Skip to content

Commit 5e6533f

Browse files
CSOAR-3239 : The Hive integration fails with error message about start-date and also certificate warning (#5394)
* CSOAR-3239 : Updated the thehive doc * CSOAR-3239 : minor fix * Updates from review --------- Co-authored-by: John Pipkin <[email protected]>
1 parent 0fbabf5 commit 5e6533f

File tree

2 files changed

+77
-2
lines changed
  • docs/platform-services/automation-service/app-central/integrations
  • static/img/platform-services/automation-service/app-central/integrations/misc

2 files changed

+77
-2
lines changed

docs/platform-services/automation-service/app-central/integrations/thehive.md

Lines changed: 77 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,31 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
66

77
<img src={useBaseUrl('/img/platform-services/automation-service/app-central/logos/thehive.png')} alt="thehive" width="80"/>
88

9-
***Version: 1.0.1
10-
Updated: Jul 03, 2023***
9+
***Version: 1.2
10+
Updated: May 22, 2025***
1111

1212
Query, update, and work with cases in TheHive from Cloud SOAR.
1313

14+
## Overview
15+
16+
### Purpose
17+
18+
This integration enables seamless interaction with TheHive platform, allowing case and observable management. It supports creating, updating, and searching cases and observables.
19+
20+
### Use cases
21+
22+
* Create and update incident cases/observables.
23+
* Search for existing cases or observables matching specific criteria.
24+
* Find similar observables.
25+
* Retrieve detailed information about a case or observable for investigation.
26+
27+
### Supported versions
28+
* TheHive 5.x
29+
30+
### Prerequisites
31+
* A working instance of TheHive with API access enabled.
32+
* API key with appropriate permissions.
33+
1434
## Actions
1535

1636
* **Create Case** (*Notification*) - Create a new case.
@@ -29,11 +49,66 @@ import IntegrationsAuth from '../../../../reuse/integrations-authentication.md';
2949

3050
<IntegrationsAuth/>
3151

52+
* **API Key**. A unique token used to authenticate API requests to TheHive.
53+
* **Server URL**. The base URL (hostname or IP address) of your TheHive server.
54+
* **Port**. (Optional) The port number on which TheHive is accessible.
55+
* **Organization Name**. (Optional) The name of the organization context in multi-tenant deployments of TheHive.
56+
* **Automation Engine**. Select **Cloud execution** for this certified integration. Select a bridge option only for a custom integration. See [Cloud or Bridge execution](/docs/platform-services/automation-service/automation-service-integrations/#cloud-or-bridge-execution).
57+
3258
<img src={useBaseUrl('/img/platform-services/automation-service/app-central/integrations/misc/thehive-configuration.png')} style={{border:'1px solid gray'}} alt="TheHive configuration" width="400"/>
3359

3460
For information about TheHive, see [TheHive documentation](https://docs.strangebee.com/).
3561

62+
## Usage
63+
64+
### Basic usage
65+
* Create Case: Provide case title, severity, TLP, tags, and other metadata to create a new case in TheHive.
66+
* Create Observable: Supply caseId, data, dataType, and other metadata to attach observables to a case.
67+
* Get Case/Observable: Retrieve full metadata for any case or observable using its unique ID.
68+
69+
### Advanced usage
70+
* Search Case/Observable: Use complex queries to find matching cases or observables using filters.
71+
* Find Similar Observables: compare observables with similar traits across multiple cases.
72+
* Update Case/Observable: Modify fields like TLP, tags, status, or timestamps.
73+
74+
## API reference
75+
76+
### Configuration
77+
To configure the integration:
78+
* API Key: A unique token used to authenticate API requests to TheHive.
79+
* Server URL and Port: Define the host and port of TheHive instance (port is optional).
80+
* Organization Name (optional): Organization name.
81+
82+
### Enrichment API
83+
* Create Observable
84+
* Update Observable
85+
* Search Observable/Case
86+
* Use filtering parameters (dataType, tags, date, etc.) to retrieve specific artifacts or cases.
87+
88+
### Rate Limits and Quotas
89+
* There are no specific limits enforced by TheHive unless configured externally.
90+
91+
#### Troubleshooting
92+
* Forbidden (403): Check API key.
93+
* Not Found (404): Ensure IDs like caseId or artifactId are correct.
94+
* Validation Errors: Ensure correct formatting of fields like range (start-end), timestamps, or tags.
95+
96+
### FAQ
97+
98+
#### What happens if an invalid range is passed?
99+
The input will be cleaned (e.g., 5 - 10 to 5-10) and validated. If the format is incorrect or the range is invalid (start > end), an error is raised.
100+
101+
### Support
102+
For issues, questions, or improvements:
103+
* Use the Sumo Logic logs and API error messages for initial debugging.
104+
* Refer to TheHive [official documentation](https://docs.thehive-project.org/)
105+
36106
## Change Log
37107

38108
* January 29, 2019 - First upload
39109
* July 3, 2023 (v1.1) - Updated the integration with Environmental Variables
110+
* May 22, 2025 (v1.2) – Modified TheHive integration with case and observable enhancements:
111+
* Fixed parsing issues for date related inputs with inconsistent formatting.
112+
* Fixed ssl related warning issues.
113+
* Added organization name field in resource which will included in the headers.
114+
* Enhanced error handling and made the integration more resilient to malformed inputs.
39.7 KB
Loading

0 commit comments

Comments
 (0)