`thehive` plugin with data sources

[traut]

Description

TheHive is a popular security incident response / case management platform.

Use Cases

Fabric must have the integrations to fetch data from TheHive instance.

Generic configuration shared by all data sources

• api_key - a string attribute. To be used in the HTTP Header as Authorization: Bearer <API_KEY>'
• username - a string attribute
• password - a string attribute
• organisation (optional) - a string attribute

Either api_key or username / password pair needs to be provided.

If organisation is provided, HTTP Header X-Organisation header must be set for all requests, as noted in the docs.

thehive_cases & thehive_alerts data sources

The data sources use Query API:

• thehive_cases data source uses a query name listCase
• thehive_alerts data source uses a query name listAlert

The data sources return a list of entities (cases or alerts).

Evaluation config

• filters (optional) -- a dict that contains filters. If defined, must have one key (see the list of supported fields) and with a value (null, a list or a dict). For example:

  filters = {
            "_eq": {
                "_field": "name",
                "_value": "admin"
            }
  }
  

• sort_fields (optional) -- a list of dicts in the format of [{"<field>": "<direction>" }, ... ], with the accepted values for direction: asc and desc (see the docs)
• exclude_fields (optional) -- a list of strings.
• size (optional) -- an int attribute. Defines the number of cases returned by a data source. Internally, a page walker must be implemented using the API pagination mechanism if the provided size is larger than the default page size.

The docs do not have an example of the response, but there is the object model for a case in TheHive4py client code.

thehive_case_timeline

The data source uses case timeline endpoint

The data source returns a list of events.

Evaluation config

• case_id (required) -- a string attribute

Additional Information

• TheHive v5 Community Edition
• https://docs.strangebee.com/thehive/api-docs/
• https://github.com/TheHive-Project/TheHive4py
• https://github.com/ilyaglow/go-thehive