Skip to content

Commit e1c0748

Browse files
jeromeleonardjeromeleonard
committed
#10 update and format
1 parent 0647f0a commit e1c0748

File tree

4 files changed

+189
-64
lines changed

4 files changed

+189
-64
lines changed

‎docs/thehive/api/alert/.pages

+12-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,17 @@
11
nav:
2+
- list.md
23
- create.md
34
- update.md
5+
- read.md
46
- delete.md
57
- promote-as-case.md
6-
- merge.md
8+
- merge.md
9+
- similar-cases.md
10+
- list-observables.md
11+
- add-observable.md
12+
- update-observable.md
13+
- delete-observable.md
14+
- run-responder.md
15+
- list-responder-jobs.md
16+
17+

‎docs/thehive/api/alert/create.md

+48-44
Original file line numberDiff line numberDiff line change
@@ -11,22 +11,24 @@ POST /api/alert
1111

1212
## Request Body Example
1313

14-
```json
15-
{
16-
"artifacts": [],
17-
"description": "Imported from MISP Event #1311.",
18-
"severity": 0,
19-
"source": "misp server",
20-
"sourceRef": "1311",
21-
"tags": [
14+
!!! Example ""
15+
16+
```json
17+
{
18+
"artifacts": [],
19+
"description": "Imported from MISP Event #1311.",
20+
"severity": 0,
21+
"source": "misp server",
22+
"sourceRef": "1311",
23+
"tags": [
2224
"tlp:white",
2325
"type:OSINT"
24-
],
25-
"title": "CISA.gov - AA21-062A Mitigate Microsoft Exchange Server Vulnerabilities",
26-
"tlp": 0,
27-
"type": "MISP Event"
28-
}
29-
```
26+
],
27+
"title": "CISA.gov - AA21-062A Mitigate Microsoft Exchange Server Vulnerabilities",
28+
"tlp": 0,
29+
"type": "MISP Event"
30+
}
31+
```
3032

3133
The following fields are required:
3234

@@ -44,35 +46,37 @@ The following fields are required:
4446

4547
### Response Body Example
4648

47-
```json
48-
{
49-
"_id": "~987889880",
50-
"id": "~987889880",
51-
"createdBy": "[email protected]",
52-
"updatedBy": null,
53-
"createdAt": 1630323713949,
54-
"updatedAt": null,
55-
"_type": "alert",
56-
"type": "misp event",
57-
"source": "misp server",
58-
"sourceRef": "1311-2",
59-
"externalLink": null,
60-
"case": null,
61-
"title": "CISA.gov - AA21-062A Mitigate Microsoft Exchange Server Vulnerabilities",
62-
"description": "Imported from MISP Event #1311.",
63-
"severity": 0,
64-
"date": 1630323713937,
65-
"tags": [
49+
!!! Example ""
50+
51+
```json
52+
{
53+
"_id": "~987889880",
54+
"id": "~987889880",
55+
"createdBy": "[email protected]",
56+
"updatedBy": null,
57+
"createdAt": 1630323713949,
58+
"updatedAt": null,
59+
"_type": "alert",
60+
"type": "misp event",
61+
"source": "misp server",
62+
"sourceRef": "1311-2",
63+
"externalLink": null,
64+
"case": null,
65+
"title": "CISA.gov - AA21-062A Mitigate Microsoft Exchange Server Vulnerabilities",
66+
"description": "Imported from MISP Event #1311.",
67+
"severity": 0,
68+
"date": 1630323713937,
69+
"tags": [
6670
"tlp:pwhite",
6771
"type:OSINT",
68-
],
69-
"tlp": 0,
70-
"pap": 2,
71-
"status": "New",
72-
"follow": true,
73-
"customFields": {},
74-
"caseTemplate": null,
75-
"artifacts": [],
76-
"similarCases": []
77-
}
78-
```
72+
],
73+
"tlp": 0,
74+
"pap": 2,
75+
"status": "New",
76+
"follow": true,
77+
"customFields": {},
78+
"caseTemplate": null,
79+
"artifacts": [],
80+
"similarCases": []
81+
}
82+
```

