Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How to perform a bulk-insert of observables #263

Closed
aalini200 opened this issue Nov 21, 2022 · 2 comments
Closed

How to perform a bulk-insert of observables #263

aalini200 opened this issue Nov 21, 2022 · 2 comments

Comments

@aalini200
Copy link

I am an analyst and I created a case for a threat hunting project. I have 100+ IPs that I have to enter as observables in the HIVE. Is there a way to do a bulk insert instead of entering IPs one by one. Thanks.

@Kamforka
Copy link
Collaborator

Kamforka commented Nov 21, 2022

Please take a look at the API docs under the section of Create Alert.
In case you want to do it with thehive4py you want to use the TheHiveApi.alert.create method:

hive = TheHiveApi(url="https://my-hive.local", apikey="your-apikey")
hive.alert.create(alert={
    "sourceRef": "your-source-ref",
    "source": "your-alert-source",
    "type": "your-alert-type",
    "title": "your alert title",
    "description": "your alert description",
    "observables": [
        {"data": "192.168.0.1", "dataType": "ip"},
        {"data": "192.168.0.2", "dataType": "ip"},
        # all the observables can be listed here
        ]
    }
)

@Kamforka
Copy link
Collaborator

I assume the above answered the original question.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants