Graylog2thehive
Create alerts in The Hive from your Graylog alerts, to be turned into Hive cases.
Install / Use
/learn @ReconInfoSec/Graylog2thehiveREADME
graylog2thehive
Create alerts in The Hive from your Graylog alerts, to be turned into Hive cases.
Simple Python flask app that runs as a web server, and accepts POST requests from your Graylog notifications.
git clone https://github.com/ReconInfoSec/graylog2thehive.git /opt/graylog2thehive
Get up and running:
- Configure SSL certificate paths in
app.py, or remove all context lines if not using SSL - Copy
init.d/graylog2thehive.serviceto/etc/systemd/system/graylog2thehive.service - Set your Hive API key in
/etc/systemd/system/graylog2thehive.servicefor theHIVE_SECRET_KEY - Set your Hive and Graylog URLs in
config.py - Optional:
app/__init__.py, configure any other IP, hash, URL, or filename fields in place of src_ip and dst_ip to include them as artifacts/observables in your alert
pip install -r requirements.txt
cp init.d/graylog2thehive.service /etc/systemd/system/graylog2thehive.service
systemctl enable graylog2thehive
systemctl start graylog2thehive
- Runs at https://0.0.0.0:5000, accepts POST requests
- Point your Graylog
Legacy Alarm Callbacktohttps://[YOURSERVER].com:5000/create_alert - Point your Graylog
HTTP Notificationtohttps://[YOURSERVER].com:5000/create_alert_http
- Point your Graylog
Related Skills
node-connect
345.9kDiagnose OpenClaw node connection and pairing failures for Android, iOS, and macOS companion apps
claude-opus-4-5-migration
106.4kMigrate prompts and code from Claude Sonnet 4.0, Sonnet 4.5, or Opus 4.1 to Opus 4.5
frontend-design
106.4kCreate distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.
model-usage
345.9kUse CodexBar CLI local cost usage to summarize per-model usage for Codex or Claude, including the current (most recent) model or a full model breakdown. Trigger when asked for model-level usage/cost data from codexbar, or when you need a scriptable per-model summary from codexbar cost JSON.
