TheHive
Version: 2.0.0
TheHive is a scalable, open source and free security incident response platform.
Connect TheHive with LogicHub
- Navigate to Automations > Integrations.
- Search for TheHive.
- Click Details, then the + icon. Enter the required information in the following fields.
- Label: Enter a connection name.
- Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
- Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
- Remote Agent: Run this integration using the LogicHub Remote Agent.
- Server IP or Hostname: Server IP or Hostname where TheHive is installed and running.Example: http://111.111.111.111
- Port Number: Port Number for TheHive instance.
- API Key: API Key for TheHive instance.
- After you've entered all the details, click Connect.
Actions for TheHive
List Cases
Get a list of cases.
Input Field
Choose a connection that you have previously created to complete the connection.
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: List of cases.
![ListCases.png 3360](https://files.readme.io/45192ea-ListCases.png)
Find Cases
Find cases.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Search Text | Column name from parent table containing search text for the Case. | Required |
Case Status | Column name from parent table containing case status. Example: Open, Resolved. | Optional |
Case Assignee | Column name from parent table containing case assignee. | Optional |
Case Severity | Column name from parent table containing case severity. Example: High, Medium, Low. | Optional |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Cases that matches search criteria
![FindCases.png 3360](https://files.readme.io/dcae7cc-FindCases.png)
Create a Case
Creates a case
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Title | Column name from the parent table for the title field. | Required |
Description | Column name from parent table containing a description of the case. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Case details
![CreateCase.png 3360](https://files.readme.io/c8f383e-CreateCase.png)
Get a Case
Get a case
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Case ID | Column name from the parent table for caseid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Case details
![GetCase.png 3360](https://files.readme.io/f6bc011-GetCase.png)
Update a Case
Update a case
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Case Id | Column name from the parent table for caseid field. | Required |
Title | Column name from the parent table for the title field. | Required |
Description | Column name from parent table containing a description of the case. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Case details
![update case.png 3360](https://files.readme.io/c5d118f-update_case.png)
Remove a Case
Remove a case
Input Field
Input Name | Description | Required |
---|---|---|
Case Id | Column name from the parent table for caseid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Case Id
![remove case.png 3360](https://files.readme.io/3ec6cf2-remove_case.png)
Get Linked Cases
Get the list of cases linked to the case
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Decription | Required |
---|---|---|
Case Id | Column name from the parent table for caseid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: List of cases
![link cases.png 3360](https://files.readme.io/21dab82-link_cases.png)
Merge Cases
Merge cases
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Case Id (First) | Column name from the parent table for first caseid field. | Required |
Case Id (Second) | Column name from the parent table for second caseid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Case details
![MergeCases.png 3360](https://files.readme.io/f799f71-MergeCases.png)
List Alerts
Get a list of alerts.
Input Field
Choose a connection that you have previously created to complete the connection.
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: List of alerts.
![list alerts.png 3360](https://files.readme.io/320885d-list_alerts.png)
Find Alerts
Find alerts.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Search Text | Column name from parent table containing search text for the Case. | Required |
Status | Column name from parent table containing status. Example: New, Updated, Ignored, Imported. | Optional |
Source | Column name from parent table containing the source. | Optional |
Severity | Column name from parent table containing severity. Example: High, Medium, Low. | Optional |
Type | Column name from parent table containing case severity. Example: External, Internal. | Optional |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Alerts that matches search criteria
![find alerts.png 3360](https://files.readme.io/7077a0b-find_alerts.png)
Compute Stats on Alerts
Compute stats on alerts.
Input Field
Choose a connection that you have previously created to complete the connection.
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Stats on alerts.
