Skip to content

Commit 3ca8a65

Browse files
jeromeleonardjeromeleonard
committed
#10 update and format
1 parent a83a976 commit 3ca8a65

File tree

4 files changed

+170
-57
lines changed

4 files changed

+170
-57
lines changed

‎docs/thehive/api/alert/add-observable.md

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Add observables
2+
3+
Add *Observable* to an *Alert*.
4+
5+
## Query
6+
7+
```plain
8+
POST /api/alert/{id}/artifact
9+
```
10+
11+
With:
12+
13+
- `id`: Alert identifier
14+
15+
## Request Body Example
16+
17+
!!! Example ""
18+
19+
```json
20+
21+
```
22+
23+
24+
25+
## Response
26+
27+
### Status codes
28+
29+
- `201`: if *Alert* is created successfully
30+
- `401`: Authentication error
31+
32+
### Response Body Example
33+
34+
!!! Example ""
35+
36+
```json
37+
38+
```

‎docs/thehive/api/alert/delete-observable.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Add observables
2+
3+
Delete an *Observable* from an *Alert*.
4+
5+
## Query
6+
7+
```plain
8+
DELETE /api/alert/artifact/{id}
9+
```
10+
11+
With:
12+
13+
- `id`: Observable identifier
14+
15+
## Response
16+
17+
### Status codes
18+
19+
- `204`: if *Observable* is deleted successfully
20+
- `401`: Authentication error

‎docs/thehive/api/alert/merge.md

+57-57
Original file line numberDiff line numberDiff line change
@@ -25,62 +25,62 @@ With:
2525
!!! Example ""
2626

2727
```json
28-
{
29-
"_id": "~6658533455",
30-
"id": "~6658533455",
31-
"createdBy": "[email protected]",
32-
"updatedBy": "[email protected]",
33-
"createdAt": 1620397519028,
34-
"updatedAt": 1624373852175,
35-
"_type": "case",
36-
"caseId": 114,
37-
"title": "User connected to known malicious IP over Telnet / Malicious payload detected",
38-
"description": "EDR automated alert: the user [email protected] has connected to known malicious IP over Telnet\n\nEDR automated alert: malicious payload detected on computer PC-Robb\n \n#### Merged with alert #90e044 User posted information on known phishing URL\n\nSIEM automated alert: the user [email protected] has posted information on a known phishing url",
39-
"severity": 2,
40-
"startDate": 1620396059728,
41-
"endDate": null,
42-
"impactStatus": null,
43-
"resolutionStatus": null,
44-
"tags": [
45-
"log-source:proxy",
46-
"source:edr",
47-
"log-source:endpoint-protection",
48-
"source:siem",
49-
"protocol: telnet",
50-
"ex2"
51-
],
52-
"flag": false,
53-
"tlp": 3,
54-
"pap": 2,
55-
"status": "Open",
56-
"summary": null,
57-
"owner": "[email protected]",
58-
"customFields": {
59-
"businessUnit": {
60-
"string": "Finance",
61-
"order": 0
62-
},
63-
"location": {
64-
"string": "Sydney",
65-
"order": 1
28+
{
29+
"_id": "~6658533455",
30+
"id": "~6658533455",
31+
"createdBy": "[email protected]",
32+
"updatedBy": "[email protected]",
33+
"createdAt": 1620397519028,
34+
"updatedAt": 1624373852175,
35+
"_type": "case",
36+
"caseId": 114,
37+
"title": "User connected to known malicious IP over Telnet / Malicious payload detected",
38+
"description": "EDR automated alert: the user [email protected] has connected to known malicious IP over Telnet\n\nEDR automated alert: malicious payload detected on computer PC-Robb\n \n#### Merged with alert #90e044 User posted information on known phishing URL\n\nSIEM automated alert: the user [email protected] has posted information on a known phishing url",
39+
"severity": 2,
40+
"startDate": 1620396059728,
41+
"endDate": null,
42+
"impactStatus": null,
43+
"resolutionStatus": null,
44+
"tags": [
45+
"log-source:proxy",
46+
"source:edr",
47+
"log-source:endpoint-protection",
48+
"source:siem",
49+
"protocol: telnet",
50+
"ex2"
51+
],
52+
"flag": false,
53+
"tlp": 3,
54+
"pap": 2,
55+
"status": "Open",
56+
"summary": null,
57+
"owner": "[email protected]",
58+
"customFields": {
59+
"businessUnit": {
60+
"string": "Finance",
61+
"order": 0
62+
},
63+
"location": {
64+
"string": "Sydney",
65+
"order": 1
66+
}
67+
},
68+
"stats": {},
69+
"permissions": [
70+
"manageShare",
71+
"manageAnalyse",
72+
"manageTask",
73+
"manageCaseTemplate",
74+
"manageCase",
75+
"manageUser",
76+
"manageProcedure",
77+
"managePage",
78+
"manageObservable",
79+
"manageTag",
80+
"manageConfig",
81+
"manageAlert",
82+
"accessTheHiveFS",
83+
"manageAction"
84+
]
6685
}
67-
},
68-
"stats": {},
69-
"permissions": [
70-
"manageShare",
71-
"manageAnalyse",
72-
"manageTask",
73-
"manageCaseTemplate",
74-
"manageCase",
75-
"manageUser",
76-
"manageProcedure",
77-
"managePage",
78-
"manageObservable",
79-
"manageTag",
80-
"manageConfig",
81-
"manageAlert",
82-
"accessTheHiveFS",
83-
"manageAction"
84-
]
85-
}
8686
```

‎docs/thehive/api/alert/run-responder.md

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Run Responder
2+
3+
Run a Responder on an *Alert*.
4+
5+
## Query
6+
7+
```plain
8+
POST /api/connector/cortex/action
9+
```
10+
11+
12+
## Request Body Example
13+
14+
!!! Example ""
15+
16+
```json
17+
{
18+
"responderId": "05521ec727f75d69e828604dc5ae4c03",
19+
"objectType": "alert",
20+
"objectId": "~947478656"
21+
}
22+
```
23+
24+
The following fields are required:
25+
26+
- `responderId`: (String)
27+
- `objectType`: "alert"
28+
- `objectId`: (String)
29+
30+
## Response
31+
32+
### Status codes
33+
34+
- `200`: if *Responder* is run successfully
35+
- `401`: Authentication error
36+
37+
### Response Body Example
38+
39+
!!! Example ""
40+
41+
```json
42+
{
43+
"responderId": "05521ec727f75d69e828604dc5ae4bed",
44+
"responderName": "JIRA_Create_Ticket_1_0",
45+
"responderDefinition": "JIRA_Create_Ticket_1_0",
46+
"cortexId": "CORTEX_INTERNAL",
47+
"cortexJobId": "_v2EnHsB8Pn57ilsukA3",
48+
"objectType": "Alert",
49+
"objectId": "~947478656",
50+
"status": "Waiting",
51+
"startDate": 1630418550145,
52+
"operations": "[]",
53+
"report": "{}"
54+
}
55+
```

0 commit comments

Comments
 (0)