TheHive

Version: 2.0.0

Suggest Edits

TheHive is a scalable, open source and free security incident response platform.

Connect TheHive with LogicHub

Navigate to Automations > Integrations.
Search for TheHive.
Click Details, then the + icon. Enter the required information in the following fields.
- Label: Enter a connection name.
- Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
- Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
- Remote Agent: Run this integration using the LogicHub Remote Agent.
- Server IP or Hostname: Server IP or Hostname where TheHive is installed and running.Example: http://111.111.111.111
- Port Number: Port Number for TheHive instance.
- API Key: API Key for TheHive instance.
After you've entered all the details, click Connect.

Actions for TheHive

List Cases

Get a list of cases.

Input Field

Choose a connection that you have previously created to complete the connection.

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: List of cases.

Find Cases

Find cases.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Search Text	Column name from parent table containing search text for the Case.	Required
Case Status	Column name from parent table containing case status. Example: Open, Resolved.	Optional
Case Assignee	Column name from parent table containing case assignee.	Optional
Case Severity	Column name from parent table containing case severity. Example: High, Medium, Low.	Optional

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Cases that matches search criteria

Create a Case

Creates a case

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Title	Column name from the parent table for the title field.	Required
Description	Column name from parent table containing a description of the case.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Case details

Get a Case

Get a case

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Case ID	Column name from the parent table for caseid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Case details

Update a Case

Update a case

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Case Id	Column name from the parent table for caseid field.	Required
Title	Column name from the parent table for the title field.	Required
Description	Column name from parent table containing a description of the case.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Case details

Remove a Case

Remove a case

Input Field

Input Name	Description	Required
Case Id	Column name from the parent table for caseid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Case Id

Get Linked Cases

Get the list of cases linked to the case

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Decription	Required
Case Id	Column name from the parent table for caseid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: List of cases

Merge Cases

Merge cases

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Case Id (First)	Column name from the parent table for first caseid field.	Required
Case Id (Second)	Column name from the parent table for second caseid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Case details

List Alerts

Get a list of alerts.

Input Field

Choose a connection that you have previously created to complete the connection.

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: List of alerts.

Find Alerts

Find alerts.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Search Text	Column name from parent table containing search text for the Case.	Required
Status	Column name from parent table containing status. Example: New, Updated, Ignored, Imported.	Optional
Source	Column name from parent table containing the source.	Optional
Severity	Column name from parent table containing severity. Example: High, Medium, Low.	Optional
Type	Column name from parent table containing case severity. Example: External, Internal.	Optional

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Alerts that matches search criteria

Compute Stats on Alerts

Compute stats on alerts.

Input Field

Choose a connection that you have previously created to complete the connection.

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Stats on alerts.

Create an Alert

Creates an alert

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Title	Column name from the parent table for the title field.	Required
Description	Column name from parent table containing description field.	Required
Type	Column name from parent table containing type field.	Required
Source	Column name from parent table containing source field.	Required
Source Reference	Column name from parent table containing source reference field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Alert details

Get an Alert

Get an alert

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Alert Id	Column name from the parent table for alertid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Alert details

Update an Alert

Update an alert

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Alert Id	Column name from the parent table for alertid field.	Required
Title	Column name from the parent table for the title field.	Required
Description	Column name from parent table containing description field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Alert details

Delete an Alert

Delete an alert

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Alert Id	Column name from the parent table for alertid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Alert Id

Mark an Alert as Read

Mark an alert as read.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Alert Id	Column name from the parent table for alertid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Alert details

Mark an Alert as Unread

Mark an alert as unread.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Alert Id	Column name from the parent table for alertid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Alert details

Create a Case from an Alert

Create a case from an alert.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Alert Id	Column name from the parent table for alertid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Case details

Merge an Alert in a Case

Merge an alert in a case.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Alert Id	Column name from the parent table for alertid field.	Required
Case Id	Column name from the parent table for caseid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Case details

Merge Several Alerts in One Case

Merge several alerts in one case.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Alert Ids	Column name from the parent table for alertids field. Example: a_id1,a_id2,a_id3.	Required
Case Id	Column name from the parent table for caseid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Case details

Find Tasks

Find tasks.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Case Id	Column name from the parent table for caseid field.	Required
Search Text	Column name from parent table containing search text for the task.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Tasks that matches search criteria

Get a Task

Get a task.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Task Id	Column name from the parent table for taskid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Task details

Update a Task

Update a task.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Task Id	Column name from the parent table for task id field.	Required
Title	Column name from the parent table for title field.	Required
Description	Column name from parent table containing description field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Task details

Create a Task

Creates a task.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Title	Column name from the parent table for the title field.	Required
Description	Column name from parent table containing description field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Task details

Find Observables

Find observables.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Case Id	Column name from the parent table for caseid field.	Required
Search Text	Column name from parent table containing search text field.	Required
Type	Column name from parent table containing type. Example: ip, domain, url, filename.	Optional
Value	Column name from parent table containing the value.	Optional

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Observables that matches search criteria

Create an Observable

Creates an observable.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Case Id	Column name from the parent table for caseid field.	Required
Observable datatype	Column name from the parent table for an observable datatype.	Required
Observable data	Column name from the parent table for observable data. Example: pic.png.	Required
Observable message	Column name from the parent table for an observable message.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Observable details

Get an Observable

Get an observable.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Observable Id	Column name from the parent table for observableid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Observable details

Create a Log

Creates a log.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Task Id	Column name from the parent table for taskid field.	Required
Message	Column name from parent table containing the message of case.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Log details

Update a Log

Update a log.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Log Id	Column name from the parent table for logid field.	Required
Message	Column name from parent table containing the message of case.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Log details

Get a Log

Get a log.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required
Log Id	Column name from the parent table for logid field.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Log details

Release Notes

v2.0.0 - Updated architecture to support IO via filesystem

Updated over 1 year ago