kibana and thehive integration

group_vars/all/main.yml

@@ -6,11 +6,6 @@ maxmind_key: ""
 
 docker_build_dir: "{{playbook_dir}}/build"
 
-# TheHive Button plugin
-THEHIVE_URL: "https://hive.gn4-3-wp8-soc.sunet.se/"
-THEHIVE_API_KEY: "5LymseWiurZBrQN8Kqp8O+9KniTL5cE0"
-THEHIVE_OWNER: "admin"
-
 soctools_netname: "soctoolsnet"
 soctools_network: "172.22.0.0/16"
 

roles/odfekibana/files/env.js.j2

 // Default plugin configuration
-export const THEHIVE_URL = '{{THEHIVE_URL}}';
-export const THEHIVE_API_KEY = '{{THEHIVE_API_KEY}}';
-export const THEHIVE_OWNER = '{{THEHIVE_OWNER}}'; // default owner account of the created cases
+export const THEHIVE_URL = 'https://{{soctoolsproxy}}:9000';
+export const THEHIVE_API_KEY = '{{lookup('password', '{{playbook_dir}}/secrets/tokens/thehive_kibana_secret_key')}}';
+export const THEHIVE_OWNER = '{{THEHIVE_KIBANA_USER.username}}'; // default owner account of the created cases

startsoctools.yml

@@ -35,6 +35,16 @@
   roles:
     - nifi
 
+- name: Reconfigure and start TheHive
+  hosts: thehive
+  roles:
+    - thehive
+
+- name: Reconfigure and start Cortex
+  hosts: cortex
+  roles:
+    - cortex
+
 - name: Reconfigure and start OpenDistro for Elasticsearch
   hosts: odfeescontainers
   roles:
@@ -50,13 +60,3 @@
   roles:
     - filebeat
 
-- name: Reconfigure and start TheHive
-  hosts: thehive
-  roles:
-    - thehive
-
-- name: Reconfigure and start Cortex
-  hosts: cortex
-  roles:
-    - cortex
-