TheHive Project
TheHive Project Pack.#
This Integration is part of theSupported versions
Supported Cortex XSOAR versions: 6.0.0 and later.
Integration with The Hive Project Security Incident Response Platform. This integration was integrated and tested with version 4.1.4 of TheHive Project
#
Configure TheHive Project in CortexParameter | Description | Required |
---|---|---|
Host | Ensure to include the port number with the URL (e.g. http://IP_OF_VM:9000) | True |
API Key | True | |
Fetch incidents | False | |
Incident type | False | |
Incidents Fetch Interval | False | |
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) | False | |
The maximum amount of incidents to fetch at once | False | |
Case mirroring | Select whether you would like cases to mirror in, out, in both directions or disabled. | True |
Trust any certificate (not secure) | False | |
Use system proxy settings | False |
#
CommandsYou can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
#
thehive-list-casesList cases.
#
Base Commandthehive-list-cases
#
InputArgument Name | Description | Required |
---|---|---|
limit | Limit the number of returned results. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
TheHive.Cases._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.customFields | unknown | Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case. |
TheHive.Cases.caseId | number | The order of the case. |
TheHive.Cases.flag | boolean | A boolean flag used for filtering. |
TheHive.Cases.startDate | number | Datetime the case was started on, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.status | string | Status of the case. |
TheHive.Cases.owner | string | Owner of the case. |
TheHive.Cases.tlp | number | Traffic Light Protocol designation for the case. |
TheHive.Cases.title | string | Title of the case. |
TheHive.Cases.tags | unknown | Tags added to the case. |
TheHive.Cases._type | string | Type of the case. |
TheHive.Cases._version | number | The version of TheHive Project. |
TheHive.Cases.id | string | The ID of the case. |
TheHive.Cases.createdAt | number | Datetime the case was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.description | string | Description of the case. |
TheHive.Cases.severity | number | Severity of the case. |
TheHive.Cases.pap | number | Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed. |
TheHive.Cases.createdBy | string | The user who created the case. |
TheHive.Cases.tasks._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases.tasks._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.tasks.flag | boolean | A boolean flag used for filtering. |
TheHive.Cases.tasks.order | number | The order of the task. |
TheHive.Cases.tasks.status | string | Status of the task. |
TheHive.Cases.tasks.title | string | Title of the task. |
TheHive.Cases.tasks._type | string | Type of the task. |
TheHive.Cases.tasks._version | number | The version of TheHive Project. |
TheHive.Cases.tasks.id | string | The ID of the task. |
TheHive.Cases.tasks.createdAt | number | Datetime the task was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.createdBy | string | The user who created the task. |
TheHive.Cases.tasks.group | string | Group of the task. |
TheHive.Cases.tasks.logs.message | string | Log message. |
TheHive.Cases.tasks.logs._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases.tasks.logs._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.tasks.logs.startDate | number | Datetime the log was started on, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.logs.status | string | Status of the log. |
TheHive.Cases.tasks.logs.owner | string | Owner of the log. |
TheHive.Cases.tasks.logs._type | string | Type of the log. |
TheHive.Cases.tasks.logs._version | number | The version of TheHive Project. |
TheHive.Cases.tasks.logs.id | string | The ID of the log. |
TheHive.Cases.tasks.logs.createdAt | number | Datetime the task log was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.logs.createdBy | string | The user who created the log. |
#
Command Example!thehive-list-cases
#
Context Example#
Human Readable Output#
TheHive Cases
id title description createdAt ~479312 case with tasks case with tasks 2021-10-11T17:02:01Z ~487504 no tasks case case with no task 2021-10-11T17:02:34Z ~491600 merge 1 case to merge 2021-10-11T17:02:55Z ~524320 merge 2 case to merge 2 2021-10-11T17:03:12Z ~561160 observables case case with observables 2021-10-11T17:12:06Z ~41509016 remove case case to be removed 2021-10-11T17:16:33Z
