SOAR/Incident Response Security Testing

TheHive Security Testing: API Key, Case Management, Admin Credentials, and Cortex Integration

📅 July 3, 2026 ⏱ 12 min read 🏷 TheHive, SOAR Security, Incident Response, API Key, Cortex Integration, Case Intelligence Access

TheHive is the most widely deployed open-source Security Orchestration, Automation, and Response (SOAR) and incident response platform, used by security operations teams to manage security incidents, track IOCs, and coordinate response actions. As the incident intelligence hub, TheHive contains information that attackers actively want: current active incident cases, IOC lists that reveal what attackers are already known, affected system lists, and response action plans. Key assessment areas: TheHive ships with default credentials of admin@thehive.local / secret; API keys provide full access to all incident cases and observables; TheHive's application.conf stores the Cortex API key for automated analyzer execution; the Elasticsearch/OpenSearch backend on port 9200 may be accessible without authentication on default deployments; and the MISP integration stores threat intelligence platform credentials. This guide covers systematic TheHive security assessment.

Default Credentials and API Authentication
Case and Observable Enumeration
Application Configuration and Integration Credentials
TheHive Security Hardening

Default Credentials and API Authentication

# TheHive — default credentials and API key authentication
HIVE_URL="https://thehive.example.com"

# TheHive default credentials: admin@thehive.local / secret
# Test via direct login
curl -s -X POST "${HIVE_URL}/api/login" \
  -H "Content-Type: application/json" \
  -d '{"user":"admin@thehive.local","password":"secret"}' \
  -c /tmp/hive_session 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    print(f'Login status: {d.get(\"status\",\"success\")}')
    print(f'User: {d.get(\"login\")} roles={d.get(\"roles\")}')
except: print('Response:', sys.stdin.read()[:200])
" 2>/dev/null

# API key authentication (TheHive v4/v5)
HIVE_API_KEY="your-thehive-api-key"
curl -s "${HIVE_URL}/api/user/current" \
  -H "Authorization: Bearer ${HIVE_API_KEY}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'User: {d.get(\"login\")} name={d.get(\"name\")} roles={d.get(\"roles\")}')
" 2>/dev/null

# List all users
curl -s "${HIVE_URL}/api/user?range=all" \
  -H "Authorization: Bearer ${HIVE_API_KEY}" 2>/dev/null | python3 -c "
import json,sys
users=json.load(sys.stdin)
print(f'Users: {len(users)}')
for u in users:
    print(f'  {u.get(\"login\")} name={u.get(\"name\")} roles={u.get(\"roles\")} status={u.get(\"status\")}')
" 2>/dev/null

Case and Observable Enumeration

# TheHive case and observable access — incident intelligence extraction
HIVE_URL="https://thehive.example.com"
HIVE_API_KEY="your-thehive-api-key"

# Enumerate all incident cases — complete incident history
curl -s -X POST "${HIVE_URL}/api/v1/query?name=list-cases" \
  -H "Authorization: Bearer ${HIVE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"query":[{"_name":"listCase"},{"_name":"sort","_fields":[{"_createdAt":"desc"}]},{"_name":"page","from":0,"to":50}]}' \
  2>/dev/null | python3 -c "
import json,sys
cases=json.load(sys.stdin)
print(f'Incident cases: {len(cases)}')
for c in cases:
    print(f'  [{c.get(\"caseId\")}] {c.get(\"title\")} severity={c.get(\"severity\")} status={c.get(\"status\")}')
    print(f'    Created: {c.get(\"_createdAt\")} Tags: {c.get(\"tags\")}')
    print(f'    Description: {c.get(\"description\",\"\")[:100]}')
" 2>/dev/null

# Get observables (IOCs) from a specific case
CASE_ID="case-id-here"
curl -s -X POST "${HIVE_URL}/api/v1/query?name=case-observables" \
  -H "Authorization: Bearer ${HIVE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "{\"query\":[{\"_name\":\"getCase\",\"idOrName\":\"${CASE_ID}\"},{\"_name\":\"observables\"},{\"_name\":\"page\",\"from\":0,\"to\":100}]}" \
  2>/dev/null | python3 -c "
import json,sys
obs=json.load(sys.stdin)
print(f'Observables (IOCs): {len(obs)}')
for o in obs:
    print(f'  type={o.get(\"dataType\")} value={o.get(\"data\")} tlp={o.get(\"tlp\")} ioc={o.get(\"ioc\")}')
" 2>/dev/null

