Skip to content

Commit 8986d68

Browse files
jeromeleonardjeromeleonard
committed
#10 update and format
1 parent e1c0748 commit 8986d68

11 files changed

+307
-0
lines changed

Diff for: ‎docs/thehive/api/alert/add-observable.md

Whitespace-only changes.

Diff for: ‎docs/thehive/api/alert/delete-observable.md

Whitespace-only changes.

Diff for: ‎docs/thehive/api/alert/list-observables.md

Whitespace-only changes.

Diff for: ‎docs/thehive/api/alert/list-responder-jobs.md

Whitespace-only changes.

Diff for: ‎docs/thehive/api/alert/list.md

+92
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# List / Search
2+
3+
List *Alerts*.
4+
5+
## Query
6+
7+
```plain
8+
POST /api/v1/query?name=alerts
9+
```
10+
11+
## Request Body Example
12+
13+
!!! Example ""
14+
15+
List last 15 alerts:
16+
17+
```json
18+
{
19+
"query": [
20+
{
21+
"_name": "listAlert"
22+
},
23+
{
24+
"_name": "filter",
25+
"_field": "imported",
26+
"_value": false
27+
},
28+
{
29+
"_name": "sort",
30+
"_fields": [
31+
{
32+
"date": "desc"
33+
}
34+
]
35+
},
36+
{
37+
"_name": "page",
38+
"from": 0,
39+
"to": 15,
40+
"extraData": [
41+
"importDate",
42+
"caseNumber"
43+
]
44+
}
45+
]
46+
}
47+
```
48+
49+
## Response
50+
51+
### Status codes
52+
53+
- `200`: if query is run successfully
54+
- `401`: Authentication error
55+
56+
### Response Body Example
57+
58+
!!! Example ""
59+
60+
```json
61+
[
62+
...
63+
{
64+
"_id": "~789196976",
65+
"_type": "Alert",
66+
"_createdBy": "[email protected]",
67+
"_createdAt": 1620393156944,
68+
"type": "external",
69+
"source": "MISP server",
70+
"sourceRef": "event_1576",
71+
"title": "Phishing list update 7.5.2021",
72+
"description": "A curated list of phishing IOCs",
73+
"severity": 2,
74+
"date": 1620393156000,
75+
"tags": [
76+
"source:MISP",
77+
"origin:CIRCL_LU"
78+
],
79+
"tlp": 3,
80+
"pap": 2,
81+
"read": false,
82+
"follow": true,
83+
"customFields": [],
84+
"observableCount": 16,
85+
"extraData": {
86+
"importDate": null,
87+
"caseNumber": null
88+
}
89+
},
90+
...
91+
]
92+
```

