Skip to content

Commit 6fa4327

Browse files
rmurray-r7rmurray-r7
authored
snyk and sdk - thehive 5.0.2 (#2935)
1 parent 20fb887 commit 6fa4327

File tree

8 files changed

+115
-82
lines changed

8 files changed

+115
-82
lines changed

‎plugins/thehive/.CHECKSUM

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
2-
"spec": "2d883aeb1845e3c4fce681107d7fdd2c",
3-
"manifest": "b004976d0de9ad7230f2d1613f70fbcf",
4-
"setup": "5c11e585dc121982d6e27614a40b1958",
2+
"spec": "280d98e34d32fcbac373bbb57c593988",
3+
"manifest": "a18dcfc142958b4ad36ede24ee57dcd8",
4+
"setup": "f1bc5d835ef85034c6d38144e348ad89",
55
"schemas": [
66
{
77
"identifier": "close_case/schema.py",

‎plugins/thehive/Dockerfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM --platform=linux/amd64 rapid7/insightconnect-python-3-slim-plugin:5
1+
FROM --platform=linux/amd64 rapid7/insightconnect-python-3-slim-plugin:6.2.0
22

33
LABEL organization=rapid7
44
LABEL sdk=python
@@ -12,7 +12,7 @@ RUN if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
1212

1313
ADD . /python/src
1414

15-
RUN python setup.py build && python setup.py install
15+
RUN python setup.py build && python setup.py install
1616

1717
# User to run plugin code. The two supported users are: root, nobody
1818
USER nobody

‎plugins/thehive/bin/komand_thehive

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ from sys import argv
66

77
Name = "TheHive"
88
Vendor = "rapid7"
9-
Version = "5.0.1"
9+
Version = "5.0.2"
1010
Description = "TheHive is a scalable, open source security incident response solution designed for SOCs & CERTs to collaborate, elaborate, analyze and get their job done"
1111

1212

‎plugins/thehive/help.md

Lines changed: 69 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
# Description
22

3-
TheHive is a scalable, open source security incident response solution designed for SOCs & CERTs to collaborate,
4-
elaborate, analyze and get their job done
3+
TheHive is a scalable, open source security incident response solution designed for SOCs & CERTs to collaborate, elaborate, analyze and get their job done
54

65
# Key Features
76

@@ -17,25 +16,25 @@ elaborate, analyze and get their job done
1716
* TheHive username and password
1817

1918
# Supported Product Versions
20-
19+
2120
* 2023-05-17
2221

2322
# Documentation
2423

2524
## Setup
26-
25+
2726
The connection configuration accepts the following parameters:
2827

29-
|Name|Type|Default|Required|Description|Enum|Example|
30-
| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
31-
|api_key|credential_secret_key|None|False|An optional API key for authentication via bearer token|None|9de5069c5afe602b2ea0a04b66beb2c0|
32-
|credentials|credential_username_password|None|False|Username and password|None|{}|
33-
|host|string|None|True|TheHive host|None|thehive.company.com or 10.3.4.50|
34-
|port|string|9000|True|TheHive API port|None|9000|
35-
|protocol|string|None|True|HTTP Protocol|['http', 'https']|http|
36-
|proxy|object|None|False|An optional dictionary containing proxy data, with HTTP or HTTPS as the key, and the proxy URL as the value|None|{}|
37-
|verify|boolean|True|True|Verify the certificate|None|True|
38-
28+
|Name|Type|Default|Required|Description|Enum|Example|Placeholder|Tooltip|
29+
| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
30+
|api_key|credential_secret_key|None|False|An optional API key for authentication via bearer token|None|9de5069c5afe602b2ea0a04b66beb2c0|None|None|
31+
|credentials|credential_username_password|None|False|Username and password|None|{}|None|None|
32+
|host|string|None|True|TheHive host|None|thehive.company.com or 10.3.4.50|None|None|
33+
|port|string|9000|True|TheHive API port|None|9000|None|None|
34+
|protocol|string|None|True|HTTP Protocol|["http", "https"]|http|None|None|
35+
|proxy|object|None|False|An optional dictionary containing proxy data, with HTTP or HTTPS as the key, and the proxy URL as the value|None|{}|None|None|
36+
|verify|boolean|True|True|Verify the certificate|None|True|None|None|
37+
3938
Example input:
4039

