commonfields:
  id: TheHive Project
  version: -1
sectionorder:
- Connect
- Collect
name: TheHive Project
display: TheHive Project
category: Case Management
provider: StrangeBee
description: Integration with The Hive Project Security Incident Response Platform.
configuration:
- display: Host
  name: url
  defaultvalue: http://IP_OF_VM:9000
  type: 0
  required: true
  additionalinfo: Ensure to include the port number with the URL (e.g. http://IP_OF_VM:9000)
  section: Connect
- display: API Key
  name: apiKey
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: API Key
  name: credentials_api_key
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
  section: Collect
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  defaultvalue: 7 days
  required: false
  section: Collect
- defaultvalue: '50'
  display: The maximum amount of incidents to fetch at once
  name: max_fetch
  type: 0
  required: false
  section: Collect
- display: Case mirroring
  name: mirror
  type: 15
  required: true
  options:
  - Disabled
  - In
  - Out
  - Both
  additionalinfo: Select whether you would like cases to mirror in, out, in both directions or disabled.
  hidden:
  - marketplacev2
  - platform
  defaultvalue: Disabled
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch closed cases
  name: fetch_closed
  type: 8
  required: false
  section: Collect
- additionalinfo: Use this parameter to determine how long backward to look in the search for incidents that were created before the last run time and did not match the query when they were created.
  defaultvalue: 0
  display: 'Advanced: Time in minutes to look back when fetching incidents and detections'
  name: look_back
  type: 0
  advanced: true
  required: false
  section: Collect
script:
  script: ''
  type: python
  commands:
  - name: thehive-list-cases
    arguments:
    - name: limit
      description: Limit the number of returned results.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: List cases.
  - name: thehive-get-case
    arguments:
    - name: id
      required: true
      description: ID of the case.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: Get a case.
  - name: thehive-search-cases
    deprecated: true
    arguments:
    - name: title
      description: Title of the case.
    - name: description
      description: Description of the case.
    - name: severity
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      - "3"
      description: 'Severity of the case (default = 2: medium).'
    - name: startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
    - name: owner
      description: Owner of the case.
    - name: flag
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: A boolean flag used for filtering (default is false).
    - name: tlp
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      - "2"
      - "3"
      description: 'Traffic Light Protocol designation for the case (default is 2: amber).'
    - name: tags
      description: Tags added to the case.
    - name: resolutionStatus
      auto: PREDEFINED
      predefined:
      - Indeterminate
      - FalsePositive
      - TruePositive
      - Other
      - Duplicated
      description: Resolution status of the case (Indeterminate, FalsePositive, TruePositive, Other or Duplicated).
    - name: impactStatus
      auto: PREDEFINED
      predefined:
      - NoImpact
      - WithImpact
      - NotApplicable
      description: Impact status of the case.
    - name: summary
      description: Summary of the case.
    - name: endDate
      description: Datetime the case ended, for example, 2018-06-29 08:15:27.243860.
    - name: metrics
      description: Metrics of the case.
    - name: query
      description: Raw query (for use with v4 of TheHive Project and upwards).
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: Search cases.
  - name: thehive-update-case
    arguments:
    - name: id
      required: true
      description: ID of the case.
    - name: title
      description: Title of the case.
    - name: description
      description: Description of the case.
    - name: severity
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      - "3"
      description: Severity of the case.
    - name: startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
    - name: owner
      description: Owner of the case.
    - name: flag
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: A boolean flag used for filtering.
    - name: tlp
      auto: PREDEFINED
      predefined:
      - WHITE
      - GREEN
      - AMBER
      - RED
      description: Traffic Light Protocol designation for the case.
    - name: tags
      description: Tags added to the case.
    - name: resolutionStatus
      auto: PREDEFINED
      predefined:
      - Indeterminate
      - FalsePositive
      - TruePositive
      - Other
      - Duplicated
      description: Resolution status of the case.
    - name: impactStatus
      auto: PREDEFINED
      predefined:
      - NoImpact
      - WithImpact
      - NotApplicable
      description: Impact status of the case.
    - name: summary
      description: Summary of the case.
    - name: endDate
      description: Datetime the case ended, for example, 2018-06-29 08:15:27.243860.
    - name: metrics
      description: Metrics of the case.
    - name: status
      auto: PREDEFINED
      predefined:
      - Open
      - Resolved
      - Deleted
      description: Status of the case.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: Update a case.
  - name: thehive-create-case
    arguments:
    - name: title
      required: true
      description: Title of the case.
    - name: description
      required: true
      description: Description of the case.
    - name: severity
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      - "3"
      description: Severity of the case (default = 2).
    - name: startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
    - name: owner
      required: true
      description: Owner of the case.
    - name: flag
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: A boolean flag used for filtering (default = false).
