Update TheHive Service Configuration#

Modify TheHive service configuration to fit your requirements.

Maintenance window required

This procedure involves changing configuration files and restarting services. Schedule a maintenance window to prevent service disruption.

Update the listen address and port#

By default, TheHive listens on all network interfaces (0.0.0.0) on port 9000. You can change these settings to control how TheHive listens internally on the host.

Difference from the base URL

The listen address and port are independent of the public URL defined in application.baseUrl.

Use http.address and http.port to control how the service listens on the host.
Use application.baseUrl to define the public URL that TheHive communicates to clients.

Stop TheHive service.
Service commands

Stop and restart commands depend on your installation method and the specific service. Refer to the official documentation for the appropriate commands.
- Package installation: Depending on your distribution and the service, use systemctl or service. See the systemctl documentation and the service documentation for details.
- Docker Compose deployment: Refer to the official Docker Compose documentation.
- Kubernetes deployment: Refer to the kubectl scale documentation or the kubectl rollout restart documentation.
Open the application.conf file using a text editor.
Add the following configuration:
```
http.address=127.0.0.1
http.port=9000
```
Modify the values according to your requirements.
Save your modifications in the application.conf file.
Restart TheHive service.

Update the base URL#

The base URL defines the public address that users access to reach TheHive. This setting tells TheHive how to generate URLs for clients.

Role of the base URL

The public URL defined in application.baseUrl is independent of the service’s listening address and port.

Use http.address and http.port to control how the service listens on the host.
Use application.baseUrl to define the public URL that TheHive communicates to clients.

Stop TheHive service.
Service commands

Stop and restart commands depend on your installation method and the specific service. Refer to the official documentation for the appropriate commands.
- Package installation: Depending on your distribution and the service, use systemctl or service. See the systemctl documentation and the service documentation for details.
- Docker Compose deployment: Refer to the official Docker Compose documentation.
- Kubernetes deployment: Refer to the kubectl scale documentation or the kubectl rollout restart documentation.
Open the application.conf file using a text editor.
Update the following line:
```
[..]
# Service configuration
application.baseUrl = "http://localhost:9000"
[..]
```
Replace http://localhost:9000 with the actual public URL that users will use to access TheHive.

Mandatory elements#
- Protocol: Either http or https, depending on whether you configured HTTPS using a reverse proxy.
- Host name: The DNS name or IP address that users enter in their browser.
Optional elements#
- Port: The network port where TheHive is exposed. Include a port only when the public URL uses a non-standard port. Standard ports are 80 for HTTP and 443 for HTTPS.
- Path segments: Needed if TheHive runs behind a reverse proxy under a subpath.
Service configuration examples
- Root domain:
  
  Without explicit port:
```
application.baseUrl = "https://thehive.example.org"
play.http.context = "/"
```
  With explicit port:
```
application.baseUrl = "https://thehive.example.org:9000"
play.http.context = "/"
```
- Custom path behind a reverse proxy:
  
  Without explicit port:
```
application.baseUrl = "https://example.org/thehive"
play.http.context = "/thehive"
```
  With explicit port:
```
application.baseUrl = "https://example.org:9000/thehive"
play.http.context = "/thehive"
```
Save your modifications in the application.conf file.
Restart TheHive service.

Set a context path#

Configure a context path when TheHive runs behind a reverse proxy under a specific URL path.

Stop TheHive service.
Service commands

Stop and restart commands depend on your installation method and the specific service. Refer to the official documentation for the appropriate commands.
- Package installation: Depending on your distribution and the service, use systemctl or service. See the systemctl documentation and the service documentation for details.
- Docker Compose deployment: Refer to the official Docker Compose documentation.
- Kubernetes deployment: Refer to the kubectl scale documentation or the kubectl rollout restart documentation.
Open the application.conf file using a text editor.

Update the following line:

[..]
# Service configuration
play.http.context = "/"
[..]

Replace / with your desired context path.

For example:

play.http.context: "/thehive"

Service configuration examples

Root domain:

Without explicit port:

application.baseUrl = "https://thehive.example.org"
play.http.context = "/"

With explicit port:

application.baseUrl = "https://thehive.example.org:9000"
play.http.context = "/"

Custom path behind a reverse proxy:

Without explicit port:

application.baseUrl = "https://example.org/thehive"
play.http.context = "/thehive"

With explicit port:

application.baseUrl = "https://example.org:9000/thehive"
play.http.context = "/thehive"

Save your modifications in the application.conf file.
Restart TheHive service.

Adjust the stream long-polling refresh interval#

TheHive uses long-polling to stream events to clients, with a default refresh interval of 1 minute.

Adjusting the stream.longPolling.refresh setting is useful in two situations:

Reverse proxy timeouts: Proxies such as Nginx can return 504 Gateway Time-Out errors on long-polling requests. Reducing this interval keeps requests within the proxy's timeout threshold.
Performance: Adjusting this interval lets you balance event delivery speed against server load.

To update these settings, follow the steps below.

Stop TheHive service.
Service commands

Stop and restart commands depend on your installation method and the specific service. Refer to the official documentation for the appropriate commands.
- Package installation: Depending on your distribution and the service, use systemctl or service. See the systemctl documentation and the service documentation for details.
- Docker Compose deployment: Refer to the official Docker Compose documentation.
- Kubernetes deployment: Refer to the kubectl scale documentation or the kubectl rollout restart documentation.
Open the application.conf file using a text editor.
Add the following configuration, adjusting the value to your requirements:
```
stream.longPolling.refresh: 1 minute
```
Save your modifications in the application.conf file.
Restart TheHive service.

Adjust attachment and request size limits#

TheHive enforces size limits on uploaded attachments and HTTP requests.

Two settings control these limits independently:

Setting	Controls	Default
`play.http.parser.maxDiskBuffer`	Maximum attachment size	`1GB`
`play.http.parser.maxMemoryBuffer`	Maximum HTTP request size (excluding attachments)	`10M`

To update these settings, follow the steps below.

Stop TheHive service.
Service commands

Stop and restart commands depend on your installation method and the specific service. Refer to the official documentation for the appropriate commands.
- Package installation: Depending on your distribution and the service, use systemctl or service. See the systemctl documentation and the service documentation for details.
- Docker Compose deployment: Refer to the official Docker Compose documentation.
- Kubernetes deployment: Refer to the kubectl scale documentation or the kubectl rollout restart documentation.
Open the application.conf file using a text editor.

Add the following configuration, adjusting the values to your requirements:

play.http.parser.maxDiskBuffer = 1GB
play.http.parser.maxMemoryBuffer = 10M

Save your modifications in the application.conf file.
Restart TheHive service.