive API key
In TheHive log in as orgadmin -> Users -> Create a service account -> copy the API key.
2. Place the custom integration script
Save your custom-thehive.py and matching wrapper as /var/ossec/integrations/custom-thehive and /var/ossec/integrations/custom-thehive.py (mode 750, owner root:wazuh).
3. Wire it up in ossec.conf
<integration>
<name>custom-thehive</name>
<hook_url>https://thehive.example.com/api/case</hook_url>
<api_key>THE_HIVE_API_KEY</api_key>
<level>12</level>
<alert_format>json</alert_format>
</integration>4. Restart the manager
systemctl restart wazuh-managerNote: Send only level 12+ alerts to TheHive, everything below is best left in Wazuh to avoid analyst fatigue.
We build full Wazuh + TheHive + Cortex SOC stacks, contact us for an architecture call.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see: