Soc Deploy Thehive

Deploy TheHive 5 + Cortex 3 incident response platform on any Docker-ready Linux host. Automates account creation, API key generation, Cortex CSRF handling,...

This skill appears to do what it says: deploy TheHive + Cortex to a Docker-ready Linux host and generate API keys. Before using it: (1) only run it on a host you control and trust — it will create containers and save plaintext credentials to ~/thehive-cortex/api-keys.txt and print them to stdout; delete or move that file to secure storage when done. (2) Ensure the target has prerequisites installed (docker, docker compose v2, curl, openssl, sed) and that you have SSH/SCP access as instructed. (3) Review the included setup.sh and docker-compose.yml yourself (they are provided) to confirm network/port exposure and volumes meet your security policy. (4) Consider using a stronger generated secret and rotating keys after initial setup. If you want tighter security, run the deployment in an isolated lab or VM, and then harden the instance (firewall, remove plaintext key files, enable TLS) before exposing it to production.

Type: OpenClaw Skill Name: soc-deploy-thehive Version: 1.0.0 The skill is a legitimate automation bundle for deploying TheHive 5 and Cortex 3 incident response platforms via Docker. The core logic in `scripts/setup.sh` correctly handles complex multi-step setup processes, including service health polling, administrative password rotation, and the specific CSRF-token requirements of the Cortex API. It generates secure random secrets using `openssl` and properly integrates the two services by programmatically updating the `docker-compose.yml` file. All network activity is restricted to `localhost` for service configuration, and the documentation provided in `gotchas.md` and `api-reference.md` is accurate and helpful for the stated purpose.