Maîtriser TheHive

# Login et récupération du token
curl -X POST http://localhost:9000/api/v1/login \
  -H "Content-Type: application/json" \
  -d '{
    "username": "admin@thehive.local",
    "password": "secret"
  }'

# Réponse
{
  "success": true,
  "token": "YOUR_API_TOKEN_HERE"
}

import requests

url = "http://localhost:9000/api/v1/case"
headers = {
    "Authorization": "Bearer YOUR_API_TOKEN",
    "Content-Type": "application/json"
}

data = {
    "title": "Phishing Campaign Detected",
    "description": "Multiple phishing emails detected targeting finance team",
    "severity": 3,  # 1=Low, 2=Medium, 3=High, 4=Critical
    "tlp": 2,       # 0=White, 1=Green, 2=Amber, 3=Red
    "pap": 2,       # 0=White, 1=Green, 2=Amber, 3=Red
    "tags": ["phishing", "email", "finance"],
    "customFields": {
        "businessUnit": {
            "string": "Finance Department"
        }
    }
}

response = requests.post(url, headers=headers, json=data)
print(response.json())

# Ajouter des observables (IOCs) à un cas
case_id = "~123456"
url = f"http://localhost:9000/api/v1/case/{case_id}/artifact"

observables = [
    {
        "dataType": "ip",
        "data": "192.168.1.100",
        "tlp": 2,
        "ioc": True,
        "tags": ["malicious", "c2"],
        "message": "C2 server IP"
    },
    {
        "dataType": "domain",
        "data": "malicious.com",
        "tlp": 2,
        "ioc": True,
        "tags": ["phishing"]
    },
    {
        "dataType": "hash",
        "data": "d41d8cd98f00b204e9800998ecf8427e",
        "tlp": 2,
        "ioc": True
    }
]

for obs in observables:
    response = requests.post(url, headers=headers, json=obs)
    print(f"Observable created: {response.json()['_id']}")

const axios = require('axios');

const caseId = '~123456';
const url = `http://localhost:9000/api/v1/case/${caseId}/task`;

const task = {
  title: "Analyze malware sample",
  description: "Submit sample to sandbox and analyze behavior",
  status: "Waiting",
  flag: false,
  startDate: Date.now(),
  dueDate: Date.now() + (24 * 60 * 60 * 1000), // 24h
  assignee: "analyst1@company.com"
};

axios.post(url, task, {
  headers: {
    'Authorization': 'Bearer YOUR_API_TOKEN',
    'Content-Type': 'application/json'
  }
})
.then(response => console.log('Task created:', response.data))
.catch(error => console.error('Error:', error));

# Recherche de cas avec filtres
url = "http://localhost:9000/api/v1/query"

query = {
    "query": [
        {
            "_name": "listCase"
        },
        {
            "_name": "filter",
            "_and": [
                {
                    "_field": "severity",
                    "_value": 3
                },
                {
                    "_field": "status",
                    "_value": "Open"
                },
                {
                    "_field": "tags",
                    "_value": "phishing"
                }
            ]
        },
        {
            "_name": "sort",
            "_fields": [
                {
                    "startDate": "desc"
                }
            ]
        },
        {
            "_name": "page",
            "from": 0,
            "to": 10
        }
    ]
}

response = requests.post(url, headers=headers, json=query)
cases = response.json()

for case in cases:
    print(f"Case: {case['title']} - Severity: {case['severity']}")

# Analyser un observable avec Cortex
OBSERVABLE_ID="~789012"
ANALYZER_ID="VirusTotal_GetReport_3_0"

curl -X POST http://localhost:9000/api/v1/connector/cortex/job \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "cortexId": "local-cortex",
    "artifactId": "'$OBSERVABLE_ID'",
    "analyzerId": "'$ANALYZER_ID'"
  }'

# Vérifier le résultat
JOB_ID="returned_job_id"
curl -X GET http://localhost:9000/api/v1/connector/cortex/job/$JOB_ID \
  -H "Authorization: Bearer YOUR_API_TOKEN"