Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a find_alerts method to search for alerts #31

Closed
nadouani opened this issue Aug 23, 2017 · 3 comments
Closed

Add a find_alerts method to search for alerts #31

nadouani opened this issue Aug 23, 2017 · 3 comments
Assignees
Milestone

Comments

@nadouani
Copy link
Contributor

nadouani commented Aug 23, 2017

Request Type

Feature Request

Problem Description

The goal here is to provide a function to search for alerts. This function should accept the following options: query, range and sort like the find_cases function

@nadouani nadouani added this to the 1.3.0 milestone Aug 23, 2017
@nadouani nadouani self-assigned this Aug 23, 2017
@nadouani
Copy link
Contributor Author

This is a usage example:

import json
from thehive4py.api import TheHiveApi

# Instanciate an API client
api = TheHiveApi('http://127.0.0.1:9000', 'username', 'password', {})

# Build the query that returns the Alerts with medium severity of type "siem"
query = {
    "_and": [
        {"type": "siem"},
        {"severity": 2}
    ]
}

# Call the alert find function
siem_alerts = api.find_alerts(query=query)

# Display the response
print(json.dumps(siem_alerts.json(), indent=4))

@Marsidi
Copy link

Marsidi commented Oct 9, 2019

Hello,
I am trying to make a query on alerts like this:

from thehive4py.api import TheHiveApi, Eq
from thehive4py.query import And, Between

api = TheHiveApi('http://127.0.0.1:9000', 'username', 'password', {})
sts = Eq('status', 'Ignored')
between = Between("startDate", '1570485600000', '1570572000000')
query = And(sts, between)
alerts = api.find_alerts(query=query)
response = json.loads(alerts.text)

But i get empty response list.
If i remove 'between' from query it works but i need the alerts between two dates.
PS:In this way is working perfectly to find the cases

@b00lpy
Copy link

b00lpy commented Sep 18, 2020

Guys, this library is still not working well..
I'm searching alerts by title
query=Eq("title","My alert title copy and pasted")

It should return at least one alert but this is not working...

Any suggestion?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants