Build Guide

Build from sources

This document is a step-by-step guide to build TheHive from sources.

1. Pre-requisites

Few softwares are required to download and build Hippocampe.

Java VM

echo 'deb http://ppa.launchpad.net/webupd8team/java/ubuntu trusty main' | sudo tee -a /etc/apt/sources.list.d/java.list
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-key EEA14886
sudo apt-get update
sudo apt-get install oracle-java8-installer

Elasticsearch 5.2

Version 5.2 of Elasticsearch is required.

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/5.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-5.x.list
sudo apt-get update && sudo apt-get install elasticsearch

Before run Elasticsearch, secure it adding the following line in /etc/elasticsearch/elasticsearch.yml :

network.host: 127.0.0.1

and start the service :

sudo service elasticsearch start

Supplementary packages

sudo apt-get install git
sudo pip install elasticsearch Configparser netaddr flask python-dateutil apscheduler requests

Node.js

Install nodejs and bower, mandatory to build Hippocampe:

wget -qO- https://deb.nodesource.com/setup_4.x | sudo bash -
sudo apt-get install nodejs
sudo npm install -g bower

Build Hippocampe

We decided to install and build it in /opt but you can choose your own directory.

cd /opt
git clone https://github.com/CERT-BDF/Hippocampe.git
cd core/static
bower install
mkdir core/logs

Now you can start Hippocampe with the following command :

cd /opt/Hippocampe
python core/app.py

The service runs on port 5000/TCP by default and can be queried it on http://HOSTNAME:5000/hippocampe/api/v1.0/more.

Now refer to the tutorial to activate and update feeds.