Incident Response: TheHive Integration

Overview#

A national CERT receives notification of a phishing campaign targeting a sector it protects. Within the hour, twelve separate organizations have reported incidents. Each incident is being tracked in a local TheHive instance. The analysts coordinating the sector response need to see all twelve cases at once, compare the observables across them, and identify the common IOC set that links them to a single campaign. The Argus TheHive integration pulls each case into a unified view, deduplicates the overlapping IP and domain indicators, cross-references them against MISP feeds, and surfaces the common thread: three C2 domains registered within the same 48-hour window, all resolving to the same hosting autonomous system.

Argus integrates with TheHive, the open-source security incident response platform widely used by CERTs and SOC teams for case management, task assignment, and evidence tracking. The integration synchronizes TheHive case data into Argus, enabling cross-platform incident correlation, threat intelligence enrichment, and unified reporting across both platforms without requiring manual data duplication.

Diagram

flowchart TD
    A[TheHive Case Created or Updated] --> B[syncThehiveCase Mutation Triggered]
    B --> C[fetch_thehive_data: REST API Pull]
    C --> D[Case Metadata: Title / Severity / Status / TLP]
    C --> E[Observables: IPs / Hashes / Domains / Emails]
    D --> F[PostgreSQL Record Persisted]
    E --> F
    F --> G[MISP Cross-Reference]
    F --> H[Argus Intelligence Linkage]
    G --> I[Enriched Incident View]
    H --> I
    I --> J[Multi-Case Correlation & Reporting]

Last Reviewed: 2026-03-18 Last Updated: 2026-04-14

Key Features#

Case Synchronization#

Sync TheHive cases and their associated observables into Argus via the syncThehiveCase mutation. The fetch_thehive_data client connects to the TheHive REST API, retrieves case metadata including title, description, severity, status, TLP, and observable list, and persists records to PostgreSQL. Each sync is logged as an interop ingest audit event.

Observable Cross-Referencing#

Case observables (IP addresses, hashes, domain names, email addresses) are cross-referenced against MISP indicators and Argus intelligence records during ingestion. Linkages between TheHive case artefacts and known threat intelligence entries are created automatically, without requiring a separate enrichment step from the analyst.

Clearance-Filtered Case Access#

Case records carry secrecy_level tags, meaning classified incident cases can be tagged accordingly and restricted to cleared personnel only. This supports CERT environments where some cases involve classified systems or information that cannot be exposed to the full analyst population.

Aggregate Statistics#

The thehiveStats query returns case counts by severity and status, giving operations managers a real-time view of incident load distribution without loading the full case list. This is useful for shift handover, capacity management, and executive reporting.

Use Cases#

Unified SOC Operations: Analysts using TheHive for case tracking gain automatic enrichment from Argus threat intelligence. Argus operators see TheHive case context alongside MISP indicators and Sigma hits, eliminating the need to switch platforms during active response.
CERT Case Correlation: When multiple CERTs are investigating related incidents in separate TheHive instances, Argus aggregates the case data under one tenant to identify shared IOCs and TTPs that link the incidents to a single campaign.
Post-Incident Investigation: After an incident is closed in TheHive, import all observables into Argus for long-term OSINT enrichment, victim attribution, and inclusion in future threat intelligence outputs.

Integration#

Available via GraphQL: thehiveCases, thehiveStats (queries); syncThehiveCase (mutation). All operations require authentication and organisation scoping.

Compatible with TheHive 5 REST API. Works alongside Cortex (automated observable analysis), OpenCTI (strategic threat intelligence), MISP and MISP Modules (IOC feeds and enrichment), and MWDB (malware sample correlation).

Module metadata