Skip to content

Latest commit

 

History

History
142 lines (116 loc) · 4.56 KB

README.md

File metadata and controls

142 lines (116 loc) · 4.56 KB
Raw

goHive5

goHive5 is an unofficial API client library for the TheHive5 platform.

Some functionalities are still missing.
Please feel free to contribute or create issues for additional functionality requests.

Overview: goHive5

Check out examples for more examples.

TODO

  • Write tests for functions
  • Add more examples
  • Add administrative functions
  • Add more API coverage

Install

go get github.com/b401/gohive5
import "github.com/b401/gohive5"

Initialize a hive object

verifyCert := true
hive := thehive5.CreateLogin("https://thehive.example.com", "apitoken", verifyCert)

Create case example with customFields

tasks := []thehive5.CaseTask{
	thehive5.CaseTask{Title: "Identification", Status: "Waiting",Flag: true},
	thehive5.CaseTask{Title: "Containment", Description: "Please contain this threat"},
	thehive5.CaseTask{Title: "Eradication", Status: "InProgress", Mandatory: true},
}

caseObject := &thehive5.HiveCase { 
	Title: "case title",
	Description: "case description",
	Severity: "critical",
	Tlp: "amber",
	Pap: "amber",
	Tasks: &tasks,
	Tags: []string{"gohive5", "example", "case"},
	Flag: true,
}

ret, err := handler.CreateCase(caseObject); if err != nil {
	fmt.Println(err)
}

This will return a pointer to a HiveCaseResponse struct

type HiveCaseResponse struct {
	Id                  string        `json:"_id"`
	Title               string        `json:"title"`
	Number              int           `json:"number"`
	Description         string        `json:"description"`
	Status              string        `json:"status"`
	Stage               string        `json:"stage"`
	StartDate           time.Time     `json:"startDate"`
	Tlp                 int           `json:"tlp"`
	Pap                 int           `json:"pap"`
	Type                string        `json:"_type"`
	CreatedBy           string        `json:"_createdBy"`
	UpdatedBy           string        `json:"_updatedBy"`
	CreatedAt           time.Time     `json:"_createdAt"`
	UpdatedAt           time.Time     `json:"_updatedAt"`
	EndDate             time.Time     `json:"endDate"`
	Tags                []string      `json:"tags"`
	Flag                bool          `json:"flag"`
	TlpLabel            string        `json:"tlpLabel"`
	PapLabel            string        `json:"papLabel"`
	Summary             string        `json:"summary"`
	Severity            int           `json:"severity"`
	ImpactStatus        string        `json:"impactStatus"`
	Assignee            string        `json:"assignee"`
	CustomFields        []CustomField `json:"customFields"`
	UserPermissions     []string      `json:"userPermissions"`
	ExtraData           map[string]string 	  `json:"extraData"`
	NewDate             time.Time         `json:"newDate"`
	InProgressDate      time.Time         `json:"inProgressDate"`
	ClosedDate          time.Time         `json:"closedDate"`
	AlertDate           time.Time         `json:"alertDate"`
	AlertNewDate        time.Time         `json:"alertNewDate"`
	AlertInProgressDate time.Time         `json:"alertInProgressDate"`
	AlertImportedDate   time.Time         `json:"alertImportedDate"`
	TimeToDetect        time.Duration         `json:"timeToDetect"`
	TimeToTriage        time.Duration         `json:"timeToTriage"`
	TimeToQualify       time.Duration         `json:"timeToQualify"`
	TimeToAcknowledge   time.Duration         `json:"timeToAcknowledge"`
	TimeToResolve       time.Duration         `json:"timeToResolve"`
	HandlingDuration    time.Duration         `json:"handlingDuration"`
}

Create alert example with customFields & observables

observables := 	&[]thehive5.Observable {
	thehive5.Observable{DataType: "ip", Data: "8.8.8.8"},
	thehive5.Observable{DataType: "domain", Data: "google.com"},
}

// Create a new empty customField slice
customFields := &[]thehive5.CustomField{ thehive5.CustomField{ Name: "UUID", Group: "Group", Description: "UUID", Type: "string", Value: uuid.New()}}

alertObject := &thehive5.HiveAlert {
	Title: "Alert Title",
	Description: "Alert Description",
	Observables: observables,
	Status: "InProgress",
	Tlp: thehive5.TlpAmber.String(),
	Pap: thehive5.PapRed.String(),
	Severity: thehive5.SeverityHigh.String(),
	Tags: []string{"example", "tag"},
	Source: "Defender for Endpoint",
	SourceRef: "#123123124",
	ExternalLink: "https://uauth.io",
	CustomFields: customFields,
	Flag: true,
}

ret, err := handler.CreateAlert(alertObject); if err != nil {
	fmt.Printf("%+v", err)
}

hive.CreateAlert returns a pointer to an HiveAlertResponse struct