‎docs/thehive/api/alert/delete.md

+4-11
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,9 @@ Delete an *Alert*.
88
DELETE /api/alert/{id}?force=1
99
```
1010

11+
## Response
1112

12-
## Request Body Example
13+
### Status codes
1314

14-
```json
15-
16-
```
17-
18-
19-
## Response Body Example
20-
21-
```json
22-
23-
```
15+
- `204`: if *Alert* is deleted successfully
16+
- `401`: Authentication error

‎docs/thehive/api/alert/update.md

+125-8
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,140 @@
11
# Update
22

3-
Update an existing Alert, like add observables, mark as read, update status ...
3+
Update an *Alert*.
44

55
## Query
66

7+
```plain
8+
PATCH /api/alert/{id}
79
```
810

9-
```
11+
with:
1012

13+
- `id`: id of the Alert
1114

12-
## Request Body Example
15+
## Request Body Example
1316

14-
```json
17+
!!! Example ""
18+
19+
```json
20+
{
21+
"description": "SIEM automated alert: the user [email protected] has posted information on a known phishing url. "
22+
}
23+
```
1524

16-
```
25+
## Response
26+
27+
### Status codes
1728

29+
- `200`: if *Alert* is updated successfully
30+
- `401`: Authentication error
1831

19-
## Response Body Example
32+
### Response Body Example
2033

21-
```json
34+
!!! Example ""
2235

23-
```
36+
```json
37+
{
38+
"_id": "~624443400",
39+
"id": "~624443400",
40+
"createdBy": "[email protected]",
41+
"updatedBy": null,
42+
"createdAt": 1620373264377,
43+
"updatedAt": null,
44+
"_type": "alert",
45+
"type": "external",
46+
"source": "SIEM",
47+
"sourceRef": "47e379",
48+
"externalLink": null,
49+
"case": null,
50+
"title": "User posted information on known phishing URL",
51+
"description": "SIEM automated alert: the user [email protected] has posted information on a known phishing url. ",
52+
"severity": 2,
53+
"date": 1620373264000,
54+
"tags": [
55+
"source:siem",
56+
"log-source:proxy"
57+
],
58+
"tlp": 3,
59+
"pap": 2,
60+
"status": "Ignored",
61+
"follow": true,
62+
"customFields": {
63+
"businessUnit": {
64+
"string": "Finance"
65+
},
66+
"location": {
67+
"string": "Sydney"
68+
}
69+
},
70+
"caseTemplate": null,
71+
"artifacts": [
72+
{
73+
"_id": "~665772152",
74+
"id": "~665772152",
75+
"createdBy": "[email protected]",
76+
"createdAt": 1620373264410,
77+
"_type": "case_artifact",
78+
"dataType": "username",
79+
"data": "[email protected]",
80+
"startDate": 1620373264410,
81+
"tlp": 2,
82+
"tags": [],
83+
"ioc": false,
84+
"sighted": false,
85+
"reports": {},
86+
"stats": {}
87+
},
88+
{
89+
"_id": "~677015568",
90+
"id": "~677015568",
91+
"createdBy": "[email protected]",
92+
"createdAt": 1620373264398,
93+
"_type": "case_artifact",
94+
"dataType": "domain",
95+
"data": "pl-getbuys.icu",
96+
"startDate": 1620373264398,
97+
"tlp": 2,
98+
"tags": [],
99+
"ioc": false,
100+
"sighted": false,
101+
"reports": {},
102+
"stats": {}
103+
},
104+
{
105+
"_id": "~677019664",
106+
"id": "~677019664",
107+
"createdBy": "[email protected]",
108+
"createdAt": 1620373264405,
109+
"_type": "case_artifact",
110+
"dataType": "mail",
111+
"data": "[email protected]",
112+
"startDate": 1620373264405,
113+
"tlp": 2,
114+
"tags": [],
115+
"ioc": false,
116+
"sighted": false,
117+
"reports": {},
118+
"stats": {}
119+
},
120+
{
121+
"_id": "~706650224",
122+
"id": "~706650224",
123+
"createdBy": "[email protected]",
124+
"createdAt": 1620373264391,
125+
"_type": "case_artifact",
126+
"dataType": "url",
127+
"data": "https://poczta.pl-getbuys.icu/",
128+
"startDate": 1620373264391,
129+
"tlp": 2,
130+
"tags": [],
131+
"ioc": false,
132+
"sighted": false,
133+
"message": "http method: POST",
134+
"reports": {},
135+
"stats": {}
136+
}
137+
],
138+
"similarCases": []
139+
}
140+
```

0 commit comments

Comments
 (0)