4140
```
@@ -61,10 +60,10 @@ Close a case by ID
6160

6261
##### Input
6362

64-
|Name|Type|Default|Required|Description|Enum|Example|
65-
| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
66-
|force|boolean|False|False|True to physically delete the case, False to mark the case as delete|None|False|
67-
|id|string|None|True|ID for the case|None|50|
63+
|Name|Type|Default|Required|Description|Enum|Example|Placeholder|Tooltip|
64+
| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
65+
|force|boolean|False|False|True to physically delete the case, False to mark the case as delete|None|False|None|None|
66+
|id|string|None|True|ID for the case|None|50|None|None|
6867

6968
Example input:
7069

@@ -95,21 +94,21 @@ Create a new case
9594

9695
##### Input
9796

98-
|Name|Type|Default|Required|Description|Enum|Example|
99-
| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
100-
|customFields|object|None|False|Case custom fields|None|{}|
101-
|description|string|None|False|Description of the case, supports markdown|None|Case description|
102-
|flag|boolean|False|False|Case's flag, True to mark case as important|None|True|
103-
|jsonData|object|None|False|If the field is not equal to None, the case is instantiated using the JSON value instead of the arguements|None|{}|
104-
|metrics|object|None|False|Case metrics collection. A JSON object where keys are defining metric name, and values are defining metric value|None|{}|
105-
|owner|string|None|False|Case's assignee|None|admin|
106-
|pap|integer|2|False|Password Authentication Protocol|[0, 1, 2, 3]|2|
107-
|severity|integer|2|False|Case severity|[1, 2, 3, 4]|2|
108-
|startDate|integer|None|False|Case start date (datetime in ms) (will default to now if left blank)|None|1684170163000|
109-
|tags|[]string|None|False|List of case tags|None|["case_tag_1", "case_tag_2"]|
110-
|template|string|None|False|Case template's name. If specified then the case is created using the given template|None|Case template name|
111-
|title|string|None|True|Name of the case|None|Case title|
112-
|tlp|integer|2|False|Traffic Light Protocol level|[0, 1, 2, 3]|2|
97+
|Name|Type|Default|Required|Description|Enum|Example|Placeholder|Tooltip|
98+
| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
99+
|customFields|object|None|False|Case custom fields|None|{}|None|None|
100+
|description|string|None|False|Description of the case, supports markdown|None|Case description|None|None|
101+
|flag|boolean|False|False|Case's flag, True to mark case as important|None|True|None|None|
102+
|jsonData|object|None|False|If the field is not equal to None, the case is instantiated using the JSON value instead of the arguements|None|{}|None|None|
103+
|metrics|object|None|False|Case metrics collection. A JSON object where keys are defining metric name, and values are defining metric value|None|{}|None|None|
104+
|owner|string|None|False|Case's assignee|None|admin|None|None|
105+
|pap|integer|2|False|Password Authentication Protocol|[0, 1, 2, 3]|2|None|None|
106+
|severity|integer|2|False|Case severity|[1, 2, 3, 4]|2|None|None|
107+
|startDate|integer|None|False|Case start date (datetime in ms) (will default to now if left blank)|None|1684170163000|None|None|
108+
|tags|[]string|None|False|List of case tags|None|["case_tag_1", "case_tag_2"]|None|None|
109+
|template|string|None|False|Case template's name. If specified then the case is created using the given template|None|Case template name|None|None|
110+
|title|string|None|True|Name of the case|None|Case title|None|None|
111+
|tlp|integer|2|False|Traffic Light Protocol level|[0, 1, 2, 3]|2|None|None|
113112

114113
Example input:
115114

@@ -177,20 +176,20 @@ Create a new case observable
177176

178177
##### Input
179178

180-
|Name|Type|Default|Required|Description|Enum|Example|
181-
| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
182-
|data|string|None|False|Observable's data|None|Test data for observable|
183-
|datatype|string|None|False|Observables Data Type|None|domain, ip, url, fqdn, uri_path, user-agent, hash, email, mail, mail_subject, registry, regexp, other|
184-
|id|string|None|False|ID for the case|None|AYgQXmjbfMffAh_St-fk|
185-
|ignoreSimilarity|boolean|False|False|Observable's similarity ignore flag. True to ignore the observable during similarity computing|None|False|
186-
|ioc|boolean|False|False|Observable's IOC, True to mark an observable as IOC|None|False|
187-
|jsonData|object|None|False|All fields included in one JSON object. If using this, all other fields will be ignored|None|json object containing all necessary fields|
188-
|message|string|None|False|Observable's description. If tags is empty, this is required|None|Observable message|
189-
|pap|integer|2|False|Case's PAP|[0, 1, 2, 3]|2|
190-
|sighted|boolean|False|False|Observable's sighted flag, True to mark the observable as sighted|None|False|
191-
|startDate|integer|None|False|Observable start date (datetime in ms) (will default to now if left blank)|None|1640000000000|
