{"id":13305702,"url":"https://github.com/KaanSK/hivelime","last_synced_at":"2025-03-10T13:32:22.445Z","repository":{"id":65536699,"uuid":"593549884","full_name":"KaanSK/hivelime","owner":"KaanSK","description":"Create TheHive alerts from Sublime detections effortlessly!","archived":false,"fork":false,"pushed_at":"2023-01-26T10:10:20.000Z","size":2943,"stargazers_count":5,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-06-20T12:07:27.599Z","etag":null,"topics":["automation","golang","google-workspace","imap","incident-response","m365","mail","phishing","phishing-detection","secops","smtp","thehive","thehive-project","thehive5"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/KaanSK.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2023-01-26T09:34:43.000Z","updated_at":"2023-08-22T12:22:21.000Z","dependencies_parsed_at":"2023-02-14T16:16:53.569Z","dependency_job_id":null,"html_url":"https://github.com/KaanSK/hivelime","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KaanSK%2Fhivelime","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KaanSK%2Fhivelime/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KaanSK%2Fhivelime/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KaanSK%2Fhivelime/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/KaanSK","download_url":"https://codeload.github.com/KaanSK/hivelime/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":242859789,"owners_count":20196993,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["automation","golang","google-workspace","imap","incident-response","m365","mail","phishing","phishing-detection","secops","smtp","thehive","thehive-project","thehive5"],"created_at":"2024-07-29T17:54:00.009Z","updated_at":"2025-03-10T13:32:21.424Z","avatar_url":"https://github.com/KaanSK.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://goreportcard.com/badge/github.com/KaanSK/hivelime\" /\u003e\n  \u003cimg src=\"https://ghcr-badge.deta.dev/kaansk/hivelime/size\" /\u003e\n\u003c!--   \u003cimg src=\"https://img.shields.io/github/downloads/kaansk/hivelime/total?color=%233ABE25\u0026label=Release%20Downloads\" /\u003e --\u003e\n\u003c/p\u003e\n\n# HiveLime\nHivelime is a comprehensive integration between [TheHive](https://www.strangebee.com/thehive/) and [Sublime](https://sublimesecurity.com/). Utilizing Sublime webhooks, Hivelime can be effortlessly configured to create alerts on TheHive!\n\n# Functionalities\n* Triggered event (malicious email detection) is parsed and converted into an actionable TheHive alert with tags, observables;\n* Request signing can be used if `SUBLIME_SIGNING_KEY` variable is provided;\n* Observables have detailed tags to further analyze, filter or use in remediation step;\n* Built with both Security and OPS in mind. _HiveLime_ has small footprint, great performance on various workloads and easily deployable with minimal configuration;\n* Tags can be provided in configuration to be appended to alerts created by _HiveLime_;\n* Alert has a brief summary description with links to detection, flagged rules and important information.\n\n# Alert Examples\n![Observable example](images/alerts.png)\n\n![Observable example](images/alert_desc.png)\n\n![Observable example](images/observables.png)\n\n\n# Usage\n* Parameters should be provided via environment variables. Please see [docker-compose file](docker-compose.yml).\n* Run the app via docker or via simply `./hivelime`\n* _HiveLime_ will listen `http://SERVER_ADDRESS/sublime/event`. Make sure to provide `/sublime/event` url resource to Sublime Webhook action configuration.\n\n## Notes\n* Alert reference is first 8 chars of detection CanonicalID;\n\n# Setup \u0026 Compile Instructions\n## Get latest compiled binary from releases\n1. Check [Releases](https://github.com/KaanSK/hivelime/releases/latest)  section.\n\n## Compile from source code\n1. Make sure that you have a working Golang workspace.\n2. `go build .`\n    * `go build -ldflags=\"-s -w\" .` could be used to customize compilation and produce smaller binary.\n\n## Using Public Container Registries\n* `docker pull ghcr.io/kaansk/hivelime`\n\n## Using [Dockerfile](Dockerfile)\n1. Edit [config file](conf.yaml) or provide environment variables to commands bellow\n2. `docker build -t hivelime .`\n3. `docker run -it hivelime`\n\n## Using [docker-compose file](docker-compose.yml)\n1. Edit environment variables and configurations in [docker-compose file](docker-compose.yml)\n2. `docker-compose run -d`\n\n# Credits\n* [Sublime Security](https://sublimesecurity.com/)\n* [Dockerfile Reference](https://www.cloudreach.com/en/resources/blog/cts-build-golang-dockerfiles/) \n* Release management with [GoReleaser](https://goreleaser.com)\n* [Delivr.to](https://delivr.to/)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FKaanSK%2Fhivelime","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FKaanSK%2Fhivelime","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FKaanSK%2Fhivelime/lists"}