Skip to content

Initial Configuration

Configure your Hive environment for optimal use.

Configuration Overview

After first login, configure these key areas:

  1. Organization Settings - Basic org configuration
  2. User Preferences - Personal settings
  3. Notification Settings - Alert preferences
  4. API Configuration - For CLI/automation
  5. Scope Definition - What you're allowed to test

Organization Configuration

View Organization Details

  1. Navigate to Operations → Organizations
  2. Select your organization
  3. Review details

Key Information: - Organization name - Members - Engagements - Campaigns - Scope definitions

Update Organization (Admin Only)

Editable Fields: - Organization name - Description - Contact information - Logo (optional)

Steps: 1. Click Edit Organization 2. Update fields 3. Click Save

User Preferences

Profile Settings

  1. Click user menu (top right)
  2. Select Profile
  3. Update preferences

Configurable: - Display name - Email notifications - Time zone - Date format - Language (if available)

Notification Preferences

Configure Alerts:

  1. Go to Profile → Notifications
  2. Choose notification types:
  3. Email notifications
  4. In-app notifications
  5. Webhook notifications (advanced)

Notification Types: - Scan completed - Vulnerability found - Critical findings - Scan failed - System updates

Frequency: - Real-time - Daily digest - Weekly summary - Disabled

Dashboard Preferences

Customize Your View:

  1. Navigate to Dashboard
  2. Click Customize
  3. Configure widgets:
  4. Add/remove widgets
  5. Resize widgets
  6. Rearrange layout
  7. Click Save Layout

See Customizing Views

See API Keys

Test API Access

Verify API Key Works:

# Using curl
curl -H "X-Api-Key: YOUR_KEY" \
  https://api.hive.darksidesecurity.io/executions-cli/executions

# Using APHIDS CLI
aphids-cli --api-key YOUR_KEY --help

Scope Definition

Understanding Scope

Scope defines what you're authorized to test.

Scope Types: - IP ranges (e.g., 192.168.1.0/24) - Domain names (e.g., example.com) - Subdomains (e.g., *.example.com) - Specific URLs (e.g., https://app.example.com)

Define Engagement Scope

When Creating Engagement:

  1. Navigate to Operations → Engagements
  2. Click Create Engagement
  3. In Scope section:
  4. Add authorized targets
  5. Specify exclusions
  6. Define testing windows
  7. Set rate limits

Example Scope: 

In Scope:
  - 192.168.1.0/24
  - *.example.com
  - https://app.example.com

Out of Scope:
  - 192.168.1.1 (firewall)
  - admin.example.com
  - Production database servers

Testing Windows:
  - Monday-Friday: 6pm-6am
  - Weekends: Anytime
  - Holidays: No testing

Rate Limits:
  - Max 100 requests/second
  - Max 10 concurrent scans

Scope Verification

Before Scanning:

✅ Verify Authorization: Written permission
✅ Check Scope: Target in defined scope
✅ Review Exclusions: Avoid out-of-scope targets
✅ Confirm Timing: Within testing windows
✅ Check Rate Limits: Won't overwhelm systems

Notification Configuration

Email Notifications

Configure Email Alerts:

  1. Go to Profile → Notifications
  2. Enable email notifications
  3. Select events:
  4. Scan completed
  5. Critical vulnerabilities
  6. Scan failures
  7. Weekly summaries

Email Format: - HTML or plain text - Include details or summary only - Attach reports (optional)

Webhook Notifications

For Integration (Advanced):

  1. Navigate to Configuration → Webhooks
  2. Click Create Webhook
  3. Configure:
  4. URL: Your endpoint
  5. Events: Select triggers
  6. Secret: For verification
  7. Retry: Enable/disable
  8. Click Create

Webhook Events: - scan.started - scan.completed - scan.failed - vulnerability.found - asset.discovered

See API Integration

Integration Setup

SIEM Integration

Forward Logs to SIEM:

  1. Navigate to Configuration → Integrations
  2. Select SIEM type (Splunk, ELK, etc.)
  3. Configure:
  4. Endpoint URL
  5. Authentication
  6. Log format
  7. Filtering rules
  8. Test connection
  9. Enable integration

Ticketing Integration

Create Tickets Automatically:

  1. Go to Configuration → Integrations
  2. Select ticketing system (Jira, ServiceNow)
  3. Configure:
  4. API credentials
  5. Project/board
  6. Issue type
  7. Priority mapping
  8. Test connection
  9. Enable auto-ticketing

Ticket Creation Rules: - Create ticket for critical vulns - Create ticket for high vulns - Group by asset - Assign to team

Security Configuration

Session Settings

Configure Session Behavior:

  1. Go to Configuration → Settings → Security
  2. Configure:
  3. Session timeout (default: 30 min)
  4. Max session duration (default: 8 hours)
  5. Concurrent sessions (allow/deny)
  6. Remember me duration (default: 30 days)

Password Policy

Admin Only:

  1. Navigate to Configuration → Settings → Security
  2. Configure password requirements:
  3. Minimum length
  4. Complexity requirements
  5. Expiration period
  6. History (prevent reuse)
  7. Lockout policy

MFA Enforcement

Admin Only:

  1. Go to Configuration → Settings → Security
  2. Enable Require MFA for all users
  3. Set grace period for enrollment
  4. Configure backup options

Best Practices

Initial Configuration Checklist

  • Profile completed
  • MFA enabled
  • Notifications configured
  • API key created (if needed)
  • Scope defined
  • Dashboard customized
  • Team members invited (if admin)
  • Integrations configured (if needed)

Security Best Practices

✅ Enable MFA: Two-factor authentication
✅ Strong Passwords: 12+ characters
✅ API Key Security: Store securely, rotate regularly
✅ Scope Verification: Always verify authorization
✅ Audit Logs: Review regularly
✅ Least Privilege: Minimum necessary permissions

Operational Best Practices

✅ Clear Naming: Use descriptive names
✅ Documentation: Document scope and authorization
✅ Testing Windows: Define and respect
✅ Rate Limits: Prevent system overload
✅ Notifications: Configure for critical events
✅ Regular Reviews: Review settings periodically

Troubleshooting

Can't Create API Key

Check: - You have appropriate permissions - Organization allows API access - Not at API key limit

Solution: - Contact administrator - Request API key permissions - Delete unused keys

Notifications Not Working

Check: - Email address verified - Notifications enabled in profile - Check spam folder - Webhook endpoint accessible

Solution: - Verify email address - Re-enable notifications - Test webhook endpoint - Check firewall rules

Scope Validation Errors

Check: - Scope format correct - No overlapping ranges - Exclusions properly defined - CIDR notation valid

Solution: - Review scope syntax - Use scope validator - Contact support if needed

Next Steps

Configuration complete! Now:

  1. Explore Dashboard - Learn the interface
  2. Create Engagement - Start your first project
  3. Run First Scan - Execute security test
  4. Install APHIDS CLI - Set up command-line tool

Related: First Login | API Keys | Dashboard