    - name: tlp
      auto: PREDEFINED
      predefined:
      - "0"
      - "1"
      - "2"
      - "3"
      description: Traffic Light Protocol designation for the case (default = 2).
    - name: tags
      description: Tags added to the case.
    - name: resolutionStatus
      description: Resolution status of the case.
    - name: impactStatus
      auto: PREDEFINED
      predefined:
      - NoImpact
      - WithImpact
      - qNotApplicable
      description: Impact status of the case.
    - name: summary
      description: Summary of the case.
    - name: endDate
      description: Datetime the case ended, for example, 2018-06-29 08:15:27.243860.
    - name: metrics
      description: Metrics of the case.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: Create a new case.
  - name: thehive-create-task
    arguments:
    - name: id
      required: true
      description: Case ID.
    - name: title
      required: true
      description: Title of the case.
    - name: description
      description: Description.
    - name: startDate
      description: Datetime the task was started on, for example, 2018-06-29 08:15:27.243860.
    outputs:
    - contextPath: TheHive.Tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.TasKs.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Tasks.order
      description: The order of the task.
      type: int
    description: Create a new task.
  - name: thehive-remove-case
    arguments:
    - name: id
      required: true
      description: Case ID.
    - name: permanent
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Permanently removes the case (cannot be undone).
      defaultValue: "false"
    description: Removes a case.
  - name: thehive-get-linked-cases
    deprecated: true
    arguments:
    - name: id
      required: true
      description: Case ID.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    description: Get linked cases.
  - name: thehive-merge-cases
    arguments:
    - name: firstCaseID
      required: true
      description: ID of the first case.
    - name: secondCaseID
      required: true
      description: ID of the second case.
    outputs:
    - contextPath: TheHive.Cases._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.customFields
      description: Any fields that the user of TheHiveProject has added to the platform and filled in as part of a case.
    - contextPath: TheHive.Cases.caseId
      description: The order of the case.
      type: number
    - contextPath: TheHive.Cases.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.startDate
      description: Datetime the case was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.status
      description: Status of the case.
      type: string
    - contextPath: TheHive.Cases.owner
      description: Owner of the case.
      type: string
    - contextPath: TheHive.Cases.tlp
      description: Traffic Light Protocol designation for the case.
      type: number
    - contextPath: TheHive.Cases.title
      description: Title of the case.
      type: string
    - contextPath: TheHive.Cases.tags
      description: Tags added to the case.
    - contextPath: TheHive.Cases._type
      description: Type of the case.
      type: string
    - contextPath: TheHive.Cases._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.id
      description: The ID of the case.
      type: string
    - contextPath: TheHive.Cases.createdAt
      description: Datetime the case was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.description
      description: Description of the case.
      type: string
    - contextPath: TheHive.Cases.severity
      description: Severity of the case.
      type: number
    - contextPath: TheHive.Cases.pap
      description: Permissible Actions Protocol (PAP), used to indicate what kind of action is allowed.
      type: number
    - contextPath: TheHive.Cases.createdBy
      description: The user who created the case.
      type: string
    - contextPath: TheHive.Cases.tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Cases.tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Cases.tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Cases.tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Cases.tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Cases.tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Cases.tasks.logs.createdBy
      description: The user who created the log.
      type: string
    description: Merges 2 cases.
  - name: thehive-get-case-tasks
    arguments:
    - name: id
      required: true
      description: Case ID.
    description: Get the tasks of a case.
  - name: thehive-get-task
    arguments:
    - name: id
      required: true
      description: Task ID.
    outputs:
    - contextPath: TheHive.Tasks._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Tasks._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Tasks.flag
      description: A boolean flag used for filtering.
      type: boolean
    - contextPath: TheHive.Tasks.order
      description: The order of the task.
      type: number
    - contextPath: TheHive.Tasks.status
      description: Status of the task.
      type: string
    - contextPath: TheHive.Tasks.title
      description: Title of the task.
      type: string
    - contextPath: TheHive.Tasks._type
      description: Type of the task.
      type: string
    - contextPath: TheHive.Tasks._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Tasks.id
      description: The ID of the task.
      type: string
    - contextPath: TheHive.Tasks.createdAt
      description: Datetime the task was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Tasks.createdBy
      description: The user who created the task.
      type: string
    - contextPath: TheHive.Tasks.group
      description: Group of the task.
      type: string
    - contextPath: TheHive.Tasks.logs.message
      description: Log message.
      type: string
    - contextPath: TheHive.Tasks.logs._routing
      description: The root level object which the current object belongs to. For example, a log entry is part of a task, which is part of a case. The _routing in this example would point to the ID of the case.
      type: string
    - contextPath: TheHive.Tasks.logs._parent
      description: The direct parent level object which the current object belongs to.
