FAQ

Analyzers

MaxMind

What version of MaxMind TheHive uses?

TheHive includes the GeoLite2 free City and Country databases.

How often are the databases refreshed?

TheHive does not refresh those databases. It is up to you to create a cron job to refresh them at the frequency you want. The files to update are:

• analyzers/MaxMind/GeoLite2-City.mmdb
• analyzers/MaxMind/GeoLite2-Country.mmdb

You can fetch up-to-date versions from https://dev.maxmind.com/geoip/geoip2/geolite2/.

How shall I configure the MaxMind analyzer?

No configuration is required. If it looks like the analyzer is not working, please clear the cache of your browser and retry. If it still doesn't work, please join TheHive User Discussion Forum or open an issue on GitHub.

Can I use the commercial versions of the databases?

The current version of TheHive does not offer that possibility. The next major release, slated for the end of 2016, will make that possible.