thehive-falcon is a Crowdstrike Falcon streaming api alert integration script for TheHive.

• Alert creation for TheHive
• Granular black/white list support (see included white/black lists for reference).
• Email alerting
• Elasticsearch logging of streaming data

elasticsearch is required for elasticsearch logging. smtplib is a requirement for email alerting.

To start with, edit falcon_config.json and thehive_config.json and review each field to make sure it is correct for your environment.

Stand-alone script execution:

python thehive_falcon.py falcon_config.json thehive_config.json

It uses logging to log events.

There is a systemd unit file included which expects you to place the script and configuration files in /opt/thehive-falcon. Copy the unit file thehive-falcon.service to /etc/systemd/system run systemctl enable thehive-falcon to install it as a service. Run systemctl start thehive-falcon to start the service.