TheHive Project

Integration with The Hive Project Security Incident Response Platform.

Category

Case Management

Pack

TheHiveProject

Configuration parameters

• url — Host (required)
• apiKey — API Key
• credentials_api_key —
• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
• max_fetch — The maximum amount of incidents to fetch at once
• mirror — Case mirroring (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• fetch_closed — Fetch closed cases
• look_back — Advanced: Time in minutes to look back when fetching incidents and detections

Commands (24)

• get-mapping-fields — Returns the list of fields.
• get-modified-remote-data — Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.
• get-remote-data — Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
• thehive-block-user — Block a user.
• thehive-create-case — Create a new case.
• thehive-create-local-user — Create a new user.
• thehive-create-observable — Creates an observable.
• thehive-create-task — Create a new task.
• thehive-get-attachment — Retrieves an attachment from a log.
• thehive-get-case — Get a case.
• thehive-get-case-tasks — Get the tasks of a case.
• thehive-get-linked-cases — Get linked cases.
• thehive-get-task — Get a specific task.
• thehive-get-user — Get a single user.
• thehive-get-version — Displays the version of TheHive Project.
• thehive-list-cases — List cases.
• thehive-list-observables — List observables for a case.
• thehive-list-users — Get a list of users.
• thehive-merge-cases — Merges 2 cases.
• thehive-remove-case — Removes a case.
• thehive-search-cases — Search cases.
• thehive-update-case — Update a case.
• thehive-update-observable — Update an observable.
• thehive-update-task — Updates a task.