thehive_config.json

{
    "Verify_SSL": true,
    "defaultCaseTemplate": "default playbook",
    "tag_fields":["DetectName","Tactic","Technique","Objective"],
    "email_alerts":false,
    "email_notify":["user1@corp.com","security@corp.com"],
    "email_from":"thehiveapi@corp.com",
    "email_server":"email.corp.com",
    "whitelist_config":"./whitelist.json",
    "blacklist_config":"./blacklist.json",
    "observable_map": {
        "CommandLine": {
            "dataType": "commandline",
            "message": "Command Line"
        },
	"ComputerName": {
            "dataType": "hostname",
            "message": "Computer Name"
        },
	"UserName": {
            "dataType": "user",
            "message": "User name"
        },
	"FileName": {
            "dataType": "filename",
            "message": "Triggering File Name"
        },
	"SHA256String": {
            "dataType": "hash",
            "message": "Triggering SHA256 hash"
        },
	"Tactic": {
            "dataType": "tactic",
            "message": "Attacker Tactic"
        },
	"Technique": {
            "dataType": "technique",
            "message": "Attacker Technique"
        },
	"Objective": {
            "dataType": "objective",
            "message": "Attacker Objective"
        }
    },
    "thehiveapi": "<api key for thehive>",
    "thehiveurl": "<url to your instance of thehive>/api/alert"
}