{"id":8200,"date":"2026-03-18T13:25:54","date_gmt":"2026-03-18T11:25:54","guid":{"rendered":"https:\/\/scalemedia.co.za\/cybermedia\/?post_type=docs&p=8200"},"modified":"2026-03-24T20:37:16","modified_gmt":"2026-03-24T18:37:16","password":"","slug":"home-lab-episode-5-thehive-cortex-misp-installation","status":"publish","type":"docs","link":"https:\/\/scalemedia.co.za\/cybermedia\/docs\/home-lab-episode-5-thehive-cortex-misp-installation\/","title":{"rendered":"Lab Building Series: Ep5"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

We’ll install TheHive, Cortex & MISP with Docker containers<\/strong> and Docker Compose<\/strong>. These tools help cyber security professionals manage and respond to incidents efficiently.<\/p>\n\n\n\n

Here’s a breakdown of what each tool does:<\/p>\n\n\n\n

TheHive<\/h2>\n\n\n\n

The hive is an open-source Security Incident Response Platform (SIRP)<\/strong> used to manage and track security incidents on a case-by-case basis. <\/p>\n\n\n\n

Cortex<\/h2>\n\n\n\n

is an observable analysis<\/strong> and active response engine<\/strong> that automates the enrichment of indicators like IP addresses, domains, and files. It analyzes observables found during an incident and provides intelligence from various sources.<\/p>\n\n\n\n

MISP (Malware Information Sharing Platform)<\/h2>\n\n\n\n

is a platform for sharing and gathering security intelligence<\/strong>. It helps collect, store, share, and correlate cyber security indicators and threats.<\/p>\n\n\n\n

Docker<\/h2>\n\n\n\n

is an open-source containerization platform<\/strong> that packages applications and their dependencies into isolated containers, making them portable and easy to deploy.<\/p>\n\n\n\n

Docker Compose<\/h2>\n\n\n\n

is a tool that allows you to define and run multiple Docker containers<\/strong> at once using a single YAML file, simplifying multi-container application deployments.<\/p>\n\n\n\n

How they work together:<\/strong> When an incident occurs, TheHive<\/strong> manages the case. Cortex<\/strong> analyzes suspicious observables from the incident, and MISP<\/strong> provides external threat intelligence and facilitates sharing new findings.<\/p>\n\n\n\n

In oder to install TheHive, Cortex & MISP you need to install them on the Ubuntu server if you do not have it yet check this video<\/a> will show you how to do it. And make sure that is on the same network as where we installed the Wazuh SIEM. Allocate at least 8 GB of memory<\/strong> and 2-4 virtual processors<\/strong> to the VM, as TheHive, Cortex, and MISP require several supporting database services.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

We will be using Docker Compose to deploy this lab, It will allows us to define and run multiple containers at once using YAML file (.yaml<\/code> or .yml<\/code>) <\/p>\n\n\n\n

\n\n
\n
\n
\n <\/span>\n <\/span>\n <\/span>\n <\/div>\n \n
\n
\n \ud83d\udcd8<\/span>\n <\/div>\n \n
\n filename.js<\/span>\n <\/div>\n <\/div>\n <\/div>\n\n
\n
\n