You are a Threat Hunter. While investigating, did you find yourself with more than 20 tabs opened in your browser, scattered .txt files with data and some terminals showing up in the background?
theTHE centralizes all the information on an investigation in a single project and shares its results with your team (and with nobody else). theTHE caches your API responses, so you don't need to repeat the requests. Don’t share your keys, let the users make calls to the services.
theTHE also contains some command-line tools integrated so you don't have to open a terminal and pipe the results in a .txt file.
Your feedback is welcome.
See releases
First, clone this repository with:
git clone https://github.com/ElevenPaths/thethe.git
Then, build the images and run the containers
docker-compose up -d
You should see thethe in https://localhost after a ☕
By default, there is a single user admin with password admin
Change the admin password as soon as you log into thethe the very first time.
(It is planned to have a proper multiuser support)
There are not API keys stored by default on the system.
To add an API key, there is an option in the user menu (upper-right corner) to manage your keys.
Mongodb has a bind volume to ease external storage and backups in a folder mongodb_data
In any case, we have provided you with a couple of scripts to backup (a compressed file) and restore data from your mongo container.
Inside utils folder:
Make a backup
backup_thethe_db.sh <mongodb_container_name>
Restore from a backup
restore_thethe_db.sh <mongodb_container_name>
There is a folder called extenal for everything theTHE should store outside a database: files, images, etc.
Backup this folder according to your backup policy.
See updating thethe
If you want to collaborate with the project, a development version is provided:
git clone https://github.com/ElevenPaths/thethe.git
Inside thethe main repo:
for the server:
git clone https://github.com/ElevenPaths/thethe_server.git
for the frontend:
git clone https://github.com/ElevenPaths/thethe_frontend.git
docker-compose -f docker-compose_dev.yml up -d
In develop mode the frontnd does not run inside a container, do:
cd thethe_frontend
npm install
npm run serve
Website: https://thethe.e-paths.com
License: https://raw.githubusercontent.com/ElevenPaths/thethe/master/LICENSE