Application Configuration and Integration Credentials

# TheHive application.conf — Cortex, MISP, and backend credentials

cat /etc/thehive/application.conf 2>/dev/null | grep -A5 -B2 \
  -E "url|key|password|secret|cortex|misp|elasticsearch"
# Reveals:
# Cortex integration:
#   play.modules.enabled += "org.thp.thehive.connector.cortex.CortexModule"
#   cortex { ... url = "http://cortex:9001" key = "cortex-api-key" }
# MISP integration:
#   misp { ... url = "https://misp.corp.local" key = "misp-auth-key" }
# Elasticsearch backend:
#   db.janusgraph.storage.backend = elasticsearch
#   db.janusgraph.storage.hostname = ["elasticsearch"]

# Elasticsearch direct access — often unauthenticated in default TheHive setups
# TheHive's Elasticsearch backend may lack authentication
ES_URL="http://elasticsearch:9200"
curl -s "${ES_URL}/_cat/indices?v" 2>/dev/null | head -20
# If this succeeds without credentials, all TheHive data is accessible directly

# Direct Elasticsearch query for all cases (bypasses TheHive RBAC)
curl -s "${ES_URL}/the_hive_14/_search?size=10" \
  -H "Content-Type: application/json" \
  -d '{"query":{"match_all":{}}}' 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
hits = d.get('hits',{}).get('hits',[])
total = d.get('hits',{}).get('total',{}).get('value',0)
print(f'Total TheHive documents in Elasticsearch: {total}')
for h in hits[:5]:
    src = h.get('_source',{})
    print(f'  type={src.get(\"_type\")} title={src.get(\"title\",\"\")} status={src.get(\"status\",\"\")}')
" 2>/dev/null

TheHive Security Hardening

TheHive Security Hardening Checklist:

Change default admin@thehive.local/secret credentials and implement organizational authentication — TheHive ships with a default admin account; many security teams deploy it quickly for an incident and fail to change defaults; change the admin password immediately and integrate with LDAP/AD or SSO for organizational authentication; disable the default admin account after creating organizational admin accounts; enable multi-factor authentication for all analyst and admin roles
Secure the Elasticsearch/OpenSearch backend with authentication — TheHive's default Docker Compose configuration runs Elasticsearch without authentication, relying on network isolation between containers; if the Elasticsearch port (9200) is reachable from other network segments, all TheHive case data including IOCs, incident descriptions, and investigation notes is accessible without any authentication; enable Elasticsearch security with X-Pack (built into modern versions) and generate dedicated TheHive credentials for the backend connection
Protect application.conf with filesystem permissions and externalize sensitive credentials — application.conf contains the Cortex API key (enabling automated threat analysis execution), MISP authentication key (threat intelligence platform), and Elasticsearch credentials; restrict the file to 640 owned by the thehive service user; better: use environment variables injected via Docker secrets or Kubernetes secrets for the Cortex and MISP API keys rather than embedding them in the config file
Implement case and observable TLP/PAP policies — TheHive supports Traffic Light Protocol (TLP) and Permissible Actions Protocol (PAP) classifications on cases and observables; use these classifications to limit which IOCs and case details are shared with Cortex analyzers and MISP; TLP:RED observables should not be submitted to external analysis services automatically; configure per-organization data sharing policies in multi-tenant deployments
Audit API key creation and implement key expiry — TheHive API keys do not expire by default; any compromised API key provides indefinite access to all incident intelligence; implement a key rotation policy; audit active API keys in Administration > Users; associate API keys with specific integration purposes and revoke unused keys; monitor for API access from unexpected source IPs

Security Test	Method	Risk
Default admin@thehive.local/secret credentials	POST /api/login with admin@thehive.local:secret — successful login provides full SOAR admin access including all incident cases, IOC lists, response playbooks, and user management	Critical
Incident case and IOC enumeration	POST /api/v1/query with API key — returns all incident cases with titles, severity, IOCs, affected users, and investigation notes; exposes which incidents are currently being investigated and the organization's threat detection capability	Critical
Elasticsearch unauthenticated access	GET http://elasticsearch:9200/_cat/indices — if accessible, all TheHive data is readable directly bypassing application RBAC; direct document queries return case data without TheHive authentication	Critical
Cortex API key extraction from application.conf	Read /etc/thehive/application.conf — cortex.key provides authenticated access to all Cortex analyzers; enables submitting arbitrary IOCs for analysis using the organization's analyzer subscriptions and credentials	High
MISP integration key extraction	Read /etc/thehive/application.conf — misp.key provides access to the organization's MISP threat intelligence platform; enables reading all private threat intelligence feeds and creating false threat events	High

Automate TheHive Security Testing

Ironimo tests TheHive deployments for default credential exploitation, API key incident case and observable enumeration, Elasticsearch unauthenticated backend access, application.conf Cortex and MISP credential extraction, case TLP/PAP policy enforcement testing, multi-organization data isolation boundary testing, and Cortex integration security assessment.

Start free scan

Table of Contents

Default Credentials and API Authentication

Case and Observable Enumeration

Application Configuration and Integration Credentials

TheHive Security Hardening

Automate TheHive Security Testing