Diff for: ‎docs/thehive/api/alert/read.md

+127
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
# Mark as Read/Unread
2+
3+
Mark an *Alert* as read
4+
5+
## Query
6+
7+
### Mark as read
8+
9+
```plain
10+
POST /api/alert/{id}/markAsRead
11+
```
12+
13+
with:
14+
15+
- `id`: id of the Alert
16+
17+
### Mark as unread
18+
19+
```plain
20+
POST /api/alert/{id}/markAsUnead
21+
```
22+
23+
with:
24+
25+
- `id`: id of the Alert
26+
27+
28+
## Response
29+
30+
### Status codes
31+
32+
- `200`: if *Alert* is updated successfully
33+
- `401`: Authentication error
34+
35+
### Response Body Example
36+
37+
!!! Example ""
38+
39+
```json
40+
{
41+
"_id": "~911601872",
42+
"id": "~911601872",
43+
"createdBy": "[email protected]",
44+
"updatedBy": null,
45+
"createdAt": 1620333017135,
46+
"updatedAt": null,
47+
"_type": "alert",
48+
"type": "external",
49+
"source": "SIEM",
50+
"sourceRef": "8257b4",
51+
"externalLink": null,
52+
"case": null,
53+
"title": "User posted information on known phishing URL",
54+
"description": "SIEM automated alert: the user [email protected] has posted information on a known phishing url",
55+
"severity": 2,
56+
"date": 1620333017000,
57+
"tags": [
58+
"source:siem",
59+
"log-source:proxy"
60+
],
61+
"tlp": 3,
62+
"pap": 2,
63+
"status": "Ignored",
64+
"follow": true,
65+
"customFields": {
66+
"businessUnit": {
67+
"string": "Finance"
68+
},
69+
"location": {
70+
"string": "Sydney"
71+
}
72+
},
73+
"caseTemplate": null,
74+
"artifacts": [
75+
{
76+
"_id": "~624226312",
77+
"id": "~624226312",
78+
"createdBy": "[email protected]",
79+
"createdAt": 1620333017175,
80+
"_type": "case_artifact",
81+
"dataType": "mail",
82+
"data": "[email protected]",
83+
"startDate": 1620333017175,
84+
"tlp": 2,
85+
"tags": [],
86+
"ioc": false,
87+
"sighted": false,
88+
"reports": {},
89+
"stats": {}
90+
},
91+
{
92+
"_id": "~788742360",
93+
"id": "~788742360",
94+
"createdBy": "[email protected]",
95+
"createdAt": 1620333017168,
96+
"_type": "case_artifact",
97+
"dataType": "url",
98+
"data": "https://moneyfornothing.pl-getbuys.icu/",
99+
"startDate": 1620333017168,
100+
"tlp": 2,
101+
"tags": [],
102+
"ioc": false,
103+
"sighted": false,
104+
"message": "http method: POST",
105+
"reports": {},
106+
"stats": {}
107+
},
108+
{
109+
"_id": "~870416536",
110+
"id": "~870416536",
111+
"createdBy": "[email protected]",
112+
"createdAt": 1620333017157,
113+
"_type": "case_artifact",
114+
"dataType": "ip",
115+
"data": "94.154.129.50",
116+
"startDate": 1620333017157,
117+
"tlp": 2,
118+
"tags": [],
119+
"ioc": false,
120+
"sighted": false,
121+
"reports": {},
122+
"stats": {}
123+
}
124+
],
125+
"similarCases": []
126+
}
127+
```

Diff for: ‎docs/thehive/api/alert/run-responder.md

Whitespace-only changes.

Diff for: ‎docs/thehive/api/alert/similar-cases.md

Whitespace-only changes.

Diff for: ‎docs/thehive/api/alert/update-observable.md

Whitespace-only changes.

Diff for: ‎docs/thehive/api/custom-field/delete.md

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Delete
2+
3+
Delete a *Custom Field*.
4+
5+
## Query
6+
7+
```plain
8+
DELETE /api/customField/{id}
9+
```
10+
11+
with:
12+
13+
- `id`: id of the Custom Field.
14+
15+
16+
## Response
17+
18+
### Status codes
19+
20+
- `204`: if *Custom Fields* is successfully deleted
21+
- `401`: Authentication error
22+
- `403`: Authorization error
23+

Diff for: ‎docs/thehive/api/custom-field/get.md

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Get / List
2+
3+
List *Custom Fields*.
4+
5+
## Query
6+
7+
```plain
8+
GET /api/customField
9+
```
10+
11+
12+
## Response
13+
14+
### Status codes
15+
16+
- `200`: if query is run successfully
17+
- `401`: Authentication error
18+
- `403`: Authorization error
19+
20+
### Response Body Example
21+
22+
!!! Example ""
23+
24+
=== "200"
25+
26+
```json
27+
[
28+
{
29+
"id": "~28672",
30+
"name": "Number of Accounts",
31+
"reference": "Number of Accounts",
32+
"description": "Number of accounts leaked",
33+
"type": "integer",
34+
"options": [],
35+
"mandatory": true
36+
},
37+
{
38+
"id": "~53440",
39+
"name": "Nb of emails delivered",
40+
"reference": "Nb of emails delivered",
41+
"description": "Nb of emails delivered",
42+
"type": "integer",
43+
"options": [],
44+
"mandatory": true
45+
}
46+
]
47+
```
48+
49+
=== "401"
50+
51+
```json
52+
{
53+
"type": "AuthenticationError",
54+
"message": "Authentication failure"
55+
}
56+
```
57+
58+
=== "403"
59+
60+
```json
61+
{
62+
"type": "AuthorizationError",
63+
"message": "Your are not authorized to create custom field, you haven't the permission manageCustomField"
64+
}
65+
```

0 commit comments

Comments
 (0)