tutorial

Monitoring TheHive with Vigilmon

TheHive is the backbone of your SOC's incident response workflow — but it has no built-in alerting for when the platform goes down, alert ingestion stalls, or Cortex stops enriching observables. Here's how to monitor TheHive end-to-end with Vigilmon.

TheHive is the case management and collaboration hub for security operations teams — when it goes down, your analysts can't create cases, ingest SIEM alerts, or track investigation tasks. Vigilmon gives you uptime monitoring for TheHive's REST API, alert pipeline watchdogs, Cortex connectivity checks, MISP sync health, and TLS certificate alerts so your SOC response capability stays visible even when the platform itself is struggling.

What You'll Set Up

  • HTTP uptime monitor for TheHive REST API and web UI (port 9000)
  • Alert ingestion pipeline watchdog via heartbeat
  • Cortex connector connectivity check
  • MISP synchronization health monitor
  • Elasticsearch/Lucene search index health check
  • TLS certificate expiry alert
  • Case creation throughput watchdog

Prerequisites

  • TheHive 5.x or 4.x installed and running (accessible on port 9000)
  • TheHive API key with read access
  • A free Vigilmon account

Step 1: Monitor TheHive Application Health

TheHive exposes a /api/status endpoint that returns application health without authentication. When this endpoint fails, your entire SOC incident response workflow stops.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter http://your-thehive-host:9000/api/status.
  4. Set Check interval to 1 minute.
  5. Set Expected HTTP status to 200.
  6. Under Response body, set Contains to "status":"Ok".
  7. Click Save.

If you run TheHive behind a reverse proxy with TLS, use the HTTPS URL instead and enable Monitor SSL certificate while you're here (see Step 7).

Step 2: Watchdog the Alert Ingestion Pipeline

TheHive receives alerts from SIEM systems, MISP, and custom sources via its API. Ingestion failures are silent — the SOC has no visibility into missed alerts until an analyst notices a case that never opened. Add a heartbeat that verifies the ingestion pipeline is processing:

#!/bin/bash
# /usr/local/bin/thehive-ingestion-check.sh
THEHIVE_URL="http://localhost:9000"
API_KEY="your-thehive-api-key"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-ingestion-heartbeat-id"

# Count alerts created in the last 5 minutes (or that the pipeline is accepting)
RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer $API_KEY" \
  "$THEHIVE_URL/api/v1/alert?range=0-1")

if [ "$RESPONSE" = "200" ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Schedule every 5 minutes with a 10-minute heartbeat interval. This confirms TheHive's alert API endpoint is accepting connections — if it stops responding, ingestion is blocked.

For environments with continuous SIEM alert flow, use a more targeted check that verifies alerts are actually being created:

# Check that at least one alert arrived in the last 15 minutes
RECENT=$(curl -s \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":[{"_name":"filter","_gte":{"_field":"createdAt","_value":"now-15m"}}],"from":0,"to":1}' \
  "$THEHIVE_URL/api/v1/query?name=list-alerts" | \
  python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null || echo "0")

if [ "$RECENT" -gt "0" ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Adjust the now-15m window to match your expected alert arrival rate.

Step 3: Monitor Cortex Connector Health

TheHive integrates with Cortex to enrich observables (IP addresses, domains, file hashes) using analyzers. When Cortex connectivity is lost, observable enrichment silently stalls — analysts see un-enriched IoCs with no indication that analysis failed.

#!/bin/bash
# /usr/local/bin/thehive-cortex-check.sh
THEHIVE_URL="http://localhost:9000"
API_KEY="your-thehive-api-key"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-cortex-heartbeat-id"

# Check Cortex connector status via TheHive's connector API
CORTEX_STATUS=$(curl -s \
  -H "Authorization: Bearer $API_KEY" \
  "$THEHIVE_URL/api/connector" | \
  python3 -c "
import sys, json
connectors = json.load(sys.stdin)
cortex = [c for c in connectors if c.get('name','').lower() == 'cortex']
if cortex and cortex[0].get('status') == 'Ok':
    print('ok')
else:
    print('error')
" 2>/dev/null || echo "error")

if [ "$CORTEX_STATUS" = "ok" ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Schedule every 5 minutes with a 10-minute heartbeat interval. A stopped Cortex or a broken API key will cause this check to fail and Vigilmon to alert.

