Skip to content

Update TheHive Service Configuration#

Modify TheHive service configuration to fit your requirements.

Maintenance window required

This procedure involves changing configuration files and restarting services. Schedule a maintenance window to prevent service disruption.

Update the listen address and port#

By default, TheHive listens on all network interfaces (0.0.0.0) on port 9000. You can change these settings to control how TheHive listens internally on the host.

Difference from the base URL

The listen address and port are independent of the public URL defined in application.baseUrl.

  • Use http.address and http.port to control how the service listens on the host.
  • Use application.baseUrl to define the public URL that TheHive communicates to clients.

  1. Stop TheHive service.

    Service commands

    For stop/restart commands depending on your installation method, refer back to the relevant installation guide.

  2. Open the application.conf file using a text editor.

  3. Add the following configuration:

    http.address=127.0.0.1
http.port=9000

  4. Modify the values according to your requirements.

  5. Save your modifications in the application.conf file.

  6. Restart TheHive service.

Update the base URL#

The base URL defines the public address that users access to reach TheHive. This setting tells TheHive how to generate URLs for clients.

Role of the base URL

The public URL defined in application.baseUrl is independent of the service’s listening address and port.

  • Use http.address and http.port to control how the service listens on the host.
  • Use application.baseUrl to define the public URL that TheHive communicates to clients.

  1. Stop TheHive service.

    Service commands

    For stop/restart commands depending on your installation method, refer back to the relevant installation guide.

  2. Open the application.conf file using a text editor.

  3. Update the following line:

    [..]
# Service configuration
application.baseUrl = "http://localhost:9000"
[..]

    Replace http://localhost:9000 with the actual public URL that users will use to access TheHive.

    Mandatory elements#

    Optional elements#

    • Port: The network port where TheHive is exposed. Include a port only when the public URL uses a non-standard port. Standard ports are 80 for HTTP and 443 for HTTPS.
    • Path segments: Needed if TheHive runs behind a reverse proxy under a subpath.

    Service configuration examples

    • Root domain:

      Without explicit port:

      application.baseUrl = "https://thehive.example.org"
play.http.context = "/"

      With explicit port:

      application.baseUrl = "https://thehive.example.org:9000"
play.http.context = "/"

    • Custom path behind a reverse proxy:

      Without explicit port:

      application.baseUrl = "https://example.org/thehive"
play.http.context = "/thehive"

      With explicit port:

      application.baseUrl = "https://example.org:9000/thehive"
play.http.context = "/thehive"

  4. Save your modifications in the application.conf file.

  5. Restart TheHive service.

Set a context path#

Configure a context path when TheHive runs behind a reverse proxy under a specific URL path.

  1. Stop TheHive service.

    Service commands

    For stop/restart commands depending on your installation method, refer back to the relevant installation guide.

  2. Open the application.conf file using a text editor.

  3. Update the following line:

    [..]
# Service configuration
play.http.context = "/"
[..]

    Replace / with your desired context path.

    For example:

    play.http.context: "/thehive"

    Service configuration examples

    • Root domain:

      Without explicit port:

      application.baseUrl = "https://thehive.example.org"
play.http.context = "/"

      With explicit port:

      application.baseUrl = "https://thehive.example.org:9000"
play.http.context = "/"

    • Custom path behind a reverse proxy:

      Without explicit port:

      application.baseUrl = "https://example.org/thehive"
play.http.context = "/thehive"

      With explicit port:

      application.baseUrl = "https://example.org:9000/thehive"
play.http.context = "/thehive"

  4. Save your modifications in the application.conf file.

  5. Restart TheHive service.

Configure streams for reverse proxies#

Reverse proxies like Nginx can cause 504 Gateway Time-Out errors with TheHive long-polling requests. Configure the refresh interval to prevent these timeouts.

  1. Stop TheHive service.

    Service commands

    For stop/restart commands depending on your installation method, refer back to the relevant installation guide.

  2. Open the application.conf file using a text editor.

  3. Add the following configuration:

    stream.longPolling.refresh: 45 seconds

    This setting determines how often TheHive refreshes long-polling connections to prevent proxy timeouts.

  4. Save your modifications in the application.conf file.

  5. Restart TheHive service.

Next steps