'\ /`
___ \___/ ___ HONEYBEE HIVEHUB
/ \ (0 0) / \ _________________________________
| M | X | M | AUTONOMOUS MAINTENANCE
|_____/ @@@ \_____| QUAD-TIERED RISK MITIGATION
@@@@@ SIGNATURE + HEURISTIC + LLM
@@@ _________________________________
V SCIKIT PANDA SECURITY RESEARCH
The hub for sharing HoneyBee configurations and rulesets.
Welcome to HiveHub.
Here you will find the best datasets for Bee, built and optimized through community contributions. Datasets are organized by distribution and job type. Browse the various versions and import the dataset that fits your needs.
Select your distribution above to see the available job datasets,
or continue with the default Debian jobs below.
Jobs for DEBIAN distro
default
1 version / 33 downloadsdisk-health
1 version / 3 downloadsservice-pulse
1 version / 5 downloadssystem-info
1 version / 8 downloadssystem-report
1 version / 1 downloadzombie-hunt
1 version / 30 downloadsLatest entries
- Redhat: zombie-hunt:default
- Redhat: system-report:default
- Suse: system-report:default
- Redhat: system-info:default
- Redhat: service-pulse:default
Ruleset catelog
- Redhat: disk-health:default
- Suse: system-info:default
- Debian: mail-monitor:default
- Debian: system-info:default
- Debian: disk-health:default
Debian
Ubuntu, Debian, Kali Linux, Raspberry Pi OS, Linux Mint, Pop!_OS
Arch
Arch Linux, Manjaro, EndeavourOS, SteamOS
Redhat
RHEL, Fedora, CentOS, Rocky Linux, AlmaLinux
Suse
OpenSUSE, SUSE Enterprise
Alpine
PostmarketOS, AdΓ©lie Linux
Slackware
Zenwalk, Salix OS, Porteus, Slax, VectorLinux
Gentoo
Calculate Linux, Pentoo, Redcore Linux, SWabaton, SystemRescue
π Hive Hub contributing
To submit/share your rulesets registration is required to obtain a Hivehub key used to submit your export. This helps us to avoid uploaders impersonating trusted users or abusing the service.
Enter your email address below to register your email adress and obtain the api key for exporting.
π HiveHub submission process
Rulesets contain true bash commands for detection. These rulesets cannot be executed by themself but Bee will apply them as rules. I find the process and contents of files a risk for my network and Bee users. Therefor i apply automated pre-filters and warning scanners as well as a final manual review by an operator to assure these files contain no configurations intended for harm, damage or unaccepted data handling.
Scanning and filtering
After initial risk scanning of submitted material our automated filter is applied to remove (most) user specific data
(ip's, hostname's, key's, usernames) from the files though i leave general LAN IPs or system account names.
During manual review i strip out what the filter missed to assure a proper ruleset.
This ruleset is then published on HiveHub becoming available to users for review and download.
Whitelisting for submissions
Sadly i cannot rely on good will to use Hive Hub within acceptable bounderies.
For that reason i also rely on whitelisting of users.
Downloads (Bee --import's) require no registration. Do review before downloading. It is smart to know what you allow your Bee to execute.
Uploading a ruleset (bee --export) requires registration to allow placing the data on our servers.
[SYSTEM] Initializing HoneyBee Agent...
[HIVE] Status: Online (12 Bees Active)
[MODE] PERMISSIVE - Threat Score Threshold < 10%
β Signature Check Passed
β Heuristic Score: 10/10
[CMD] Executing: apt-get update && apt-get upgrade -y