Step 4: Monitor MISP Synchronization

TheHive can pull threat intelligence events from MISP to automatically create alerts. When MISP sync breaks, your TheHive cases lose their threat intelligence context. Monitor sync health:

#!/bin/bash
# /usr/local/bin/thehive-misp-sync-check.sh
THEHIVE_URL="http://localhost:9000"
API_KEY="your-thehive-api-key"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-misp-sync-heartbeat-id"

# Check MISP connector last sync time
LAST_SYNC=$(curl -s \
  -H "Authorization: Bearer $API_KEY" \
  "$THEHIVE_URL/api/connector" | \
  python3 -c "
import sys, json, time
from datetime import datetime
connectors = json.load(sys.stdin)
misp = [c for c in connectors if c.get('name','').lower() == 'misp']
if not misp:
    print('missing')
elif misp[0].get('status') != 'Ok':
    print('error')
else:
    # Check last sync within 6 hours
    last = misp[0].get('lastSync', 0) / 1000  # ms to seconds
    age_hours = (time.time() - last) / 3600
    print('ok' if age_hours < 6 else 'stale')
" 2>/dev/null || echo "error")

if [ "$LAST_SYNC" = "ok" ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Schedule hourly with a 90-minute heartbeat interval.

Step 5: Monitor Search Index Health

TheHive uses Elasticsearch (or the embedded Lucene index) for case and alert search. When the index is degraded, case search times out or returns stale results. Monitor Elasticsearch directly if you run an external cluster:

  1. In Vigilmon, click Add Monitor → HTTP / HTTPS.
  2. Enter http://your-elasticsearch-host:9200/_cluster/health.
  3. Set Check interval to 2 minutes.
  4. Set Expected HTTP status to 200.
  5. Under Response body, set Does not contain to "status":"red".
  6. Click Save.

For the embedded Lucene index, monitor TheHive's own search endpoint:

#!/bin/bash
# /usr/local/bin/thehive-search-check.sh
THEHIVE_URL="http://localhost:9000"
API_KEY="your-thehive-api-key"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-search-heartbeat-id"

START=$(date +%s%N)
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":[],"from":0,"to":1}' \
  "$THEHIVE_URL/api/v1/query?name=list-cases")
END=$(date +%s%N)
LATENCY_MS=$(( (END - START) / 1000000 ))

# Alert if search takes more than 5 seconds or fails
if [ "$HTTP_CODE" = "200" ] && [ "$LATENCY_MS" -lt 5000 ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Schedule every 5 minutes with a 10-minute heartbeat interval.

Step 6: Monitor Task Completion Rate

Overdue high-priority investigation tasks are an SLA breach that TheHive won't alert on by default. Add a watchdog:

#!/bin/bash
# /usr/local/bin/thehive-task-sla-check.sh
THEHIVE_URL="http://localhost:9000"
API_KEY="your-thehive-api-key"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/your-task-sla-heartbeat-id"

# Count open tasks on P1/P2 cases older than 4 hours
OVERDUE=$(curl -s \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "query": [
      {"_name": "filter", "_and": [
        {"_field": "status", "_value": "InProgress"},
        {"_lt": {"_field": "dueDate", "_value": "now"}}
      ]}
    ], "from": 0, "to": 0
  }' \
  "$THEHIVE_URL/api/v1/query?name=count-overdue-tasks" | \
  python3 -c "import sys,json; print(json.load(sys.stdin).get('total',0))" 2>/dev/null || echo "0")

if [ "$OVERDUE" = "0" ]; then
  curl -s "$HEARTBEAT_URL" > /dev/null
fi

Schedule every 30 minutes with a 45-minute heartbeat interval.

Step 7: TLS Certificate Expiry Alert

TheHive is typically exposed over HTTPS via a reverse proxy (nginx, Apache, or Caddy). Certificate expiry can lock out your entire SOC team from the platform.

  1. Open the HTTP monitor created in Step 1 (or add a new one for your HTTPS URL).
  2. Enable Monitor SSL certificate.
  3. Set Alert when certificate expires in less than 30 days.
  4. Click Save.

A 30-day alert window gives your team time to renew even with out-of-office periods and change management overhead.

Step 8: Configure Alert Channels

  1. Go to Alert Channels in Vigilmon and add your SOC notification channel — email, Slack, PagerDuty, or a webhook to your ticketing system.
  2. For production SOC environments, route TheHive application health alerts to PagerDuty with a P2 severity — TheHive downtime means analysts are working blind.
  3. For ingestion pipeline and Cortex alerts, use Slack with a #soc-ops channel to keep noise out of the on-call rotation.

Recommended Alert Thresholds

| Monitor | Alert After | Notes | |---|---|---| | Application health (port 9000) | 2 failures | Play Framework startup takes ~30s | | Alert ingestion pipeline | 1 failure | Silent ingestion failures are high-risk | | Cortex connector | 2 failures | Cortex restart causes transient gap | | MISP sync health | 1 failure | 6h staleness is already conservative | | Elasticsearch health | 1 failure | Red cluster = immediate action required | | TLS certificate | — | 30 days remaining |

Conclusion

With these monitors in place, Vigilmon gives you end-to-end visibility across TheHive's incident response stack: application availability, alert ingestion, observable enrichment via Cortex, threat intelligence sync from MISP, search index health, and certificate management. Your SOC team can focus on investigating threats knowing their platform health is covered.

For more self-hosted security monitoring guides, visit vigilmon.online.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles