TheHive Project

Integration with The Hive Project Security Incident Response Platform.

Case Management · TheHive Project

Details

IDTheHive Project
ProviderStrangeBee
CategoryCase Management
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Integration with The Hive Project Security Incident Response Platform.
This integration was integrated and tested with version 4.1.4 of TheHive Project

Configure TheHive Project in Cortex

Parameter Description Required
Host Ensure to include the port number with the URL (e.g. http://IP_OF_VM:9000) True
API Key   True
Fetch incidents   False
Incident type   False
Incidents Fetch Interval   False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False
The maximum amount of incidents to fetch at once   False
Case mirroring Select whether you would like cases to mirror in, out, in both directions or disabled. True
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

thehive-list-cases

List cases.

Base Command

thehive-list-cases

Input

Argument Name Description Required
limit Limit the number of returned results. Optional

Context Output

Path Type Description
TheHive.Cases._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.customFields unknown Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
TheHive.Cases.caseId number The order of the case.
TheHive.Cases.flag boolean A boolean flag used for filtering.
TheHive.Cases.startDate number Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.status string Status of the case.
TheHive.Cases.owner string Owner of the case.
TheHive.Cases.tlp number Traffic Light Protocol designation for the case.
TheHive.Cases.title string Title of the case.
TheHive.Cases.tags unknown Tags added to the case.
TheHive.Cases._type string Type of the case.
TheHive.Cases._version number The version of TheHive Project.
TheHive.Cases.id string The ID of the case.
TheHive.Cases.createdAt number Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.description string Description of the case.
TheHive.Cases.severity number Severity of the case.
TheHive.Cases.pap number Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
TheHive.Cases.createdBy string The user who created the case.
TheHive.Cases.tasks._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases.tasks._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.tasks.flag boolean A boolean flag used for filtering.
TheHive.Cases.tasks.order number The order of the task.
TheHive.Cases.tasks.status string Status of the task.
TheHive.Cases.tasks.title string Title of the task.
TheHive.Cases.tasks._type string Type of the task.
TheHive.Cases.tasks._version number The version of TheHive Project.
TheHive.Cases.tasks.id string The ID of the task.
TheHive.Cases.tasks.createdAt number Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.createdBy string The user who created the task.
TheHive.Cases.tasks.group string Group of the task.
TheHive.Cases.tasks.logs.message string Log message.
TheHive.Cases.tasks.logs._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases.tasks.logs._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.tasks.logs.startDate number Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.logs.status string Status of the log.
TheHive.Cases.tasks.logs.owner string Owner of the log.
TheHive.Cases.tasks.logs._type string Type of the log.
TheHive.Cases.tasks.logs._version number The version of TheHive Project.
TheHive.Cases.tasks.logs.id string The ID of the log.
TheHive.Cases.tasks.logs.createdAt number Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.logs.createdBy string The user who created the log.

Command Example


#### Context Example

```json
{
    "TheHive": {
        "Cases": [
            {
                "_id": "~479312",
                "_type": "case",
                "caseId": 1,
                "createdAt": "2021-10-11T17:02:01Z",
                "createdBy": "ad@example.com",
                "customFields": {},
                "description": "case with tasks",
                "endDate": null,
                "flag": false,
                "id": "~479312",
                "impactStatus": null,
                "instance": "TheHive Project_instance_1",
                "mirroring": "Both",
                "observables": [],
                "owner": "ad@example.com",
                "pap": 2,
                "permissions": [
                    "manageShare",
                    "manageAnalyse",
                    "manageTask",
                    "manageCaseTemplate",
                    "manageCase",
                    "manageUser",
                    "manageProcedure",
                    "managePage",
                    "manageObservable",
                    "manageTag",
                    "manageConfig",
                    "manageAlert",
                    "accessTheHiveFS",
                    "manageAction"
                ],
                "resolutionStatus": null,
                "severity": 2,
                "startDate": 1633971660000,
                "stats": {},
                "status": "Open",
                "summary": null,
                "tags": [],
                "tasks": [
                    {
                        "_createdAt": 1633971721834,
                        "_createdBy": "ad@example.com",
                        "_id": "~41500824",
                        "_type": "Task",
                        "extraData": {
                            "shareCount": 0
                        },
                        "flag": false,
                        "group": "default",
                        "logs": [],
                        "order": 0,
                        "status": "Waiting",
                        "title": "task1"
                    },
                    {
                        "_createdAt": 1633971721837,
                        "_createdBy": "ad@example.com",
                        "_id": "~438408",
                        "_type": "Task",
                        "extraData": {
                            "shareCount": 0
                        },
                        "flag": false,
                        "group": "default",
                        "logs": [],
                        "order": 0,
                        "status": "Waiting",
                        "title": "task2"
                    },
                    {
                        "_createdAt": 1633971721840,
                        "_createdBy": "ad@example.com",
                        "_id": "~442504",
                        "_type": "Task",
                        "extraData": {
                            "shareCount": 0
                        },
                        "flag": false,
                        "group": "default",
                        "logs": [],
                        "order": 0,
                        "status": "Waiting",
                        "title": "task3"
                    }
                ],
                "title": "case with tasks",
                "tlp": 2,
                "updatedAt": 1633971749765,
                "updatedBy": "ad@example.com"
            },
            {
                "_id": "~487504",
                "_type": "case",
                "caseId": 2,
                "createdAt": "2021-10-11T17:02:34Z",
                "createdBy": "ad@example.com",
                "customFields": {},
                "description": "case with no task",
                "endDate": null,
                "flag": false,
                "id": "~487504",
                "impactStatus": null,
                "instance": "TheHive Project_instance_1",
                "mirroring": "Both",
                "observables": [],
                "owner": "ad@example.com",
                "pap": 2,
                "permissions": [
                    "manageShare",
                    "manageAnalyse",
                    "manageTask",
                    "manageCaseTemplate",
                    "manageCase",
                    "manageUser",
                    "manageProcedure",
                    "managePage",
                    "manageObservable",
                    "manageTag",
                    "manageConfig",
                    "manageAlert",
                    "accessTheHiveFS",
                    "manageAction"
                ],
                "resolutionStatus": null,
                "severity": 2,
                "startDate": 1633971720000,
                "stats": {},
                "status": "Open",
                "summary": null,
                "tags": [],
                "tasks": [],
                "title": "no tasks case",
                "tlp": 2,
                "updatedAt": 1633971809110,
                "updatedBy": "ad@example.com"
            },
            {
                "_id": "~491600",
                "_type": "case",
                "caseId": 3,
                "createdAt": "2021-10-11T17:02:55Z",
                "createdBy": "ad@example.com",
                "customFields": {},
                "description": "case to merge",
                "endDate": null,
                "flag": false,
                "id": "~491600",
                "impactStatus": null,
                "instance": "TheHive Project_instance_1",
                "mirroring": "Both",
                "observables": [],
                "owner": "ad@example.com",
                "pap": 2,
                "permissions": [
                    "manageShare",
                    "manageAnalyse",
                    "manageTask",
                    "manageCaseTemplate",
                    "manageCase",
                    "manageUser",
                    "manageProcedure",
                    "managePage",
                    "manageObservable",
                    "manageTag",
                    "manageConfig",
                    "manageAlert",
                    "accessTheHiveFS",
                    "manageAction"
                ],
                "resolutionStatus": null,
                "severity": 2,
                "startDate": 1633971720000,
                "stats": {},
                "status": "Open",
                "summary": null,
                "tags": [],
                "tasks": [],
                "title": "merge 1",
                "tlp": 2,
                "updatedAt": 1633971809811,
                "updatedBy": "ad@example.com"
            },
            {
                "_id": "~524320",
                "_type": "case",
                "caseId": 4,
                "createdAt": "2021-10-11T17:03:12Z",
                "createdBy": "ad@example.com",
                "customFields": {},
                "description": "case to merge 2",
                "endDate": null,
                "flag": false,
                "id": "~524320",
                "impactStatus": null,
                "instance": "TheHive Project_instance_1",
                "mirroring": "Both",
                "observables": [],
                "owner": "ad@example.com",
                "pap": 2,
                "permissions": [
                    "manageShare",
                    "manageAnalyse",
                    "manageTask",
                    "manageCaseTemplate",
                    "manageCase",
                    "manageUser",
                    "manageProcedure",
                    "managePage",
                    "manageObservable",
                    "manageTag",
                    "manageConfig",
                    "manageAlert",
                    "accessTheHiveFS",
                    "manageAction"
                ],
                "resolutionStatus": null,
                "severity": 2,
                "startDate": 1633971720000,
                "stats": {},
                "status": "Open",
                "summary": null,
                "tags": [],
                "tasks": [],
                "title": "merge 2",
                "tlp": 2,
                "updatedAt": 1633971810562,
                "updatedBy": "ad@example.com"
            },
            {
                "_id": "~561160",
                "_type": "case",
                "caseId": 5,
                "createdAt": "2021-10-11T17:12:06Z",
                "createdBy": "ad@example.com",
                "customFields": {},
                "description": "case with observables",
                "endDate": null,
                "flag": false,
                "id": "~561160",
                "impactStatus": null,
                "instance": "TheHive Project_instance_1",
                "mirroring": "Both",
                "observables": [
                    {
                        "_createdAt": 1633972384854,
                        "_createdBy": "ad@example.com",
                        "_id": "~41504920",
                        "_type": "Observable",
                        "data": "google",
                        "dataType": "domain",
                        "extraData": {
                            "permissions": [
                                "manageShare",
                                "manageAnalyse",
                                "manageTask",
                                "manageCaseTemplate",
                                "manageCase",
                                "manageUser",
                                "manageProcedure",
                                "managePage",
                                "manageObservable",
                                "manageTag",
                                "manageConfig",
                                "manageAlert",
                                "accessTheHiveFS",
                                "manageAction"
                            ],
                            "seen": {
                                "ioc": false,
                                "seen": 0
                            },
                            "shareCount": 0
                        },
                        "ignoreSimilarity": false,
                        "ioc": false,
                        "message": "observable 2",
                        "reports": {},
                        "sighted": false,
                        "startDate": 1633972384854,
                        "tags": [],
                        "tlp": 1
                    },
                    {
                        "_createdAt": 1633972365905,
                        "_createdBy": "ad@example.com",
                        "_id": "~532512",
                        "_type": "Observable",
                        "data": "8.8.8.8",
                        "dataType": "ip",
                        "extraData": {
                            "permissions": [
                                "manageShare",
                                "manageAnalyse",
                                "manageTask",
                                "manageCaseTemplate",
                                "manageCase",
                                "manageUser",
                                "manageProcedure",
                                "managePage",
                                "manageObservable",
                                "manageTag",
                                "manageConfig",
                                "manageAlert",
                                "accessTheHiveFS",
                                "manageAction"
                            ],
                            "seen": {
                                "ioc": false,
                                "seen": 0
                            },
                            "shareCount": 0
                        },
                        "ignoreSimilarity": false,
                        "ioc": false,
                        "message": "observable 1",
                        "reports": {},
                        "sighted": false,
                        "startDate": 1633972365905,
                        "tags": [],
                        "tlp": 2
                    }
                ],
                "owner": "ad@example.com",
                "pap": 2,
                "permissions": [
                    "manageShare",
                    "manageAnalyse",
                    "manageTask",
                    "manageCaseTemplate",
                    "manageCase",
                    "manageUser",
                    "manageProcedure",
                    "managePage",
                    "manageObservable",
                    "manageTag",
                    "manageConfig",
                    "manageAlert",
                    "accessTheHiveFS",
                    "manageAction"
                ],
                "resolutionStatus": null,
                "severity": 2,
                "startDate": 1633972260000,
                "stats": {},
                "status": "Open",
                "summary": null,
                "tags": [],
                "tasks": [],
                "title": "observables case",
                "tlp": 2,
                "updatedAt": 1633972353588,
                "updatedBy": "ad@example.com"
            },
            {
                "_id": "~41509016",
                "_type": "case",
                "caseId": 6,
                "createdAt": "2021-10-11T17:16:33Z",
                "createdBy": "ad@example.com",
                "customFields": {},
                "description": "case to be removed",
                "endDate": null,
                "flag": false,
                "id": "~41509016",
                "impactStatus": null,
                "instance": "TheHive Project_instance_1",
                "mirroring": "Both",
                "observables": [],
                "owner": "ad@example.com",
                "pap": 2,
                "permissions": [
                    "manageShare",
                    "manageAnalyse",
                    "manageTask",
                    "manageCaseTemplate",
                    "manageCase",
                    "manageUser",
                    "manageProcedure",
                    "managePage",
                    "manageObservable",
                    "manageTag",
                    "manageConfig",
                    "manageAlert",
                    "accessTheHiveFS",
                    "manageAction"
                ],
                "resolutionStatus": null,
                "severity": 2,
                "startDate": 1633972560000,
                "stats": {},
                "status": "Open",
                "summary": null,
                "tags": [],
                "tasks": [],
                "title": "remove case",
                "tlp": 2,
                "updatedAt": 1633972648939,
                "updatedBy": "ad@example.com"
            }
        ]
    }
}

Human Readable Output

TheHive Cases

id title description createdAt
~479312 case with tasks case with tasks 2021-10-11T17:02:01Z
~487504 no tasks case case with no task 2021-10-11T17:02:34Z
~491600 merge 1 case to merge 2021-10-11T17:02:55Z
~524320 merge 2 case to merge 2 2021-10-11T17:03:12Z
~561160 observables case case with observables 2021-10-11T17:12:06Z
~41509016 remove case case to be removed 2021-10-11T17:16:33Z

thehive-get-case

Get a case

Base Command

thehive-get-case

Input

Argument Name Description Required
id ID of the case. Required

Context Output

Path Type Description
TheHive.Cases._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.customFields unknown Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
TheHive.Cases.caseId number The order of the case.
TheHive.Cases.flag boolean A boolean flag used for filtering.
TheHive.Cases.startDate number Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.status string Status of the case.
TheHive.Cases.owner string Owner of the case.
TheHive.Cases.tlp number Traffic Light Protocol designation for the case.
TheHive.Cases.title string Title of the case.
TheHive.Cases.tags unknown Tags added to the case.
TheHive.Cases._type string Type of the case.
TheHive.Cases._version number The version of TheHive Project.
TheHive.Cases.id string The ID of the case.
TheHive.Cases.createdAt number Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.description string Description of the case.
TheHive.Cases.severity number Severity of the case.
TheHive.Cases.pap number Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
TheHive.Cases.createdBy string The user who created the case.
TheHive.Cases.tasks._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases.tasks._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.tasks.flag boolean A boolean flag used for filtering.
TheHive.Cases.tasks.order number The order of the task.
TheHive.Cases.tasks.status string Status of the task.
TheHive.Cases.tasks.title string Title of the task.
TheHive.Cases.tasks._type string Type of the task.
TheHive.Cases.tasks._version number The version of TheHive Project.
TheHive.Cases.tasks.id string The ID of the task.
TheHive.Cases.tasks.createdAt number Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.createdBy string The user who created the task.
TheHive.Cases.tasks.group string Group of the task.
TheHive.Cases.tasks.logs.message string Log message.
TheHive.Cases.tasks.logs._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases.tasks.logs._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.tasks.logs.startDate number Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.logs.status string Status of the log.
TheHive.Cases.tasks.logs.owner string Owner of the log.
TheHive.Cases.tasks.logs._type string Type of the log.
TheHive.Cases.tasks.logs._version number The version of TheHive Project.
TheHive.Cases.tasks.logs.id string The ID of the log.
TheHive.Cases.tasks.logs.createdAt number Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.logs.createdBy string The user who created the log.

Command Example

!thehive-get-case id="~479312"

Context Example

{
    "TheHive": {
        "Cases": {
            "_id": "~479312",
            "_type": "case",
            "caseId": 1,
            "createdAt": "2021-10-11T17:02:01Z",
            "createdBy": "ad@example.com",
            "customFields": {},
            "description": "case with tasks",
            "endDate": null,
            "flag": false,
            "id": "~479312",
            "impactStatus": null,
            "observables": [],
            "owner": "ad@example.com",
            "pap": 2,
            "permissions": [
                "manageShare",
                "manageAnalyse",
                "manageTask",
                "manageCaseTemplate",
                "manageCase",
                "manageUser",
                "manageProcedure",
                "managePage",
                "manageObservable",
                "manageTag",
                "manageConfig",
                "manageAlert",
                "accessTheHiveFS",
                "manageAction"
            ],
            "resolutionStatus": null,
            "severity": 2,
            "startDate": 1633971660000,
            "stats": {},
            "status": "Open",
            "summary": null,
            "tags": [],
            "tasks": [
                {
                    "_createdAt": 1633971721834,
                    "_createdBy": "ad@example.com",
                    "_id": "~41500824",
                    "_type": "Task",
                    "extraData": {
                        "shareCount": 0
                    },
                    "flag": false,
                    "group": "default",
                    "logs": [],
                    "order": 0,
                    "status": "Waiting",
                    "title": "task1"
                },
                {
                    "_createdAt": 1633971721837,
                    "_createdBy": "ad@example.com",
                    "_id": "~438408",
                    "_type": "Task",
                    "extraData": {
                        "shareCount": 0
                    },
                    "flag": false,
                    "group": "default",
                    "logs": [],
                    "order": 0,
                    "status": "Waiting",
                    "title": "task2"
                },
                {
                    "_createdAt": 1633971721840,
                    "_createdBy": "ad@example.com",
                    "_id": "~442504",
                    "_type": "Task",
                    "extraData": {
                        "shareCount": 0
                    },
                    "flag": false,
                    "group": "default",
                    "logs": [],
                    "order": 0,
                    "status": "Waiting",
                    "title": "task3"
                }
            ],
            "title": "case with tasks",
            "tlp": 2,
            "updatedAt": 1633971749765,
            "updatedBy": "ad@example.com"
        }
    }
}

Human Readable Output

TheHive Case ID ~479312

id title description createdAt
~479312 case with tasks case with tasks 2021-10-11T17:02:01Z

thehive-update-case

Update a case

Base Command

thehive-update-case

Input

Argument Name Description Required
id ID of the case. Required
title Title of the case. Optional
description Description of the case. Optional
severity Severity of the case. Possible values are: 1, 2, 3. Optional
startDate Datetime the case was started on, for example, 2018-06-29 08:15:27.243860. Optional
owner Owner of the case. Optional
flag A boolean flag used for filtering. Possible values are: true, false. Optional
tlp Traffic Light Protocol designation for the case. Possible values are: WHITE, GREEN, AMBER, RED. Optional
tags Tags added to the case. Optional
resolutionStatus Resolution status of the case. Possible values are: Indeterminate, FalsePositive, TruePositive, Other, Duplicated. Optional
impactStatus Impact status of the case. Possible values are: NoImpact, WithImpact, NotApplicable. Optional
summary Summary of the case. Optional
endDate Datetime the case ended, for example, 2018-06-29 08:15:27.243860. Optional
metrics Metrics of the case. Optional
status Status of the case. Possible values are: Open, Resolved, Deleted. Optional

Context Output

Path Type Description
TheHive.Cases._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.customFields unknown Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
TheHive.Cases.caseId number The order of the case.
TheHive.Cases.flag boolean A boolean flag used for filtering.
TheHive.Cases.startDate number Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.status string Status of the case.
TheHive.Cases.owner string Owner of the case.
TheHive.Cases.tlp number Traffic Light Protocol designation for the case.
TheHive.Cases.title string Title of the case.
TheHive.Cases.tags unknown Tags added to the case.
TheHive.Cases._type string Type of the case.
TheHive.Cases._version number The version of TheHive Project.
TheHive.Cases.id string The ID of the case.
TheHive.Cases.createdAt number Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.description string Description of the case.
TheHive.Cases.severity number Severity of the case.
TheHive.Cases.pap number Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
TheHive.Cases.createdBy string The user who created the case.
TheHive.Cases.tasks._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases.tasks._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.tasks.flag boolean A boolean flag used for filtering.
TheHive.Cases.tasks.order number The order of the task.
TheHive.Cases.tasks.status string Status of the task.
TheHive.Cases.tasks.title string Title of the task.
TheHive.Cases.tasks._type string Type of the task.
TheHive.Cases.tasks._version number The version of TheHive Project.
TheHive.Cases.tasks.id string The ID of the task.
TheHive.Cases.tasks.createdAt number Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.createdBy string The user who created the task.
TheHive.Cases.tasks.group string Group of the task.
TheHive.Cases.tasks.logs.message string Log message.
TheHive.Cases.tasks.logs._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases.tasks.logs._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.tasks.logs.startDate number Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.logs.status string Status of the log.
TheHive.Cases.tasks.logs.owner string Owner of the log.
TheHive.Cases.tasks.logs._type string Type of the log.
TheHive.Cases.tasks.logs._version number The version of TheHive Project.
TheHive.Cases.tasks.logs.id string The ID of the log.
TheHive.Cases.tasks.logs.createdAt number Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.logs.createdBy string The user who created the log.

Command Example

!thehive-update-case id="~487504" title="updated title for case with no tasks"

Context Example

{
    "TheHive": {
        "Cases": {
            "_id": "~487504",
            "_type": "case",
            "caseId": 2,
            "createdAt": "2021-10-11T17:02:34Z",
            "createdBy": "ad@example.com",
            "customFields": {},
            "description": "case with no task",
            "endDate": null,
            "flag": false,
            "id": "~487504",
            "impactStatus": null,
            "owner": "ad@example.com",
            "pap": 2,
            "permissions": [
                "manageShare",
                "manageAnalyse",
                "manageTask",
                "manageCaseTemplate",
                "manageCase",
                "manageUser",
                "manageProcedure",
                "managePage",
                "manageObservable",
                "manageTag",
                "manageConfig",
                "manageAlert",
                "accessTheHiveFS",
                "manageAction"
            ],
            "resolutionStatus": null,
            "severity": 2,
            "startDate": 1633971720000,
            "stats": {},
            "status": "Open",
            "summary": null,
            "tags": [],
            "title": "updated title for case with no tasks",
            "tlp": 2,
            "updatedAt": 1633973798560,
            "updatedBy": "ad@example.com"
        }
    }
}

Human Readable Output

TheHive Update Case ID ~487504

id title description createdAt
~487504 updated title for case with no tasks case with no task 2021-10-11T17:02:34Z

thehive-create-case

Create a new case

Base Command

thehive-create-case

Input

Argument Name Description Required
title Title of the case. Required
description Description of the case. Required
severity Severity of the case (default = 2). Possible values are: 1, 2, 3. Optional
startDate Datetime the case was started on, for example, 2018-06-29 08:15:27.243860. Optional
owner Owner of the case. Required
flag A boolean flag used for filtering (default = false). Possible values are: false, true. Optional
tlp Traffic Light Protocol designation for the case (default = 2). Possible values are: 0, 1, 2, 3. Optional
tags Tags added to the case. Optional
resolutionStatus Resolution status of the case. Optional
impactStatus Impact status of the case. Possible values are: NoImpact, WithImpact, qNotApplicable. Optional
summary Summary of the case. Optional
endDate Datetime the case ended, for example, 2018-06-29 08:15:27.243860. Optional
metrics Metrics of the case. Optional

Context Output

Path Type Description
TheHive.Cases._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.customFields unknown Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
TheHive.Cases.caseId number The order of the case.
TheHive.Cases.flag boolean A boolean flag used for filtering.
TheHive.Cases.startDate number Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.status string Status of the case.
TheHive.Cases.owner string Owner of the case.
TheHive.Cases.tlp number Traffic Light Protocol designation for the case.
TheHive.Cases.title string Title of the case.
TheHive.Cases.tags unknown Tags added to the case.
TheHive.Cases._type string Type of the case.
TheHive.Cases._version number The version of TheHive Project.
TheHive.Cases.id string The ID of the case.
TheHive.Cases.createdAt number Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.description string Description of the case.
TheHive.Cases.severity number Severity of the case.
TheHive.Cases.pap number Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
TheHive.Cases.createdBy string The user who created the case.
TheHive.Cases.tasks._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases.tasks._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.tasks.flag boolean A boolean flag used for filtering.
TheHive.Cases.tasks.order number The order of the task.
TheHive.Cases.tasks.status string Status of the task.
TheHive.Cases.tasks.title string Title of the task.
TheHive.Cases.tasks._type string Type of the task.
TheHive.Cases.tasks._version number The version of TheHive Project.
TheHive.Cases.tasks.id string The ID of the task.
TheHive.Cases.tasks.createdAt number Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.createdBy string The user who created the task.
TheHive.Cases.tasks.group string Group of the task.
TheHive.Cases.tasks.logs.message string Log message.
TheHive.Cases.tasks.logs._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases.tasks.logs._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.tasks.logs.startDate number Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.logs.status string Status of the log.
TheHive.Cases.tasks.logs.owner string Owner of the log.
TheHive.Cases.tasks.logs._type string Type of the log.
TheHive.Cases.tasks.logs._version number The version of TheHive Project.
TheHive.Cases.tasks.logs.id string The ID of the log.
TheHive.Cases.tasks.logs.createdAt number Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.logs.createdBy string The user who created the log.

Command Example

!thehive-create-case title="new created case" description="description for new case" owner="owner"

Context Example

{
    "TheHive": {
        "Cases": [
            {
                "_id": "~41492552",
                "_type": "case",
                "caseId": 7,
                "createdAt": "2021-10-11T17:36:40Z",
                "createdBy": "ad@example.com",
                "customFields": {},
                "description": "description for new case",
                "endDate": null,
                "flag": false,
                "id": "~41492552",
                "impactStatus": null,
                "owner": "ad@example.com",
                "pap": 2,
                "permissions": [
                    "manageShare",
                    "manageAnalyse",
                    "manageTask",
                    "manageCaseTemplate",
                    "manageCase",
                    "manageUser",
                    "manageProcedure",
                    "managePage",
                    "manageObservable",
                    "manageTag",
                    "manageConfig",
                    "manageAlert",
                    "accessTheHiveFS",
                    "manageAction"
                ],
                "resolutionStatus": null,
                "severity": 2,
                "startDate": 1633973800326,
                "stats": {},
                "status": "Open",
                "summary": null,
                "tags": [],
                "title": "new created case",
                "tlp": 2,
                "updatedAt": null,
                "updatedBy": null
            },
            {
                "_id": "~41496648",
                "_type": "case",
                "caseId": 7,
                "createdAt": "2021-10-11T17:36:40Z",
                "createdBy": "ad@example.com",
                "customFields": {},
                "description": "description for new case",
                "endDate": null,
                "flag": false,
                "id": "~41496648",
                "impactStatus": null,
                "owner": "ad@example.com",
                "pap": 2,
                "permissions": [
                    "manageShare",
                    "manageAnalyse",
                    "manageTask",
                    "manageCaseTemplate",
                    "manageCase",
                    "manageUser",
                    "manageProcedure",
                    "managePage",
                    "manageObservable",
                    "manageTag",
                    "manageConfig",
                    "manageAlert",
                    "accessTheHiveFS",
                    "manageAction"
                ],
                "resolutionStatus": null,
                "severity": 2,
                "startDate": 1633973800334,
                "stats": {},
                "status": "Open",
                "summary": null,
                "tags": [],
                "title": "new created case",
                "tlp": 2,
                "updatedAt": null,
                "updatedBy": null
            }
        ]
    }
}

Human Readable Output

TheHive newly Created Case

id title description createdAt
~41492552 new created case description for new case 2021-10-11T17:36:40Z

thehive-create-task

Create a new task

Base Command

thehive-create-task

Input

Argument Name Description Required
id Case ID. Required
title Title of the case. Required
description Description. Optional
startDate Datetime the task was started on, for example, 2018-06-29 08:15:27.243860. Optional

Context Output

Path Type Description
TheHive.Tasks.status string Status of the task.
TheHive.TasKs.title string Title of the task.
TheHive.Tasks.id string The ID of the task.
TheHive.Tasks.createdAt number Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Tasks._type string Type of the task.
TheHive.Tasks.createdBy string The user who created the task.
TheHive.Tasks.group string Group of the task.
TheHive.Tasks.flag boolean A boolean flag used for filtering.
TheHive.Tasks.order int The order of the task.

Command Example

!thehive-create-task id="~479312" title="newly added task" description="new description"

Context Example

{
    "TheHive": {
        "Tasks": [
            {
                "_id": "~585736",
                "_type": "case_task",
                "createdAt": "2021-10-11T17:36:42Z",
                "createdBy": "ad@example.com",
                "description": "new description",
                "flag": false,
                "group": "default",
                "id": "~585736",
                "order": 0,
                "status": "Waiting",
                "title": "newly added task"
            },
            {
                "_id": "~581640",
                "_type": "case_task",
                "createdAt": "2021-10-11T17:36:42Z",
                "createdBy": "ad@example.com",
                "description": "new description",
                "flag": false,
                "group": "default",
                "id": "~581640",
                "order": 0,
                "status": "Waiting",
                "title": "newly added task"
            }
        ]
    }
}

Human Readable Output

The newly created task

id title createdAt status
~581640 newly added task 2021-10-11T17:36:42Z Waiting

thehive-remove-case

Removes a case

Base Command

thehive-remove-case

Input

Argument Name Description Required
id Case ID. Required
permanent Permanently removes the case (cannot be undone). Possible values are: false, true. Default is false. Optional

Context Output

There is no context output for this command.

Command Example

thehive-remove-case id='~41496648'

Human Readable Output

Case ID ~41496648 removed successfully

thehive-merge-cases

Merges 2 cases

Base Command

thehive-merge-cases

Input

Argument Name Description Required
firstCaseID ID of the first case. Required
secondCaseID ID of the second case. Required

Context Output

Path Type Description
TheHive.Cases._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.customFields unknown Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
TheHive.Cases.caseId number The order of the case.
TheHive.Cases.flag boolean A boolean flag used for filtering.
TheHive.Cases.startDate number Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.status string Status of the case.
TheHive.Cases.owner string Owner of the case.
TheHive.Cases.tlp number Traffic Light Protocol designation for the case.
TheHive.Cases.title string Title of the case.
TheHive.Cases.tags unknown Tags added to the case.
TheHive.Cases._type string Type of the case.
TheHive.Cases._version number The version of TheHive Project.
TheHive.Cases.id string The ID of the case.
TheHive.Cases.createdAt number Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.description string Description of the case.
TheHive.Cases.severity number Severity of the case.
TheHive.Cases.pap number Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
TheHive.Cases.createdBy string The user who created the case.
TheHive.Cases.tasks._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases.tasks._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.tasks.flag boolean A boolean flag used for filtering.
TheHive.Cases.tasks.order number The order of the task.
TheHive.Cases.tasks.status string Status of the task.
TheHive.Cases.tasks.title string Title of the task.
TheHive.Cases.tasks._type string Type of the task.
TheHive.Cases.tasks._version number The version of TheHive Project.
TheHive.Cases.tasks.id string The ID of the task.
TheHive.Cases.tasks.createdAt number Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.createdBy string The user who created the task.
TheHive.Cases.tasks.group string Group of the task.
TheHive.Cases.tasks.logs.message string Log message.
TheHive.Cases.tasks.logs._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Cases.tasks.logs._parent string The direct parent level object which the current object belongs to.
TheHive.Cases.tasks.logs.startDate number Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.logs.status string Status of the log.
TheHive.Cases.tasks.logs.owner string Owner of the log.
TheHive.Cases.tasks.logs._type string Type of the log.
TheHive.Cases.tasks.logs._version number The version of TheHive Project.
TheHive.Cases.tasks.logs.id string The ID of the log.
TheHive.Cases.tasks.logs.createdAt number Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Cases.tasks.logs.createdBy string The user who created the log.

Command Example

thehive-merge-cases firstCaseID=12402 secondCaseID=49683

Context Example

{
        "_id": "~41443480",
        "id": "~41443480",
        "createdBy": "ad@example.com",
        "updatedBy": null,
        "createdAt": 1633374980441,
        "updatedAt": null,
        "_type": "case",
        "caseId": 27,
        "title": "new created case / new created case",
        "description": "description for new case\n\ndescription for new case",
        "severity": 2,
        "startDate": 1632305365797,
        "endDate": null,
        "impactStatus": null,
        "resolutionStatus": null,
        "tags": [],
        "flag": false,
        "tlp": 2,
        "pap": 2,
        "status": "Open",
        "summary": null,
        "owner": "ad@example.com",
        "customFields": {},
        "stats": {},
        "permissions": [
            "manageShare", "manageAnalyse", "manageTask",
            "manageCaseTemplate", "manageCase", "manageUser",
            "manageProcedure", "managePage", "manageObservable",
            "manageTag", "manageConfig", "manageAlert",
            "accessTheHiveFS", "manageAction"
        ]}

Human Readable Output

TheHive Linked Cases of ~413824

id title description createdAt
~41443480 new created case / new created case description for new case

description for new case		 2021-10-04T22:16:20Z

thehive-get-case-tasks

Get the tasks of a case

Base Command

thehive-get-case-tasks

Input

Argument Name Description Required
id Case ID. Required

Context Output

There is no context output for this command.

Command Example

!thehive-get-case-tasks id="~479312"

Context Example

{
    "TheHive": {
        "Tasks": [
            {
                "_createdAt": "2021-10-11T17:36:42Z",
                "_createdBy": "ad@example.com",
                "_id": "~585736",
                "_type": "Task",
                "description": "new description",
                "extraData": {
                    "shareCount": 0
                },
                "flag": false,
                "group": "default",
                "logs": [],
                "order": 0,
                "status": "Waiting",
                "title": "newly added task"
            },
            {
                "_createdAt": "2021-10-11T17:36:42Z",
                "_createdBy": "ad@example.com",
                "_id": "~581640",
                "_type": "Task",
                "description": "new description",
                "extraData": {
                    "shareCount": 0
                },
                "flag": false,
                "group": "default",
                "logs": [],
                "order": 0,
                "status": "Waiting",
                "title": "newly added task"
            },
            {
                "_createdAt": "2021-10-11T17:02:01Z",
                "_createdBy": "ad@example.com",
                "_id": "~41500824",
                "_type": "Task",
                "extraData": {
                    "shareCount": 0
                },
                "flag": false,
                "group": "default",
                "logs": [],
                "order": 0,
                "status": "Waiting",
                "title": "task1"
            },
            {
                "_createdAt": "2021-10-11T17:02:01Z",
                "_createdBy": "ad@example.com",
                "_id": "~438408",
                "_type": "Task",
                "extraData": {
                    "shareCount": 0
                },
                "flag": false,
                "group": "default",
                "logs": [],
                "order": 0,
                "status": "Waiting",
                "title": "task2"
            },
            {
                "_createdAt": "2021-10-11T17:02:01Z",
                "_createdBy": "ad@example.com",
                "_id": "~442504",
                "_type": "Task",
                "extraData": {
                    "shareCount": 0
                },
                "flag": false,
                "group": "default",
                "logs": [],
                "order": 0,
                "status": "Waiting",
                "title": "task3"
            }
        ]
    }
}

Human Readable Output

TheHive Tasks For Case ~479312

_id title _createdAt _createdBy status group
~585736 newly added task 2021-10-11T17:36:42Z ad@example.com Waiting default
~581640 newly added task 2021-10-11T17:36:42Z ad@example.com Waiting default
~41500824 task1 2021-10-11T17:02:01Z ad@example.com Waiting default
~438408 task2 2021-10-11T17:02:01Z ad@example.com Waiting default
~442504 task3 2021-10-11T17:02:01Z ad@example.com Waiting default

thehive-get-task

Get a specific task.

Base Command

thehive-get-task

Input

Argument Name Description Required
id Task ID. Required

Context Output

Path Type Description
TheHive.Tasks._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Tasks._parent string The direct parent level object which the current object belongs to.
TheHive.Tasks.flag boolean A boolean flag used for filtering.
TheHive.Tasks.order number The order of the task.
TheHive.Tasks.status string Status of the task.
TheHive.Tasks.title string Title of the task.
TheHive.Tasks._type string Type of the task.
TheHive.Tasks._version number The version of TheHive Project.
TheHive.Tasks.id string The ID of the task.
TheHive.Tasks.createdAt number Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Tasks.createdBy string The user who created the task.
TheHive.Tasks.group string Group of the task.
TheHive.Tasks.logs.message string Log message.
TheHive.Tasks.logs._routing string The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
TheHive.Tasks.logs._parent string The direct parent level object which the current object belongs to.
TheHive.Tasks.logs.startDate number Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
TheHive.Tasks.logs.status string Status of the log.
TheHive.Tasks.logs.owner string Owner of the log.
TheHive.Tasks.logs._type string Type of the log.
TheHive.Tasks.logs._version number The version of TheHive Project.
TheHive.Tasks.logs.id string The ID of the log.
TheHive.Tasks.logs.createdAt number Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
TheHive.Tasks.logs.createdBy string The user who created the task.

Command Example

!thehive-get-task id="~41357336"

Human Readable Output

No task found with id: ~41357336.

thehive-update-task

Updates a task.

Base Command

thehive-update-task

Input

Argument Name Description Required
id Task ID. Required
title Title of the task. Optional
status Status of the task. Possible values are: Waiting, InProgress, Completed, Cancel. Optional
flag A boolean flag used for filtering. Possible values are: false, true. Optional
owner Owner of the task. Optional
startDate Datetime the task was started on, for example, 2018-06-29 08:15:27.243860. Optional
endDate Datetime the case ended, for example, 2018-06-29 08:15:27.243860. Optional

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

### thehive-list-users

***
Get a list of users.

#### Base Command

`thehive-list-users`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |

#### Context Output

There is no context output for this command.

#### Command Example

```!thehive-list-users```

#### Context Example

```json
{
    "TheHive": {
        "Users": [
            {
                "_id": "~8256",
                "_type": "user",
                "createdAt": "2021-04-21T08:27:32Z",
                "createdBy": "rrapoport@example.com",
                "hasKey": true,
                "id": "ad@example.com",
                "login": "ad@example.com",
                "name": "name API",
                "organisation": "name",
                "roles": [
                    "admin",
                    "write",
                    "read",
                    "alert"
                ],
                "status": "Ok"
            },
            {
                "_id": "~8440",
                "_type": "user",
                "createdAt": "2021-04-21T08:13:40Z",
                "createdBy": "admin@thehive.local",
                "hasKey": false,
                "id": "rrapoport@example.com",
                "login": "rrapoport@example.com",
                "name": "Roman Testov",
                "organisation": "name",
                "roles": [
                    "admin",
                    "write",
                    "read",
                    "alert"
                ],
                "status": "Ok"
            },
            {
                "_id": "~24712",
                "_type": "user",
                "createdAt": "2021-07-15T11:40:29Z",
                "createdBy": "ad@example.com",
                "hasKey": false,
                "id": "example@example.com",
                "login": "example@example.com",
                "name": "username",
                "organisation": "name",
                "roles": [
                    "read"
                ],
                "status": "Ok"
            },
            {
                "_id": "~28704",
                "_type": "user",
                "createdAt": "2021-07-15T12:06:57Z",
                "createdBy": "ad@example.com",
                "hasKey": false,
                "id": "example@example.com",
                "login": "example@example.com",
                "name": "usernamee",
                "organisation": "name",
                "roles": [
                    "read"
                ],
                "status": "Ok"
            },
            {
                "_id": "~32800",
                "_type": "user",
                "createdAt": "2021-07-15T12:16:53Z",
                "createdBy": "ad@example.com",
                "hasKey": false,
                "id": "new_example@example.com",
                "login": "new_example@example.com",
                "name": "user_name",
                "organisation": "name",
                "roles": [
                    "read"
                ],
                "status": "Ok"
            },
            {
                "_id": "~41208",
                "_type": "user",
                "createdAt": "2021-07-15T12:17:35Z",
                "createdBy": "ad@example.com",
                "hasKey": false,
                "id": "example_2@example.com",
                "login": "example_2@example.com",
                "name": "user_name_2",
                "organisation": "name",
                "roles": [
                    "read"
                ],
                "status": "Ok"
            },
            {
                "_id": "~422136",
                "_type": "user",
                "createdAt": "2021-09-22T10:27:48Z",
                "createdBy": "ad@example.com",
                "hasKey": false,
                "id": "name_login@thehive.local",
                "login": "name_login@thehive.local",
                "name": "dem_test",
                "organisation": "name",
                "roles": [
                    "read"
                ],
                "status": "Ok"
            },
            {
                "_id": "~41033880",
                "_type": "user",
                "createdAt": "2021-07-21T09:21:38Z",
                "createdBy": "ad@example.com",
                "hasKey": false,
                "id": "example_2@example.com",
                "login": "example_2@example.com",
                "name": "merit",
                "organisation": "name",
                "roles": [
                    "read"
                ],
                "status": "Ok"
            },
            {
                "_id": "~41402520",
                "_type": "user",
                "createdAt": "2021-09-22T10:32:01Z",
                "createdBy": "ad@example.com",
                "hasKey": false,
                "id": "test@example.com",
                "login": "test@example.com",
                "name": "testing",
                "organisation": "name",
                "roles": [
                    "read"
                ],
                "status": "Ok"
            }
        ]
    }
}
```

#### Human Readable Output

>### TheHive Users

>|id|name|roles|status|
>|---|---|---|---|
>| ad@example.com | name API | admin,<br/>write,<br/>read,<br/>alert | Ok |
>| rrapoport@example.com | Roman Testov | admin,<br/>write,<br/>read,<br/>alert | Ok |
>| example@example.com | username | read | Ok |
>| example@example.com | usernamee | read | Ok |
>| new_example@example.com | user_name | read | Ok |
>| test@example.com | user_name_2 | read | Ok |
>| name_login@thehive.local | dem_test | read | Ok |
>| example_2@example.com | merit | read | Ok |
>| test@example.com | testing | read | Ok |

### thehive-get-user

***
Get a single user

#### Base Command

`thehive-get-user`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | User ID. | Required |

#### Context Output

There is no context output for this command.

#### Command Example

```!thehive-get-user id="~41402520"```

#### Context Example

```json
{
    "TheHive": {
        "Users": {
            "_id": "~41402520",
            "_type": "user",
            "createdAt": "2021-09-22T10:32:01Z",
            "createdBy": "ad@example.com",
            "hasKey": false,
            "id": "test@example.com",
            "login": "test@example.com",
            "name": "testing",
            "organisation": "name",
            "roles": [
                "read"
            ],
            "status": "Ok"
        }
    }
}
```

#### Human Readable Output

>### TheHive User ID ~41402520

>|_id|name|roles|status|organisation|createdAt|
>|---|---|---|---|---|---|
>| ~41402520 | testing | read | Ok | name | 2021-09-22T10:32:01Z |

### thehive-create-local-user

***
Create a new user

#### Base Command

`thehive-create-local-user`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| login | Username login. | Required |
| name | Name of the user. | Required |
| roles | Roles (CSV: can be read, write, admin). Default is read. | Optional |
| password | Password. | Required |
| profile | Profile name (only used with TheHive Project v4 and onwards). | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!thehive-create-local-user login=name name=dem password=1234```

#### Context Example

```json
{
    "TheHive": {
        "Users": [
            {
                "_createdAt": 1633973834658,
                "_createdBy": "ad@example.com",
                "_id": "~593928",
                "hasKey": false,
                "hasMFA": false,
                "hasPassword": false,
                "locked": false,
                "login": "name@example.local",
                "name": "dem",
                "organisation": "name",
                "organisations": [],
                "permissions": [],
                "profile": "read-only"
            },
            {
                "_createdAt": 1633973834659,
                "_createdBy": "ad@example.com",
                "_id": "~598024",
                "hasKey": false,
                "hasMFA": false,
                "hasPassword": false,
                "locked": false,
                "login": "name@example.loc",
                "name": "dem",
                "organisation": "name",
                "organisations": [],
                "permissions": [],
                "profile": "read-only"
            }
        ]
    }
}
```

#### Human Readable Output

>### New User ~593928

>|_id|login|name|profile|
>|---|---|---|---|
>| ~593928 | name@example.local | dem | read-only |

### thehive-block-user

***
Block a user

#### Base Command

`thehive-block-user`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | User ID. | Required |

#### Context Output

There is no context output for this command.

#### Command Example

```!thehive-block-user id="~41208"```

#### Human Readable Output

>User "~41208" blocked successfully

### thehive-list-observables

***
List observables for a case.

#### Base Command

`thehive-list-observables`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | Case ID. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TheHive.Observables | string | List of observables for a case. |

#### Command Example

```!thehive-list-observables id="~561160"```

#### Context Example

```json
{
    "TheHive": {
        "Observables": [
            {
                "_createdAt": 1633972384854,
                "_createdBy": "ad@example.com",
                "_id": "~41504920",
                "_type": "Observable",
                "data": "google",
                "dataType": "domain",
                "extraData": {
                    "permissions": [
                        "manageShare",
                        "manageAnalyse",
                        "manageTask",
                        "manageCaseTemplate",
                        "manageCase",
                        "manageUser",
                        "manageProcedure",
                        "managePage",
                        "manageObservable",
                        "manageTag",
                        "manageConfig",
                        "manageAlert",
                        "accessTheHiveFS",
                        "manageAction"
                    ],
                    "seen": {
                        "ioc": false,
                        "seen": 0
                    },
                    "shareCount": 0
                },
                "ignoreSimilarity": false,
                "ioc": false,
                "message": "observable 2",
                "reports": {},
                "sighted": false,
                "startDate": 1633972384854,
                "tags": [],
                "tlp": 1
            },
            {
                "_createdAt": 1633972365905,
                "_createdBy": "ad@example.com",
                "_id": "~532512",
                "_type": "Observable",
                "data": "8.8.8.8",
                "dataType": "ip",
                "extraData": {
                    "permissions": [
                        "manageShare",
                        "manageAnalyse",
                        "manageTask",
                        "manageCaseTemplate",
                        "manageCase",
                        "manageUser",
                        "manageProcedure",
                        "managePage",
                        "manageObservable",
                        "manageTag",
                        "manageConfig",
                        "manageAlert",
                        "accessTheHiveFS",
                        "manageAction"
                    ],
                    "seen": {
                        "ioc": false,
                        "seen": 0
                    },
                    "shareCount": 0
                },
                "ignoreSimilarity": false,
                "ioc": false,
                "message": "observable 1",
                "reports": {},
                "sighted": false,
                "startDate": 1633972365905,
                "tags": [],
                "tlp": 2
            }
        ]
    }
}
```

#### Human Readable Output

>### Observables for Case ~561160

>|data|dataType|message|
>|---|---|---|
>| google | domain | observable 2 |
>| 8.8.8.8 | ip | observable 1 |

### thehive-create-observable

***
Creates an observable.

#### Base Command

`thehive-create-observable`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | Case ID. | Required |
| data | Data of the observable. | Required |
| dataType | Data type of the observable. Possible values are: autonomous-system, domain, file, filename, fqdn, hash, ip, mail, mail_subject, other, regexp, registry, uri_path, url, user-agent. Default is other. | Required |
| message | Observable message. | Required |
| startDate | Datetime the observable was started on, for example, 2018-06-29 08:15:27.243860. | Optional |
| tlp | Traffic Light Protocol designation for the observable. Possible values are: WHITE, GREEN, AMBER, RED. | Optional |
| ioc | Is the observable an IOC?. Possible values are: true, false. | Optional |
| status | Status of the observable. Possible values are: Ok, Deleted. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

Human Readable Output

thehive-update-observable

Update an observable.

Base Command

thehive-update-observable

Input

Argument Name Description Required
id Observable ID. Required
message Observable message. Required
tlp Traffic Light Protocol designation for the observable. Possible values are: WHITE, GREEN, AMBER, RED. Optional
ioc Is the observable an IOC?. Possible values are: true, false. Optional
status Status of the observable. Possible values are: Ok, Deleted. Optional

Context Output

There is no context output for this command.

Command Example

!thehive-update-observable id="~41504920" message="updated message for observable"

Context Example

{
    "TheHive": {
        "Observables": {
            "_id": "~41504920",
            "_type": "case_artifact",
            "createdAt": 1633972384854,
            "createdBy": "ad@example.com",
            "data": "google",
            "dataType": "domain",
            "id": "~41504920",
            "ignoreSimilarity": false,
            "ioc": false,
            "message": "updated message for observable",
            "reports": {},
            "sighted": false,
            "startDate": 1633972384854,
            "stats": {},
            "tags": [],
            "tlp": 1,
            "updatedAt": 1633973833004,
            "updatedBy": "ad@example.com"
        }
    }
}

Human Readable Output

Updated Observable

id data dataType message
~41504920 google domain updated message for observable

get-mapping-fields

Returns the list of fields.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

### get-remote-data

***
Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

#### Base Command

`get-remote-data`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | The ticket ID. | Required |
| lastUpdate | Retrieve entries that were created after lastUpdate. | Required |

#### Context Output

There is no context output for this command.

#### Command Example

Human Readable Output

thehive-get-version

Displays the version of TheHive Project.

Base Command

thehive-get-version

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

>4.1.4-1

### get-modified-remote-data

***
Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.

#### Base Command

`get-modified-remote-data`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |

#### Context Output

There is no context output for this command.

#### Command Example

Human Readable Output

Configuration parameters

  • url — Host (required)
  • apiKey — API Key
  • credentials_api_key —
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — The maximum amount of incidents to fetch at once
  • mirror — Case mirroring (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_closed — Fetch closed cases
  • look_back — Advanced: Time in minutes to look back when fetching incidents and detections

Commands (24)

  • get-mapping-fields

    Returns the list of fields.

  • get-modified-remote-data

    Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.

  • get-remote-data

    Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

  • thehive-block-user

    Block a user.

  • thehive-create-case

    Create a new case.

  • thehive-create-local-user

    Create a new user.

  • thehive-create-observable

    Creates an observable.

  • thehive-create-task

    Create a new task.

  • thehive-get-attachment Deprecated

    Retrieves an attachment from a log.

  • thehive-get-case

    Get a case.

  • thehive-get-case-tasks

    Get the tasks of a case.

  • thehive-get-linked-cases Deprecated

    Get linked cases.

  • thehive-get-task

    Get a specific task.

  • thehive-get-user

    Get a single user.

  • thehive-get-version

    Displays the version of TheHive Project.

  • thehive-list-cases

    List cases.

  • thehive-list-observables

    List observables for a case.

  • thehive-list-users

    Get a list of users.

  • thehive-merge-cases

    Merges 2 cases.

  • thehive-remove-case

    Removes a case.

  • thehive-search-cases Deprecated

    Search cases.

  • thehive-update-case

    Update a case.

  • thehive-update-observable

    Update an observable.

  • thehive-update-task

    Updates a task.

Source

TheHiveProject.py TheHiveProject_test.py TheHiveProject.yml TheHiveProject_description.md command_examples.txt
Download History Raw 
commonfields:
  id: TheHive Project
  version: -1
sectionorder:
- Connect
- Collect
name: TheHive Project
display: TheHive Project
category: Case Management
provider: StrangeBee
description: Integration with The Hive Project Security Incident Response Platform.
configuration:
- display: Host
  name: url
  defaultvalue: http://IP_OF_VM:9000
  type: 0
  required: true
  additionalinfo: Ensure to include the port number with the URL (e.g. http://IP_OF_VM:9000)
  section: Connect
- display: API Key
  name: apiKey
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: API Key
  name: credentials_api_key
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
  section: Collect
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  defaultvalue: 7 days
  required: false
  section: Collect
- defaultvalue: '50'
  display: The maximum amount of incidents to fetch at once
  name: max_fetch
  type: 0
  required: false
  section: Collect
- display: Case mirroring
  name: mirror
  type: 15
  required: true
  options:
  - Disabled
  - In
  - Out
  - Both
  additionalinfo: Select whether you would like cases to mirror in, out, in both directions or disabled.
  hidden:
  - marketplacev2
  - platform
  defaultvalue: Disabled
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch closed cases
  name: fetch_closed
  type: 8
  required: false
  section: Collect
- additionalinfo: Use this parameter to determine how long backward to look in the search for incidents that were created before the last run time and did not match the query when they were created.
  defaultvalue: 0
  display: 'Advanced: Time in minutes to look back when fetching incidents and detections'
  name: look_back
  type: 0
  advanced: true
  required: false
  section: Collect
script:
  script: ''
  type: python
  commands:
  - name: thehive-list-cases
    arguments:
    - name: limit
      description: Limit the number of returned results.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: List cases.
  - name: thehive-get-case
    arguments:
    - name: id
      required: true
      description: ID of the case.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: Get a case.
  - name: thehive-search-cases
    deprecated: true
    arguments:
    - name: title
      description: Title of the case.
    - name: description
      description: Description of the case.
    - name: severity
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      - "3"
      description: 'Severity of the case (default = 2: medium).'
    - name: startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
    - name: owner
      description: Owner of the case.
    - name: flag
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: A boolean flag used for filtering (default is false).
    - name: tlp
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      - "2"
      - "3"
      description: 'Traffic Light Protocol designation for the case (default is 2: amber).'
    - name: tags
      description: Tags added to the case.
    - name: resolutionStatus
      auto: PREDEFINED
      predefined:
      - Indeterminate
      - FalsePositive
      - TruePositive
      - Other
      - Duplicated
      description: Resolution status of the case (Indeterminate, FalsePositive, TruePositive, Other or Duplicated).
    - name: impactStatus
      auto: PREDEFINED
      predefined:
      - NoImpact
      - WithImpact
      - NotApplicable
      description: Impact status of the case.
    - name: summary
      description: Summary of the case.
    - name: endDate
      description: Datetime the case ended, for example, 2018-06-29 08:15:27.243860.
    - name: metrics
      description: Metrics of the case.
    - name: query
      description: Raw query (for use with v4 of TheHive Project and upwards).
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: Search cases.
  - name: thehive-update-case
    arguments:
    - name: id
      required: true
      description: ID of the case.
    - name: title
      description: Title of the case.
    - name: description
      description: Description of the case.
    - name: severity
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      - "3"
      description: Severity of the case.
    - name: startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
    - name: owner
      description: Owner of the case.
    - name: flag
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: A boolean flag used for filtering.
    - name: tlp
      auto: PREDEFINED
      predefined:
      - WHITE
      - GREEN
      - AMBER
      - RED
      description: Traffic Light Protocol designation for the case.
    - name: tags
      description: Tags added to the case.
    - name: resolutionStatus
      auto: PREDEFINED
      predefined:
      - Indeterminate
      - FalsePositive
      - TruePositive
      - Other
      - Duplicated
      description: Resolution status of the case.
    - name: impactStatus
      auto: PREDEFINED
      predefined:
      - NoImpact
      - WithImpact
      - NotApplicable
      description: Impact status of the case.
    - name: summary
      description: Summary of the case.
    - name: endDate
      description: Datetime the case ended, for example, 2018-06-29 08:15:27.243860.
    - name: metrics
      description: Metrics of the case.
    - name: status
      auto: PREDEFINED
      predefined:
      - Open
      - Resolved
      - Deleted
      description: Status of the case.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: Update a case.
  - name: thehive-create-case
    arguments:
    - name: title
      required: true
      description: Title of the case.
    - name: description
      required: true
      description: Description of the case.
    - name: severity
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      - "3"
      description: Severity of the case (default = 2).
    - name: startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
    - name: owner
      required: true
      description: Owner of the case.
    - name: flag
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: A boolean flag used for filtering (default = false).
    - name: tlp
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      - "2"
      - "3"
      description: Traffic Light Protocol designation for the case (default = 2).
    - name: tags
      description: Tags added to the case.
    - name: resolutionStatus
      description: Resolution status of the case.
    - name: impactStatus
      auto: PREDEFINED
      predefined:
      - NoImpact
      - WithImpact
      - qNotApplicable
      description: Impact status of the case.
    - name: summary
      description: Summary of the case.
    - name: endDate
      description: Datetime the case ended, for example, 2018-06-29 08:15:27.243860.
    - name: metrics
      description: Metrics of the case.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: Create a new case.
  - name: thehive-create-task
    arguments:
    - name: id
      required: true
      description: Case ID.
    - name: title
      required: true
      description: Title of the case.
    - name: description
      description: Description.
    - name: startDate
      description: Datetime the task was started on, for example, 2018-06-29 08:15:27.243860.
    outputs:
    - contextPath: TheHive.Tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.TasKs.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Tasks.order
      description: The order of the task.
      type: int
    description: Create a new task.
  - name: thehive-remove-case
    arguments:
    - name: id
      required: true
      description: Case ID.
    - name: permanent
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Permanently removes the case (cannot be undone).
      defaultValue: "false"
    description: Removes a case.
  - name: thehive-get-linked-cases
    deprecated: true
    arguments:
    - name: id
      required: true
      description: Case ID.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    description: Get linked cases.
  - name: thehive-merge-cases
    arguments:
    - name: firstCaseID
      required: true
      description: ID of the first case.
    - name: secondCaseID
      required: true
      description: ID of the second case.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: Merges 2 cases.
  - name: thehive-get-case-tasks
    arguments:
    - name: id
      required: true
      description: Case ID.
    description: Get the tasks of a case.
  - name: thehive-get-task
    arguments:
    - name: id
      required: true
      description: Task ID.
    outputs:
    - contextPath: TheHive.Tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Tasks.logs.createdBy
      description: The user who created the task.
      type: string
    description: Get a specific task.
  - name: thehive-get-attachment
    deprecated: true
    arguments:
    - name: id
      required: true
      description: Attachmenmt ID.
    - name: name
      required: true
      description: Attachment Name.
    description: Retrieves an attachment from a log.
  - name: thehive-update-task
    arguments:
    - name: id
      required: true
      description: Task ID.
    - name: title
      description: Title of the task.
    - name: status
      auto: PREDEFINED
      predefined:
      - Waiting
      - InProgress
      - Completed
      - Cancel
      description: Status of the task.
    - name: flag
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: A boolean flag used for filtering.
    - name: owner
      description: Owner of the task.
    - name: startDate
      description: Datetime the task was started on, for example, 2018-06-29 08:15:27.243860.
    - name: endDate
      description: Datetime the case ended, for example, 2018-06-29 08:15:27.243860.
    description: Updates a task.
  - name: thehive-list-users
    arguments: []
    description: Get a list of users.
  - name: thehive-get-user
    arguments:
    - name: id
      required: true
      description: User ID.
    description: Get a single user.
  - name: thehive-create-local-user
    arguments:
    - name: login
      required: true
      description: Username login.
    - name: name
      required: true
      description: Name of the user.
    - name: roles
      description: 'Roles (CSV: can be read, write, admin).'
      defaultValue: read
    - name: password
      required: true
      description: Password.
    - name: profile
      description: Profile name (only used with TheHive Project v4 and onwards).
    description: Create a new user.
  - name: thehive-block-user
    arguments:
    - name: id
      required: true
      description: User ID.
    description: Block a user.
  - name: thehive-list-observables
    arguments:
    - name: id
      description: Case ID.
      required: true
    description: List observables for a case.
    outputs:
    - contextPath: TheHive.Observables
      description: List of observables for a case.
      type: string
  - name: thehive-create-observable
    arguments:
    - name: id
      required: true
      description: Case ID.
    - name: data
      required: true
      description: Data of the observable.
    - name: dataType
      required: true
      auto: PREDEFINED
      predefined:
      - autonomous-system
      - domain
      - file
      - filename
      - fqdn
      - hash
      - ip
      - mail
      - mail_subject
      - other
      - regexp
      - registry
      - uri_path
      - url
      - user-agent
      description: Data type of the observable.
      defaultValue: other
    - name: message
      required: true
      description: Observable message.
    - name: startDate
      description: Datetime the observable was started on, for example, 2018-06-29 08:15:27.243860.
    - name: tlp
      auto: PREDEFINED
      predefined:
      - WHITE
      - GREEN
      - AMBER
      - RED
      description: Traffic Light Protocol designation for the observable.
    - name: ioc
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Is the observable an IOC?
    - name: status
      auto: PREDEFINED
      predefined:
      - Ok
      - Deleted
      description: Status of the observable.
    description: Creates an observable.
  - name: thehive-update-observable
    arguments:
    - name: id
      required: true
      description: Observable ID.
    - name: message
      required: true
      description: Observable message.
    - name: tlp
      auto: PREDEFINED
      predefined:
      - WHITE
      - GREEN
      - AMBER
      - RED
      description: Traffic Light Protocol designation for the observable.
    - name: ioc
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Is the observable an IOC?
    - name: status
      auto: PREDEFINED
      predefined:
      - Ok
      - Deleted
      description: Status of the observable.
    description: Update an observable.
  - name: get-mapping-fields
    arguments: []
    description: Returns the list of fields.
  - name: get-remote-data
    arguments:
    - name: id
      required: true
      description: The ticket ID.
    - name: lastUpdate
      required: true
      description: Retrieve entries that were created after lastUpdate.
    description: Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
  - name: thehive-get-version
    arguments: []
    description: Displays the version of TheHive Project.
  - name: get-modified-remote-data
    arguments: []
    description: Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  subtype: python3
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
fromversion: 6.0.0
tests:
- Playbook_TheHiveProject_Test