#
thehive-get-caseGet a case
#
Base Commandthehive-get-case
#
InputArgument Name | Description | Required |
---|---|---|
id | ID of the case. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
TheHive.Cases._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.customFields | unknown | Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case. |
TheHive.Cases.caseId | number | The order of the case. |
TheHive.Cases.flag | boolean | A boolean flag used for filtering. |
TheHive.Cases.startDate | number | Datetime the case was started on, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.status | string | Status of the case. |
TheHive.Cases.owner | string | Owner of the case. |
TheHive.Cases.tlp | number | Traffic Light Protocol designation for the case. |
TheHive.Cases.title | string | Title of the case. |
TheHive.Cases.tags | unknown | Tags added to the case. |
TheHive.Cases._type | string | Type of the case. |
TheHive.Cases._version | number | The version of TheHive Project. |
TheHive.Cases.id | string | The ID of the case. |
TheHive.Cases.createdAt | number | Datetime the case was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.description | string | Description of the case. |
TheHive.Cases.severity | number | Severity of the case. |
TheHive.Cases.pap | number | Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed. |
TheHive.Cases.createdBy | string | The user who created the case. |
TheHive.Cases.tasks._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases.tasks._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.tasks.flag | boolean | A boolean flag used for filtering. |
TheHive.Cases.tasks.order | number | The order of the task. |
TheHive.Cases.tasks.status | string | Status of the task. |
TheHive.Cases.tasks.title | string | Title of the task. |
TheHive.Cases.tasks._type | string | Type of the task. |
TheHive.Cases.tasks._version | number | The version of TheHive Project. |
TheHive.Cases.tasks.id | string | The ID of the task. |
TheHive.Cases.tasks.createdAt | number | Datetime the task was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.createdBy | string | The user who created the task. |
TheHive.Cases.tasks.group | string | Group of the task. |
TheHive.Cases.tasks.logs.message | string | Log message. |
TheHive.Cases.tasks.logs._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases.tasks.logs._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.tasks.logs.startDate | number | Datetime the log was started on, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.logs.status | string | Status of the log. |
TheHive.Cases.tasks.logs.owner | string | Owner of the log. |
TheHive.Cases.tasks.logs._type | string | Type of the log. |
TheHive.Cases.tasks.logs._version | number | The version of TheHive Project. |
TheHive.Cases.tasks.logs.id | string | The ID of the log. |
TheHive.Cases.tasks.logs.createdAt | number | Datetime the task log was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.logs.createdBy | string | The user who created the log. |
#
Command Example!thehive-get-case id="~479312"
#
Context Example#
Human Readable Output#
TheHive Case ID ~479312
id title description createdAt ~479312 case with tasks case with tasks 2021-10-11T17:02:01Z
#
thehive-update-caseUpdate a case
#
Base Commandthehive-update-case
#
InputArgument Name | Description | Required |
---|---|---|
id | ID of the case. | Required |
title | Title of the case. | Optional |
description | Description of the case. | Optional |
severity | Severity of the case. Possible values are: 1, 2, 3. | Optional |
startDate | Datetime the case was started on, for example, 2018-06-29 08:15:27.243860. | Optional |
owner | Owner of the case. | Optional |
flag | A boolean flag used for filtering. Possible values are: true, false. | Optional |
tlp | Traffic Light Protocol designation for the case. Possible values are: WHITE, GREEN, AMBER, RED. | Optional |
tags | Tags added to the case. | Optional |
resolutionStatus | Resolution status of the case. Possible values are: Indeterminate, FalsePositive, TruePositive, Other, Duplicated. | Optional |
impactStatus | Impact status of the case. Possible values are: NoImpact, WithImpact, NotApplicable. | Optional |
summary | Summary of the case. | Optional |
endDate | Datetime the case ended, for example, 2018-06-29 08:15:27.243860. | Optional |
metrics | Metrics of the case. | Optional |
