option for adding pcap to thehive

[n00mad]

SO2:
We have a feature request of:

When we escalate information to thehive, could we get the option to include the related pcap data as a
file reference in thehive.

Right now, we have to request a steno extract via the pcap pivot, download the pcap file,
repeat the drilldown, escalate,
attach the pcap file to thehive case - all manually - and all taking up cycles we would
rather use managing the case instead of manually building the case.

Thanks for your consideration. We made this request in this part of SO2 since multiple parts
of SO2 would be involved in the solution. We didn't see any similar feature requests after searching
the SO2 github or the thehive github.

n00mad
p.s.
version 2.3.60
Original install from SO2 ISO image
Install type: standalone
so-status - stable system, all services running
salt-call state.highstate results are clean

[weslambert]

Thanks for the feedback! This isn't officially supported at the moment, but I've got a couple ideas of how this might be accomplished.