![compute stats.png 3360](https://files.readme.io/067b1d5-compute_stats.png)
Create an Alert
Creates an alert
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Title | Column name from the parent table for the title field. | Required |
Description | Column name from parent table containing description field. | Required |
Type | Column name from parent table containing type field. | Required |
Source | Column name from parent table containing source field. | Required |
Source Reference | Column name from parent table containing source reference field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Alert details
![create alert.png 3360](https://files.readme.io/df5c106-create_alert.png)
Get an Alert
Get an alert
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Alert Id | Column name from the parent table for alertid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Alert details
![get alert.png 3360](https://files.readme.io/4068c44-get_alert.png)
Update an Alert
Update an alert
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Alert Id | Column name from the parent table for alertid field. | Required |
Title | Column name from the parent table for the title field. | Required |
Description | Column name from parent table containing description field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Alert details
![update alert.png 3360](https://files.readme.io/b242e4b-update_alert.png)
Delete an Alert
Delete an alert
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Alert Id | Column name from the parent table for alertid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Alert Id
![delete alert.png 3360](https://files.readme.io/0b6ac74-delete_alert.png)
Mark an Alert as Read
Mark an alert as read.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Alert Id | Column name from the parent table for alertid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Alert details
![mark read.png 3360](https://files.readme.io/8caf259-mark_read.png)
Mark an Alert as Unread
Mark an alert as unread.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Alert Id | Column name from the parent table for alertid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Alert details
![mark unread.png 3360](https://files.readme.io/92304d4-mark_unread.png)
Create a Case from an Alert
Create a case from an alert.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Alert Id | Column name from the parent table for alertid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Case details
![create case from alert.png 3360](https://files.readme.io/c38b428-create_case_from_alert.png)
Merge an Alert in a Case
Merge an alert in a case.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Alert Id | Column name from the parent table for alertid field. | Required |
Case Id | Column name from the parent table for caseid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Case details
![Merge an alert in a case.png 3360](https://files.readme.io/14bde5e-Merge_an_alert_in_a_case.png)
Merge Several Alerts in One Case
Merge several alerts in one case.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Alert Ids | Column name from the parent table for alertids field. Example: a_id1,a_id2,a_id3. | Required |
Case Id | Column name from the parent table for caseid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Case details
![Merge several alerts in one case.png 3360](https://files.readme.io/467878b-Merge_several_alerts_in_one_case.png)
Find Tasks
Find tasks.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Case Id | Column name from the parent table for caseid field. | Required |
Search Text | Column name from parent table containing search text for the task. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Tasks that matches search criteria
![find tasks.png 3360](https://files.readme.io/cf97a2c-find_tasks.png)
Get a Task
Get a task.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Task Id | Column name from the parent table for taskid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Task details
![get task.png 3360](https://files.readme.io/5a408fb-get_task.png)
Update a Task
Update a task.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Task Id | Column name from the parent table for task id field. | Required |
Title | Column name from the parent table for title field. | Required |
Description | Column name from parent table containing description field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Task details
![update task.png 3360](https://files.readme.io/4b9fd67-update_task.png)
Create a Task
Creates a task.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Title | Column name from the parent table for the title field. | Required |
Description | Column name from parent table containing description field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Task details
![create task.png 3360](https://files.readme.io/829f674-create_task.png)
Find Observables
Find observables.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Case Id | Column name from the parent table for caseid field. | Required |
Search Text | Column name from parent table containing search text field. | Required |
Type | Column name from parent table containing type. Example: ip, domain, url, filename. | Optional |
Value | Column name from parent table containing the value. | Optional |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Observables that matches search criteria
![Find Observable.png 3360](https://files.readme.io/840ef97-Find_Observable.png)
Create an Observable
Creates an observable.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Case Id | Column name from the parent table for caseid field. | Required |
Observable datatype | Column name from the parent table for an observable datatype. | Required |
Observable data | Column name from the parent table for observable data. Example: pic.png. | Required |
Observable message | Column name from the parent table for an observable message. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Observable details
![Create an observable.png 3360](https://files.readme.io/0db25e3-Create_an_observable.png)
Get an Observable
Get an observable.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Observable Id | Column name from the parent table for observableid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Observable details
![Get an observable.png 3360](https://files.readme.io/ff14b57-Get_an_observable.png)
Create a Log
Creates a log.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Task Id | Column name from the parent table for taskid field. | Required |
Message | Column name from parent table containing the message of case. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Log details
![Create Log.png 3360](https://files.readme.io/4de2a20-Create_Log.png)
Update a Log
Update a log.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Log Id | Column name from the parent table for logid field. | Required |
Message | Column name from parent table containing the message of case. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Log details
![Update Log.png 3360](https://files.readme.io/72239d7-Update_Log.png)
Get a Log
Get a log.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Log Id | Column name from the parent table for logid field. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Log details
![Get Log.png 3360](https://files.readme.io/cb154d9-Get_Log.png)
Release Notes
v2.0.0
- Updated architecture to support IO via filesystem
Updated 9 months ago