status | Status of the case. Possible values are: Open, Resolved, Deleted. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
TheHive.Cases._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.customFields | unknown | Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case. |
TheHive.Cases.caseId | number | The order of the case. |
TheHive.Cases.flag | boolean | A boolean flag used for filtering. |
TheHive.Cases.startDate | number | Datetime the case was started on, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.status | string | Status of the case. |
TheHive.Cases.owner | string | Owner of the case. |
TheHive.Cases.tlp | number | Traffic Light Protocol designation for the case. |
TheHive.Cases.title | string | Title of the case. |
TheHive.Cases.tags | unknown | Tags added to the case. |
TheHive.Cases._type | string | Type of the case. |
TheHive.Cases._version | number | The version of TheHive Project. |
TheHive.Cases.id | string | The ID of the case. |
TheHive.Cases.createdAt | number | Datetime the case was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.description | string | Description of the case. |
TheHive.Cases.severity | number | Severity of the case. |
TheHive.Cases.pap | number | Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed. |
TheHive.Cases.createdBy | string | The user who created the case. |
TheHive.Cases.tasks._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases.tasks._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.tasks.flag | boolean | A boolean flag used for filtering. |
TheHive.Cases.tasks.order | number | The order of the task. |
TheHive.Cases.tasks.status | string | Status of the task. |
TheHive.Cases.tasks.title | string | Title of the task. |
TheHive.Cases.tasks._type | string | Type of the task. |
TheHive.Cases.tasks._version | number | The version of TheHive Project. |
TheHive.Cases.tasks.id | string | The ID of the task. |
TheHive.Cases.tasks.createdAt | number | Datetime the task was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.createdBy | string | The user who created the task. |
TheHive.Cases.tasks.group | string | Group of the task. |
TheHive.Cases.tasks.logs.message | string | Log message. |
TheHive.Cases.tasks.logs._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases.tasks.logs._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.tasks.logs.startDate | number | Datetime the log was started on, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.logs.status | string | Status of the log. |
TheHive.Cases.tasks.logs.owner | string | Owner of the log. |
TheHive.Cases.tasks.logs._type | string | Type of the log. |
TheHive.Cases.tasks.logs._version | number | The version of TheHive Project. |
TheHive.Cases.tasks.logs.id | string | The ID of the log. |
TheHive.Cases.tasks.logs.createdAt | number | Datetime the task log was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.logs.createdBy | string | The user who created the log. |
#
Command Example!thehive-update-case id="~487504" title="updated title for case with no tasks"
#
Context Example#
Human Readable Output#
TheHive Update Case ID ~487504
id title description createdAt ~487504 updated title for case with no tasks case with no task 2021-10-11T17:02:34Z
#
thehive-create-caseCreate a new case
#
Base Commandthehive-create-case
#
InputArgument Name | Description | Required |
---|---|---|
title | Title of the case. | Required |
description | Description of the case. | Required |
severity | Severity of the case (default = 2). Possible values are: 1, 2, 3. | Optional |
startDate | Datetime the case was started on, for example, 2018-06-29 08:15:27.243860. | Optional |
owner | Owner of the case. | Required |
flag | A boolean flag used for filtering (default = false). Possible values are: false, true. | Optional |
tlp | Traffic Light Protocol designation for the case (default = 2). Possible values are: 0, 1, 2, 3. | Optional |
tags | Tags added to the case. | Optional |
resolutionStatus | Resolution status of the case. | Optional |
impactStatus | Impact status of the case. Possible values are: NoImpact, WithImpact, qNotApplicable. | Optional |
summary | Summary of the case. | Optional |
endDate | Datetime the case ended, for example, 2018-06-29 08:15:27.243860. | Optional |
metrics | Metrics of the case. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
TheHive.Cases._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.customFields | unknown | Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case. |
