TheHive

Operations 38

• Comment On Alert
  Add a comment to an alert.
  thehive.add_alert_comment
• Comment On Case
  Add a comment to a case.
  thehive.add_case_comment
• Merge Alerts Into Case
  Merge several alerts into one existing case in a single call.
  thehive.bulk_merge_alerts_into_case
• Bulk Update Cases
  Apply the same field changes to several cases in one call.
  thehive.bulk_update_cases
• Count Cases
  Count the cases that match a filter, without fetching them.
  thehive.count_cases
• Create Alert
  Raise an alert for triage. The source and source reference together identify it, so re-sending the same pair is refused as a duplicate instead of creating a second alert.
  thehive.create_alert
• Add Observable To Alert
  Attach one or more observables to an alert before it is triaged.
  thehive.create_alert_observable
• Create Case
  Open a new case, with its severity, TLP, tags and assignee.
  thehive.create_case
• Add Observable To Case
  Attach one or more observables to a case. Several comma-separated values create several observables in a single call.
  thehive.create_case_observable
• Create Task
  Add an investigation task to a case.
  thehive.create_task
• Add Task Log
  Write a log entry on a task, which is how analysts record work.
  thehive.create_task_log
• Delete Alert
  Delete an alert from TheHive.
  thehive.delete_alert
• Delete Case
  Delete a case from TheHive.
  thehive.delete_case
• Delete Observable
  Delete an observable from its case or alert.
  thehive.delete_observable
• Delete Task
  Delete a task from its case.
  thehive.delete_task
• Delete Task Log
  Delete a task log entry.
  thehive.delete_task_log
• Follow Or Unfollow Alert
  Start or stop following an alert, which controls source updates.
  thehive.follow_alert
• Get Alert
  Read one alert by its id.
  thehive.get_alert
• Get Case
  Read one case by its id or its case number.
  thehive.get_case
• Get Case Timeline
  Read the ordered timeline of everything that happened on a case.
  thehive.get_case_timeline
• Get Observable
  Read one observable by its id.
  thehive.get_observable
• Get Task
  Read one task by its id.
  thehive.get_task
• List Case Observables
  List the observables attached to one case.
  thehive.list_case_observables
• List Case Tasks
  List the tasks that belong to one case.
  thehive.list_case_tasks
• List Task Logs
  List the log entries written on one task.
  thehive.list_task_logs
• Merge Alert Into Case
  Merge one alert into an existing case rather than opening a new one.
  thehive.merge_alert_into_case
• Merge Cases
  Merge two or more cases into a single new case.
  thehive.merge_cases
• Promote Alert To Case
  Turn an alert into a new case, optionally overriding its fields.
  thehive.promote_alert_to_case
• Run Query
  Run any TheHive query as a raw list of steps, for the reads the curated nodes above do not cover.
  thehive.query
• Search Alerts
  Search alerts by title, type, source, status or a raw filter.
  thehive.search_alerts
• Search Cases
  Search cases by title, status, assignee or a raw filter expression.
  thehive.search_cases
• Search Observables
  Search observables by value, type, IOC flag or a raw filter.
  thehive.search_observables
• Search Tasks
  Search tasks across every case the connection can see.
  thehive.search_tasks
• Update Alert
  Merge fields into an alert, such as its status or severity.
  thehive.update_alert
• Update Case
  Merge fields into an existing case, such as status or assignee.
  thehive.update_case
• Update Observable
  Merge fields into an observable, such as its IOC or sighted flag.
  thehive.update_observable
• Update Task
  Merge fields into a task, such as its status or assignee.
  thehive.update_task
• Update Task Log
  Edit the text of a task log, or pin it to the case timeline.
  thehive.update_task_log