TheHive Project

Integration with The Hive Project Security Incident Response Platform.

Case Management · TheHive Project

Configuration parameters

  • url — Host (required)
  • apiKey — API Key
  • credentials_api_key —
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — The maximum amount of incidents to fetch at once
  • mirror — Case mirroring (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_closed — Fetch closed cases
  • look_back — Advanced: Time in minutes to look back when fetching incidents and detections

Commands (24)

  • get-mapping-fields

    Returns the list of fields.

  • get-modified-remote-data

    Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.

  • get-remote-data

    Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

  • thehive-block-user

    Block a user.

  • thehive-create-case

    Create a new case.

  • thehive-create-local-user

    Create a new user.

  • thehive-create-observable

    Creates an observable.

  • thehive-create-task

    Create a new task.

  • thehive-get-attachment Deprecated

    Retrieves an attachment from a log.

  • thehive-get-case

    Get a case.

  • thehive-get-case-tasks

    Get the tasks of a case.

  • thehive-get-linked-cases Deprecated

    Get linked cases.

  • thehive-get-task

    Get a specific task.

  • thehive-get-user

    Get a single user.

  • thehive-get-version

    Displays the version of TheHive Project.

  • thehive-list-cases

    List cases.

  • thehive-list-observables

    List observables for a case.

  • thehive-list-users

    Get a list of users.

  • thehive-merge-cases

    Merges 2 cases.

  • thehive-remove-case

    Removes a case.

  • thehive-search-cases Deprecated

    Search cases.

  • thehive-update-case

    Update a case.

  • thehive-update-observable

    Update an observable.

  • thehive-update-task

    Updates a task.