I am now read about TheHive Project - open source incident response platform. Today i asked developers about automatization of incidents, and find, that TheHive can't do this.

Main feature for me is automatization in the following directions:

  1. get new data and add it from sources to incident (from AD, from OSINT, from SSCM and etc)
  2. write scripts to send mails to users by such templates by API
  3. add new tasks on firewalls or another

Does anybody can advise me something framework or open source project or some else?

  • 2
    Add new tasks on firewalls? I hope you don't mean automatically add a firewall rule...if you do mean this consider you are likely giving the adversary the ability to add rules to your firewall. – DarkMatter Jan 31 '19 at 20:28
  • Which OSINT tool are you using? I know some tools that integrate (aka use as input) with AD DC, SSCM and maybe your OSINT software but it depends if it can write any incidents to a log file or write out logs in a certain format.. – NASAhorse Feb 27 '19 at 21:30
  • @DarkMatter and fail2ban? Doesn't that add rules to the firewall based on external behaviours? – schroeder Mar 2 '19 at 22:26
  • Unfortunately, I'm afraid this will turn into a list of products and services, which is off-topic here as the list may never end. My advice is to search for "orchestration" as that tends to be the term that these products and services use for this type of workflow. – schroeder Mar 2 '19 at 22:54
  • @schroeder I don't know but I hope it doesn't add firewall rules... – DarkMatter Mar 4 '19 at 14:57

TheHive has hooks to Cortex, which can you use for OSINT, but it does not have all of the integrations that you are asking for.

Active Directory, SCCM, and similar can be performed with WEF as Palantir maps out for you in their Github project.

AbuseHelper is the oft suggested platform to send email out. TheHive can definitely take email in, even Microsoft Exchange through Synapse.

For firewall automation from TheHive data, I’m not sure of your direction enough to make a specific recommendation. Typically, you will see one of 2 types of deny-level controls. The first is host isolation (aka host quarantine), such as seen using PowerShell here. The second would be using Suricata IPS rules that provide countermeasures to specific malicious logic, much more open-ended compared to a domain or IP block.

My thinking here is that instead of blocking everyone from accessing what could be a false positive, just block the single laptop that is reaching out to C2 or being social media / cloud cred phished or whatnot. If you have a firewall that can be configured for a list, then use blackbook or similar project as that list.


Unfortunately, I do not think something like this exists without a significant cost attached (commercial platforms).

There are platforms from certain companies than dig much deeper into processes, baselines, etc. that can pull some low hanging IOCs, but even those will require human intervention.

Incident Response is a collection of steps taken to determine if a system was impacted, how bad it was impacted, and what all access the attackers obtained, files touched, etc.

This means, that IR is highly ad-hoc based on the situation. There can be similarities between responses, but ultimately the alert that led you to investigate will result in a different response to each system (unless a situation occurs like: the attack hit multiple targets with the same exploits/malware and you're doing clean up on each system [and even this has caveats]).

Ultimately, what you are looking for isn't really feasible from an open source solution at this time. IR is highly ad-hoc based on the indicators, malware, exploits, IDS/system level alerts that triggered, etc.

  • there are several open-source security automation/orchestration products out there – schroeder Mar 2 '19 at 22:28

Abuse.io is a tool which can be used to collect data from sources like Shadowserver, keep track of all IPs you manage and all reports about them and then notify customers about any problems with their IP addresses.

Not the answer you're looking for? Browse other questions tagged or ask your own question.