Master TheHive

# Login and retrieve token
# TheHive 5: generate an API key in the user profile,
# then send it as a Bearer header on every request
curl http://localhost:9000/api/v1/user/current \
  -H "Authorization: Bearer YOUR_API_KEY"

import requests

url = "http://localhost:9000/api/v1/case"
headers = {
    "Authorization": "Bearer YOUR_API_TOKEN",
    "Content-Type": "application/json"
}

data = {
    "title": "Phishing Campaign Detected",
    "description": "Multiple phishing emails detected targeting finance team",
    "severity": 3,  # 1=Low, 2=Medium, 3=High, 4=Critical
    "tlp": 2,       # 0=Clear, 1=Green, 2=Amber, 3=Amber+Strict, 4=Red
    "pap": 2,       # 0=White, 1=Green, 2=Amber, 3=Red
    "tags": ["phishing", "email", "finance"]
}

response = requests.post(url, headers=headers, json=data)
print(response.json())

# Add observables (IOCs) to a case
case_id = "~123456"
url = f"http://localhost:9000/api/v1/case/{case_id}/observable"

observables = [
    {
        "dataType": "ip",
        "data": "203.0.113.50",
        "tlp": 2,
        "ioc": True,
        "tags": ["malicious", "c2"],
        "message": "C2 server IP"
    },
    {
        "dataType": "domain",
        "data": "malicious.example",
        "tlp": 2,
        "ioc": True,
        "tags": ["phishing"]
    },
    {
        "dataType": "hash",
        "data": "d41d8cd98f00b204e9800998ecf8427e",
        "tlp": 2,
        "ioc": True
    }
]

for obs in observables:
    response = requests.post(url, headers=headers, json=obs)
    print(f"Observable created: {response.json()[0]['_id']}")

const axios = require('axios');

const caseId = '~123456';
const url = `http://localhost:9000/api/v1/case/${caseId}/task`;

const task = {
  title: "Analyze malware sample",
  description: "Submit sample to sandbox and analyze behavior",
  status: "Waiting",
  flag: false,
  startDate: Date.now(),
  dueDate: Date.now() + (24 * 60 * 60 * 1000), // 24h
  assignee: "analyst1@company.com"
};

axios.post(url, task, {
  headers: {
    'Authorization': 'Bearer YOUR_API_TOKEN',
    'Content-Type': 'application/json'
  }
})
.then(response => console.log('Task created:', response.data))
.catch(error => console.error('Error:', error));

# Case search with filters
url = "http://localhost:9000/api/v1/query"

query = {
    "query": [
        {
            "_name": "listCase"
        },
        {
            "_name": "filter",
            "_and": [
                {"_eq": {"_field": "severity", "_value": 3}},
                {"_eq": {"_field": "stage", "_value": "InProgress"}},
                {"_eq": {"_field": "tags", "_value": "phishing"}}
            ]
        },
        {
            "_name": "sort",
            "_fields": [
                {
                    "startDate": "desc"
                }
            ]
        },
        {
            "_name": "page",
            "from": 0,
            "to": 10
        }
    ]
}

response = requests.post(url, headers=headers, json=query)
cases = response.json()

for case in cases:
    print(f"Case: {case['title']} - Severity: {case['severity']}")

# Analyze an observable with Cortex
OBSERVABLE_ID="~789012"
ANALYZER_ID="VirusTotal_GetReport_3_0"

curl -X POST http://localhost:9000/api/connector/cortex/job \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "cortexId": "local-cortex",
    "artifactId": "'$OBSERVABLE_ID'",
    "analyzerId": "'$ANALYZER_ID'"
  }'

# Check the result
JOB_ID="returned_job_id"
curl -X GET http://localhost:9000/api/connector/cortex/job/$JOB_ID \
  -H "Authorization: Bearer YOUR_API_TOKEN"