TheHive

Version: 2.0.0

TheHive is a scalable, open source and free security incident response platform.

Connect TheHive with LogicHub

  1. Navigate to Automations > Integrations.
  2. Search for TheHive.
  3. Click Details, then the + icon. Enter the required information in the following fields.
    • Label: Enter a connection name.
    • Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
    • Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
    • Remote Agent: Run this integration using the LogicHub Remote Agent.
    • Server IP or Hostname: Server IP or Hostname where TheHive is installed and running.Example: http://111.111.111.111
    • Port Number: Port Number for TheHive instance.
    • API Key: API Key for TheHive instance.
  4. After you've entered all the details, click Connect.

Actions for TheHive

List Cases

Get a list of cases.

Input Field

Choose a connection that you have previously created to complete the connection.

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: List of cases.
3360

Find Cases

Find cases.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Search TextColumn name from parent table containing search text for the Case.Required
Case StatusColumn name from parent table containing case status.
Example: Open, Resolved.
Optional
Case AssigneeColumn name from parent table containing case assignee.Optional
Case SeverityColumn name from parent table containing case severity. Example: High, Medium, Low.Optional

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Cases that matches search criteria
3360

Create a Case

Creates a case

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
TitleColumn name from the parent table for the title field.Required
DescriptionColumn name from parent table containing a description of the case.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Case details
3360

Get a Case

Get a case

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Case IDColumn name from the parent table for caseid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Case details
3360

Update a Case

Update a case

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Case IdColumn name from the parent table for caseid field.Required
TitleColumn name from the parent table for the title field.Required
DescriptionColumn name from parent table containing a description of the case.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Case details
3360

Remove a Case

Remove a case

Input Field

Input NameDescriptionRequired
Case IdColumn name from the parent table for caseid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Case Id
3360

Get Linked Cases

Get the list of cases linked to the case

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDecriptionRequired
Case IdColumn name from the parent table for caseid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: List of cases
3360

Merge Cases

Merge cases

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Case Id (First)Column name from the parent table for first caseid field.Required
Case Id (Second)Column name from the parent table for second caseid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Case details
3360

List Alerts

Get a list of alerts.

Input Field

Choose a connection that you have previously created to complete the connection.

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: List of alerts.
3360

Find Alerts

Find alerts.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Search TextColumn name from parent table containing search text for the Case.Required
StatusColumn name from parent table containing status. Example: New, Updated, Ignored, Imported.Optional
SourceColumn name from parent table containing the source.Optional
SeverityColumn name from parent table containing severity. Example: High, Medium, Low.Optional
TypeColumn name from parent table containing case severity. Example: External, Internal.Optional

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Alerts that matches search criteria
3360

Compute Stats on Alerts

Compute stats on alerts.

Input Field

Choose a connection that you have previously created to complete the connection.

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Stats on alerts.
3360

Create an Alert

Creates an alert

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
TitleColumn name from the parent table for the title field.Required
DescriptionColumn name from parent table containing description field.Required
TypeColumn name from parent table containing type field.Required
SourceColumn name from parent table containing source field.Required
Source ReferenceColumn name from parent table containing source reference field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Alert details
3360

Get an Alert

Get an alert

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Alert IdColumn name from the parent table for alertid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Alert details
3360

Update an Alert

Update an alert

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Alert IdColumn name from the parent table for alertid field.Required
TitleColumn name from the parent table for the title field.Required
DescriptionColumn name from parent table containing description field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Alert details
3360

Delete an Alert

Delete an alert

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Alert IdColumn name from the parent table for alertid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Alert Id
3360

Mark an Alert as Read

Mark an alert as read.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Alert IdColumn name from the parent table for alertid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Alert details
3360

Mark an Alert as Unread

Mark an alert as unread.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Alert IdColumn name from the parent table for alertid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Alert details
3360

Create a Case from an Alert

Create a case from an alert.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Alert IdColumn name from the parent table for alertid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Case details
3360

Merge an Alert in a Case

Merge an alert in a case.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Alert IdColumn name from the parent table for alertid field.Required
Case IdColumn name from the parent table for caseid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Case details
3360

Merge Several Alerts in One Case

Merge several alerts in one case.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Alert IdsColumn name from the parent table for alertids field. Example: a_id1,a_id2,a_id3.Required
Case IdColumn name from the parent table for caseid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Case details
3360

Find Tasks

Find tasks.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Case IdColumn name from the parent table for caseid field.Required
Search TextColumn name from parent table containing search text for the task.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Tasks that matches search criteria
3360

Get a Task

Get a task.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Task IdColumn name from the parent table for taskid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Task details
3360

Update a Task

Update a task.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Task IdColumn name from the parent table for task id field.Required
TitleColumn name from the parent table for title field.Required
DescriptionColumn name from parent table containing description field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Task details
3360

Create a Task

Creates a task.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
TitleColumn name from the parent table for the title field.Required
DescriptionColumn name from parent table containing description field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Task details
3360

Find Observables

Find observables.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Case IdColumn name from the parent table for caseid field.Required
Search TextColumn name from parent table containing search text field.Required
TypeColumn name from parent table containing type. Example: ip, domain, url, filename.Optional
ValueColumn name from parent table containing the value.Optional

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Observables that matches search criteria
3360

Create an Observable

Creates an observable.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Case IdColumn name from the parent table for caseid field.Required
Observable datatypeColumn name from the parent table for an observable datatype.Required
Observable dataColumn name from the parent table for observable data. Example: pic.png.Required
Observable messageColumn name from the parent table for an observable message.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Observable details
3360

Get an Observable

Get an observable.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Observable IdColumn name from the parent table for observableid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Observable details
3360

Create a Log

Creates a log.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Task IdColumn name from the parent table for taskid field.Required
MessageColumn name from parent table containing the message of case.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Log details
3360

Update a Log

Update a log.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Log IdColumn name from the parent table for logid field.Required
MessageColumn name from parent table containing the message of case.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Log details
3360

Get a Log

Get a log.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input NameDescriptionRequired
Log IdColumn name from the parent table for logid field.Required

Output

A JSON object containing multiple rows of result:

  • has_error: True/False
  • error: message/null
  • result: Log details
3360

Release Notes

  • v2.0.0 - Updated architecture to support IO via filesystem

© Devo Technology Inc. All Rights Reserved.