TheHive.Cases.caseId | number | The order of the case. |
TheHive.Cases.flag | boolean | A boolean flag used for filtering. |
TheHive.Cases.startDate | number | Datetime the case was started on, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.status | string | Status of the case. |
TheHive.Cases.owner | string | Owner of the case. |
TheHive.Cases.tlp | number | Traffic Light Protocol designation for the case. |
TheHive.Cases.title | string | Title of the case. |
TheHive.Cases.tags | unknown | Tags added to the case. |
TheHive.Cases._type | string | Type of the case. |
TheHive.Cases._version | number | The version of TheHive Project. |
TheHive.Cases.id | string | The ID of the case. |
TheHive.Cases.createdAt | number | Datetime the case was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.description | string | Description of the case. |
TheHive.Cases.severity | number | Severity of the case. |
TheHive.Cases.pap | number | Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed. |
TheHive.Cases.createdBy | string | The user who created the case. |
TheHive.Cases.tasks._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases.tasks._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.tasks.flag | boolean | A boolean flag used for filtering. |
TheHive.Cases.tasks.order | number | The order of the task. |
TheHive.Cases.tasks.status | string | Status of the task. |
TheHive.Cases.tasks.title | string | Title of the task. |
TheHive.Cases.tasks._type | string | Type of the task. |
TheHive.Cases.tasks._version | number | The version of TheHive Project. |
TheHive.Cases.tasks.id | string | The ID of the task. |
TheHive.Cases.tasks.createdAt | number | Datetime the task was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.createdBy | string | The user who created the task. |
TheHive.Cases.tasks.group | string | Group of the task. |
TheHive.Cases.tasks.logs.message | string | Log message. |
TheHive.Cases.tasks.logs._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases.tasks.logs._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.tasks.logs.startDate | number | Datetime the log was started on, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.logs.status | string | Status of the log. |
TheHive.Cases.tasks.logs.owner | string | Owner of the log. |
TheHive.Cases.tasks.logs._type | string | Type of the log. |
TheHive.Cases.tasks.logs._version | number | The version of TheHive Project. |
TheHive.Cases.tasks.logs.id | string | The ID of the log. |
TheHive.Cases.tasks.logs.createdAt | number | Datetime the task log was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.logs.createdBy | string | The user who created the log. |
#
Command Example!thehive-create-case title="new created case" description="description for new case" owner="owner"
#
Context Example#
Human Readable Output#
TheHive newly Created Case
id title description createdAt ~41492552 new created case description for new case 2021-10-11T17:36:40Z
#
thehive-create-taskCreate a new task
#
Base Commandthehive-create-task
#
InputArgument Name | Description | Required |
---|---|---|
id | Case ID. | Required |
title | Title of the case. | Required |
description | Description. | Optional |
startDate | Datetime the task was started on, for example, 2018-06-29 08:15:27.243860. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
TheHive.Tasks.status | string | Status of the task. |
TheHive.TasKs.title | string | Title of the task. |
TheHive.Tasks.id | string | The ID of the task. |
TheHive.Tasks.createdAt | number | Datetime the task was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Tasks._type | string | Type of the task. |
TheHive.Tasks.createdBy | string | The user who created the task. |
TheHive.Tasks.group | string | Group of the task. |
TheHive.Tasks.flag | boolean | A boolean flag used for filtering. |
TheHive.Tasks.order | int | The order of the task. |
#
Command Example!thehive-create-task id="~479312" title="newly added task" description="new description"
#
Context Example#
Human Readable Output#
The newly created task
id title createdAt status ~581640 newly added task 2021-10-11T17:36:42Z Waiting
#
thehive-remove-caseRemoves a case
#
Base Commandthehive-remove-case
#
InputArgument Name | Description | Required |
---|---|---|
id | Case ID. | Required |
permanent | Permanently removes the case (cannot be undone). Possible values are: false, true. Default is false. | Optional |
#
Context OutputThere is no context output for this command.
#
Command Examplethehive-remove-case id='~41496648'
#
Human Readable OutputCase ID ~41496648 removed successfully
#
thehive-merge-casesMerges 2 cases
#
Base Commandthehive-merge-cases
#
InputArgument Name | Description | Required |
---|---|---|
firstCaseID | ID of the first case. | Required |
secondCaseID | ID of the second case. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
TheHive.Cases._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.customFields | unknown | Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case. |
TheHive.Cases.caseId | number | The order of the case. |
TheHive.Cases.flag | boolean | A boolean flag used for filtering. |
TheHive.Cases.startDate | number | Datetime the case was started on, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.status | string | Status of the case. |
TheHive.Cases.owner | string | Owner of the case. |
TheHive.Cases.tlp | number | Traffic Light Protocol designation for the case. |
TheHive.Cases.title | string | Title of the case. |
TheHive.Cases.tags | unknown | Tags added to the case. |
TheHive.Cases._type | string | Type of the case. |
TheHive.Cases._version | number | The version of TheHive Project. |
TheHive.Cases.id | string | The ID of the case. |
TheHive.Cases.createdAt | number | Datetime the case was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.description | string | Description of the case. |
TheHive.Cases.severity | number | Severity of the case. |
TheHive.Cases.pap | number | Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed. |
TheHive.Cases.createdBy | string | The user who created the case. |
TheHive.Cases.tasks._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases.tasks._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.tasks.flag | boolean | A boolean flag used for filtering. |
TheHive.Cases.tasks.order | number | The order of the task. |
TheHive.Cases.tasks.status | string | Status of the task. |
TheHive.Cases.tasks.title | string | Title of the task. |
TheHive.Cases.tasks._type | string | Type of the task. |
TheHive.Cases.tasks._version | number | The version of TheHive Project. |
TheHive.Cases.tasks.id | string | The ID of the task. |
TheHive.Cases.tasks.createdAt | number | Datetime the task was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.createdBy | string | The user who created the task. |
TheHive.Cases.tasks.group | string | Group of the task. |
TheHive.Cases.tasks.logs.message | string | Log message. |
TheHive.Cases.tasks.logs._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Cases.tasks.logs._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Cases.tasks.logs.startDate | number | Datetime the log was started on, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.logs.status | string | Status of the log. |
TheHive.Cases.tasks.logs.owner | string | Owner of the log. |
TheHive.Cases.tasks.logs._type | string | Type of the log. |
TheHive.Cases.tasks.logs._version | number | The version of TheHive Project. |
TheHive.Cases.tasks.logs.id | string | The ID of the log. |
TheHive.Cases.tasks.logs.createdAt | number | Datetime the task log was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Cases.tasks.logs.createdBy | string | The user who created the log. |
#
Command Examplethehive-merge-cases firstCaseID=12402 secondCaseID=49683
#
Context Example#
Human Readable Output#
TheHive Linked Cases of ~413824
id title description createdAt ~41443480 new created case / new created case description for new case
description for new case2021-10-04T22:16:20Z
#
thehive-get-case-tasksGet the tasks of a case
#
Base Commandthehive-get-case-tasks
#
InputArgument Name | Description | Required |
---|---|---|
id | Case ID. | Required |
#
Context OutputThere is no context output for this command.
#
Command Example!thehive-get-case-tasks id="~479312"
#
Context Example#
Human Readable Output#
TheHive Tasks For Case ~479312
_id title _createdAt _createdBy status group ~585736 newly added task 2021-10-11T17:36:42Z adrugobitski@paloaltonetworks.com Waiting default ~581640 newly added task 2021-10-11T17:36:42Z adrugobitski@paloaltonetworks.com Waiting default ~41500824 task1 2021-10-11T17:02:01Z adrugobitski@paloaltonetworks.com Waiting default ~438408 task2 2021-10-11T17:02:01Z adrugobitski@paloaltonetworks.com Waiting default ~442504 task3 2021-10-11T17:02:01Z adrugobitski@paloaltonetworks.com Waiting default
#
thehive-get-taskGet a specific task.
