Skip to content

Commit 4ef9cb9

Browse files
jeromeleonardjeromeleonard
committed
#10 update and format
1 parent c2768c1 commit 4ef9cb9

File tree

4 files changed

+361
-17
lines changed

4 files changed

+361
-17
lines changed

‎docs/thehive/api/alert/list-observables.md‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# List Observables
2+
3+
List observables of an *Alerts*.
4+
5+
## Query
6+
7+
```plain
8+
POST /api/v1/query?name=alert-observables
9+
```
10+
11+
## Request Body Example
12+
13+
!!! Example ""
14+
15+
List last 15 added observables:
16+
17+
```json
18+
{
19+
"query": [
20+
{
21+
"_name": "getAlert",
22+
"idOrName": "{id}"
23+
},
24+
{
25+
"_name": "observables"
26+
},
27+
{
28+
"_name": "sort",
29+
"_fields": [
30+
{
31+
"startDate": "desc"
32+
}
33+
]
34+
},
35+
{
36+
"_name": "page",
37+
"from": 0,
38+
"to": 15,
39+
"extraData": [
40+
"seen"
41+
]
42+
}
43+
]
44+
}
45+
```
46+
47+
With:
48+
49+
- `id`: id of the *Alert*
50+
51+
## Response
52+
53+
### Status codes
54+
55+
- `200`: if query is run successfully
56+
- `401`: Authentication error
57+
58+
### Response Body Example
59+
60+
!!! Example ""
61+
62+
```json
63+
[
64+
...
65+
{
66+
"_id": "~11111462234",
67+
"_type": "Observable",
68+
"_createdBy": "[email protected]",
69+
"_createdAt": 1629309258431,
70+
"dataType": "other",
71+
"data": "1.2.3.4",
72+
"startDate": 1629309258431,
73+
"tlp": 0,
74+
"tags": [],
75+
"ioc": false,
76+
"sighted": false,
77+
"reports": {},
78+
"message": "",
79+
"extraData": {
80+
"seen": {
81+
"seen": 3,
82+
"ioc": false
83+
}
84+
},
85+
}
86+
...
87+
]
88+
```

‎docs/thehive/api/alert/merge.md‎

Lines changed: 72 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,86 @@
11
# Merge
22

3-
Merge an Alert into an existing *Case*.
3+
Merge an *Alert* into an existing *Case*.
44

55
## Query
66

7+
```plain
8+
POST /api/alert/{id1}/merge/{id2}
79
```
810

9-
```
10-
11+
With:
1112

12-
## Request Body Example
13+
- `id1`: id of the *Alert* to merge
14+
- `id2`: id of the destination *Case*
1315

14-
```json
16+
## Response
1517

16-
```
18+
### Status codes
1719

20+
- `200`: if *Alert* is successfully merged
21+
- `401`: Authentication error
1822

19-
## Response Body Example
23+
### Response Body Example
2024

21-
```json
25+
!!! Example ""
2226

23-
```
27+
```json
28+
{
29+
"_id": "~6658533455",
30+
"id": "~6658533455",
31+
"createdBy": "[email protected]",
32+
"updatedBy": "[email protected]",
33+
"createdAt": 1620397519028,
34+
"updatedAt": 1624373852175,
35+
"_type": "case",
36+
"caseId": 114,
37+
"title": "User connected to known malicious IP over Telnet / Malicious payload detected",
38+
"description": "EDR automated alert: the user [email protected] has connected to known malicious IP over Telnet\n\nEDR automated alert: malicious payload detected on computer PC-Robb\n \n#### Merged with alert #90e044 User posted information on known phishing URL\n\nSIEM automated alert: the user [email protected] has posted information on a known phishing url",
39+
"severity": 2,
40+
"startDate": 1620396059728,
41+
"endDate": null,
42+
"impactStatus": null,
43+
"resolutionStatus": null,
44+
"tags": [
45+
"log-source:proxy",
46+
"source:edr",
47+
"log-source:endpoint-protection",
48+
"source:siem",
49+
"protocol: telnet",
50+
"ex2"
51+
],
52+
"flag": false,
53+
"tlp": 3,
54+
"pap": 2,
55+
"status": "Open",
56+
"summary": null,
57+
"owner": "[email protected]",
58+
"customFields": {
59+
"businessUnit": {
60+
"string": "Finance",
61+
"order": 0
62+
},
63+
"location": {
64+
"string": "Sydney",
65+
"order": 1
66+
}
67+
},
68+
"stats": {},
69+
"permissions": [
70+
"manageShare",
71+
"manageAnalyse",
72+
"manageTask",
73+
"manageCaseTemplate",
74+
"manageCase",
75+
"manageUser",
76+
"manageProcedure",
77+
"managePage",
78+
"manageObservable",
79+
"manageTag",
80+
"manageConfig",
81+
"manageAlert",
82+
"accessTheHiveFS",
83+
"manageAction"
84+
]
85+
}
86+
```

‎docs/thehive/api/alert/promote-as-case.md‎

Lines changed: 82 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,97 @@
11
# Promote
22

3-
Promote an Alert as a new *Case*.
3+
Promote an *Alert* as a new *Case*.
44

55
## Query
66

7+
```plain
8+
POST /api/alert/{id}/createCase
79
```
810

9-
```
11+
With:
1012

13+
- `id`: id of the *Alert* to promote
1114

12-
## Request Body Example
15+
## Request Body example
1316

14-
```json
17+
Specify a *Case template* applied with *Case* creation:
1518

16-
```
19+
!!! Example ""
20+
21+
```json
22+
{
23+
"caseTemplate": "SIEM_Alert"
24+
}
25+
```
26+
27+
The following fields are optional:
28+
29+
- `caseTemplate`: (String)
30+
31+
## Response
32+
33+
### Status codes
1734

35+
- `201`: if *Case* is successfully created
36+
- `401`: Authentication error
1837

19-
## Response Body Example
38+
### Response Body Example
2039

21-
```json
40+
!!! Example ""
2241

23-
```
42+
```json
43+
{
44+
"_id": "~907709843",
45+
"id": "~907709843",
46+
"createdBy": "[email protected]",
47+
"updatedBy": null,
48+
"createdAt": 1630416621805,
49+
"updatedAt": null,
50+
"_type": "case",
51+
"caseId": 126,
52+
"title": "User posted information on known phishing URL",
53+
"description": "SIEM automated alert: the user [email protected] has posted information on a known phishing url. ",
54+
"severity": 2,
55+
"startDate": 1630416621797,
56+
"endDate": null,
57+
"impactStatus": null,
58+
"resolutionStatus": null,
59+
"tags": [
60+
"source:siem",
61+
"log-source:proxy"
62+
],
63+
"flag": false,
64+
"tlp": 3,
65+
"pap": 2,
66+
"status": "Open",
67+
"summary": null,
68+
"owner": "[email protected]",
69+
"customFields": {
70+
"businessUnit": {
71+
"string": "Finance",
72+
"order": 0
73+
},
74+
"location": {
75+
"string": "Sydney",
76+
"order": 1
77+
}
78+
},
79+
"stats": {},
80+
"permissions": [
81+
"manageShare",
82+
"manageAnalyse",
83+
"manageTask",
84+
"manageCaseTemplate",
85+
"manageCase",
86+
"manageUser",
87+
"manageProcedure",
88+
"managePage",
89+
"manageObservable",
90+
"manageTag",
91+
"manageConfig",
92+
"manageAlert",
93+
"accessTheHiveFS",
94+
"manageAction"
95+
]
96+
}
97+
```

0 commit comments

Comments
 (0)