      type: string
    - contextPath: TheHive.Tasks.logs.startDate
      description: Datetime the log was started on, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Tasks.logs.status
      description: Status of the log.
      type: string
    - contextPath: TheHive.Tasks.logs.owner
      description: Owner of the log.
      type: string
    - contextPath: TheHive.Tasks.logs._type
      description: Type of the log.
      type: string
    - contextPath: TheHive.Tasks.logs._version
      description: The version of TheHive Project.
      type: number
    - contextPath: TheHive.Tasks.logs.id
      description: The ID of the log.
      type: string
    - contextPath: TheHive.Tasks.logs.createdAt
      description: Datetime the task log was created, for example, 2018-06-29 08:15:27.243860.
      type: number
    - contextPath: TheHive.Tasks.logs.createdBy
      description: The user who created the task.
      type: string
    description: Get a specific task.
  - name: thehive-get-attachment
    deprecated: true
    arguments:
    - name: id
      required: true
      description: Attachmenmt ID.
    - name: name
      required: true
      description: Attachment Name.
    description: Retrieves an attachment from a log.
  - name: thehive-update-task
    arguments:
    - name: id
      required: true
      description: Task ID.
    - name: title
      description: Title of the task.
    - name: status
      auto: PREDEFINED
      predefined:
      - Waiting
      - InProgress
      - Completed
      - Cancel
      description: Status of the task.
    - name: flag
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: A boolean flag used for filtering.
    - name: owner
      description: Owner of the task.
    - name: startDate
      description: Datetime the task was started on, for example, 2018-06-29 08:15:27.243860.
    - name: endDate
      description: Datetime the case ended, for example, 2018-06-29 08:15:27.243860.
    description: Updates a task.
  - name: thehive-list-users
    arguments: []
    description: Get a list of users.
  - name: thehive-get-user
    arguments:
    - name: id
      required: true
      description: User ID.
    description: Get a single user.
  - name: thehive-create-local-user
    arguments:
    - name: login
      required: true
      description: Username login.
    - name: name
      required: true
      description: Name of the user.
    - name: roles
      description: 'Roles (CSV: can be read, write, admin).'
      defaultValue: read
    - name: password
      required: true
      description: Password.
    - name: profile
      description: Profile name (only used with TheHive Project v4 and onwards).
    description: Create a new user.
  - name: thehive-block-user
    arguments:
    - name: id
      required: true
      description: User ID.
    description: Block a user.
  - name: thehive-list-observables
    arguments:
    - name: id
      description: Case ID.
      required: true
    description: List observables for a case.
    outputs:
    - contextPath: TheHive.Observables
      description: List of observables for a case.
      type: string
  - name: thehive-create-observable
    arguments:
    - name: id
      required: true
      description: Case ID.
    - name: data
      required: true
      description: Data of the observable.
    - name: dataType
      required: true
      auto: PREDEFINED
      predefined:
      - autonomous-system
      - domain
      - file
      - filename
      - fqdn
      - hash
      - ip
      - mail
      - mail_subject
      - other
      - regexp
      - registry
      - uri_path
      - url
      - user-agent
      description: Data type of the observable.
      defaultValue: other
    - name: message
      required: true
      description: Observable message.
    - name: startDate
      description: Datetime the observable was started on, for example, 2018-06-29 08:15:27.243860.
    - name: tlp
      auto: PREDEFINED
      predefined:
      - WHITE
      - GREEN
      - AMBER
      - RED
      description: Traffic Light Protocol designation for the observable.
    - name: ioc
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Is the observable an IOC?
    - name: status
      auto: PREDEFINED
      predefined:
      - Ok
      - Deleted
      description: Status of the observable.
    description: Creates an observable.
  - name: thehive-update-observable
    arguments:
    - name: id
      required: true
      description: Observable ID.
    - name: message
      required: true
      description: Observable message.
    - name: tlp
      auto: PREDEFINED
      predefined:
      - WHITE
      - GREEN
      - AMBER
      - RED
      description: Traffic Light Protocol designation for the observable.
    - name: ioc
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Is the observable an IOC?
    - name: status
      auto: PREDEFINED
      predefined:
      - Ok
      - Deleted
      description: Status of the observable.
    description: Update an observable.
  - name: get-mapping-fields
    arguments: []
    description: Returns the list of fields.
  - name: get-remote-data
    arguments:
    - name: id
      required: true
      description: The ticket ID.
    - name: lastUpdate
      required: true
      description: Retrieve entries that were created after lastUpdate.
    description: Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
  - name: thehive-get-version
    arguments: []
    description: Displays the version of TheHive Project.
  - name: get-modified-remote-data
    arguments: []
    description: Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available from version 6.1.
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  subtype: python3
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
fromversion: 6.0.0
tests:
- Playbook_TheHiveProject_Test