#
Base Commandthehive-get-task
#
InputArgument Name | Description | Required |
---|---|---|
id | Task ID. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
TheHive.Tasks._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Tasks._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Tasks.flag | boolean | A boolean flag used for filtering. |
TheHive.Tasks.order | number | The order of the task. |
TheHive.Tasks.status | string | Status of the task. |
TheHive.Tasks.title | string | Title of the task. |
TheHive.Tasks._type | string | Type of the task. |
TheHive.Tasks._version | number | The version of TheHive Project. |
TheHive.Tasks.id | string | The ID of the task. |
TheHive.Tasks.createdAt | number | Datetime the task was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Tasks.createdBy | string | The user who created the task. |
TheHive.Tasks.group | string | Group of the task. |
TheHive.Tasks.logs.message | string | Log message. |
TheHive.Tasks.logs._routing | string | The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case. |
TheHive.Tasks.logs._parent | string | The direct parent level object which the current object belongs to. |
TheHive.Tasks.logs.startDate | number | Datetime the log was started on, for example, 2018-06-29 08:15:27.243860. |
TheHive.Tasks.logs.status | string | Status of the log. |
TheHive.Tasks.logs.owner | string | Owner of the log. |
TheHive.Tasks.logs._type | string | Type of the log. |
TheHive.Tasks.logs._version | number | The version of TheHive Project. |
TheHive.Tasks.logs.id | string | The ID of the log. |
TheHive.Tasks.logs.createdAt | number | Datetime the task log was created, for example, 2018-06-29 08:15:27.243860. |
TheHive.Tasks.logs.createdBy | string | The user who created the task. |
#
Command Example!thehive-get-task id="~41357336"
#
Human Readable OutputNo task found with id: ~41357336.
#
thehive-update-taskUpdates a task.
#
Base Commandthehive-update-task
#
InputArgument Name | Description | Required |
---|---|---|
id | Task ID. | Required |
title | Title of the task. | Optional |
status | Status of the task. Possible values are: Waiting, InProgress, Completed, Cancel. | Optional |
flag | A boolean flag used for filtering. Possible values are: false, true. | Optional |
owner | Owner of the task. | Optional |
startDate | Datetime the task was started on, for example, 2018-06-29 08:15:27.243860. | Optional |
endDate | Datetime the case ended, for example, 2018-06-29 08:15:27.243860. | Optional |
#
Context OutputThere is no context output for this command.
#
Command Example#
Human Readable Output#
thehive-update-observableUpdate an observable.
#
Base Commandthehive-update-observable
#
InputArgument Name | Description | Required |
---|---|---|
id | Observable ID. | Required |
message | Observable message. | Required |
tlp | Traffic Light Protocol designation for the observable. Possible values are: WHITE, GREEN, AMBER, RED. | Optional |
ioc | Is the observable an IOC?. Possible values are: true, false. | Optional |
status | Status of the observable. Possible values are: Ok, Deleted. | Optional |
#
Context OutputThere is no context output for this command.
#
Command Example!thehive-update-observable id="~41504920" message="updated message for observable"
#
Context Example#
Human Readable Output#
Updated Observable
id data dataType message ~41504920 domain updated message for observable
#
get-mapping-fieldsReturns the list of fields.
#
Base Commandget-mapping-fields
#
InputArgument Name | Description | Required |
---|
#
Context OutputThere is no context output for this command.
#
Command Example#
Human Readable Output#
thehive-get-versionDisplays the version of TheHive Project.
#
Base Commandthehive-get-version
#
InputArgument Name | Description | Required |
---|
#
Context OutputThere is no context output for this command.
#
Command Example!thehive-get-version
#
Human Readable Output4.1.4-1
#
get-modified-remote-dataGets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.
#
Base Commandget-modified-remote-data
#
InputArgument Name | Description | Required |
---|
#
Context OutputThere is no context output for this command.