192-
|tags|[]string|None|False|List of observable tags, required if message is None|None|["tag_one", "tag_two"]|
193-
|tlp|integer|2|False|Case's TLP|[0, 1, 2, 3]|2|
179+
|Name|Type|Default|Required|Description|Enum|Example|Placeholder|Tooltip|
180+
| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
181+
|data|string|None|False|Observable's data|None|Test data for observable|None|None|
182+
|datatype|string|None|False|Observables Data Type|None|domain, ip, url, fqdn, uri_path, user-agent, hash, email, mail, mail_subject, registry, regexp, other|None|None|
183+
|id|string|None|False|ID for the case|None|AYgQXmjbfMffAh_St-fk|None|None|
184+
|ignoreSimilarity|boolean|False|False|Observable's similarity ignore flag. True to ignore the observable during similarity computing|None|False|None|None|
185+
|ioc|boolean|False|False|Observable's IOC, True to mark an observable as IOC|None|False|None|None|
186+
|jsonData|object|None|False|All fields included in one JSON object. If using this, all other fields will be ignored|None|json object containing all necessary fields|None|None|
187+
|message|string|None|False|Observable's description. If tags is empty, this is required|None|Observable message|None|None|
188+
|pap|integer|2|False|Case's PAP|[0, 1, 2, 3]|2|None|None|
189+
|sighted|boolean|False|False|Observable's sighted flag, True to mark the observable as sighted|None|False|None|None|
190+
|startDate|integer|None|False|Observable start date (datetime in ms) (will default to now if left blank)|None|1640000000000|None|None|
191+
|tags|[]string|None|False|List of observable tags, required if message is None|None|["tag_one", "tag_two"]|None|None|
192+
|tlp|integer|2|False|Case's TLP|[0, 1, 2, 3]|2|None|None|
194193

195194
Example input:
196195

@@ -244,16 +243,16 @@ Create a new case task
244243

245244
##### Input
246245

247-
|Name|Type|Default|Required|Description|Enum|Example|
248-
| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
249-
|description|string|None|False|Task's description|None|Task description|
250-
|flag|boolean|False|False|Task's flag, 'True' to mark the task as important|None|False|
251-
|id|string|None|False|ID for the case|None|AYgQXmjbfMffAh_St-fk|
252-
|jsonData|object|None|False|If the field is not equal to None, the Task is instantiated using the JSON value instead of the arguements|None|json object containing all necessary fields|
253-
|owner|string|None|False|Task's assignee|None|admin|
254-
|startDate|integer|None|False|Task's start date (datetime in ms) (will default to now if left blank)|None|1684170163000|
255-
|status|string|Waiting|False|Task's status|['Waiting', 'InProgress', 'Cancel', 'Completed']|Waiting|
256-
|title|string|None|False|Task's title|None|Task title|
246+
|Name|Type|Default|Required|Description|Enum|Example|Placeholder|Tooltip|
247+
| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
248+
|description|string|None|False|Task's description|None|Task description|None|None|
249+
|flag|boolean|False|False|Task's flag, 'True' to mark the task as important|None|False|None|None|
250+
|id|string|None|False|ID for the case|None|AYgQXmjbfMffAh_St-fk|None|None|
251+
|jsonData|object|None|False|If the field is not equal to None, the Task is instantiated using the JSON value instead of the arguements|None|json object containing all necessary fields|None|None|
252+
|owner|string|None|False|Task's assignee|None|admin|None|None|
253+
|startDate|integer|None|False|Task's start date (datetime in ms) (will default to now if left blank)|None|1684170163000|None|None|
254+
|status|string|Waiting|False|Task's status|["Waiting", "InProgress", "Cancel", "Completed"]|Waiting|None|None|
255+
|title|string|None|False|Task's title|None|Task title|None|None|
257256

258257
Example input:
259258

@@ -303,9 +302,9 @@ Retrieve a case by ID
303302

304303
##### Input
305304

306-
|Name|Type|Default|Required|Description|Enum|Example|
307-
| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
308-
|id|string|None|True|ID for the case|None|50|
305+
|Name|Type|Default|Required|Description|Enum|Example|Placeholder|Tooltip|
306+
| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
307+
|id|string|None|True|ID for the case|None|50|None|None|
309308

310309
Example input:
311310

@@ -434,8 +433,8 @@ Example output:
434433
```
435434

436435
#### Get Current User
437-
438-
Get information about the current user
436+
437+
This action is used to get information about the current user
439438

440439
##### Input
441440

@@ -461,9 +460,9 @@ Get information about a specific user
461460

462461
##### Input
463462

464-
|Name|Type|Default|Required|Description|Enum|Example|
465-
| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
466-
|id|string|None|True|The ID of the user|None|50|
463+
|Name|Type|Default|Required|Description|Enum|Example|Placeholder|Tooltip|
464+
| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
465+
|id|string|None|True|The ID of the user|None|50|None|None|
467466

468467
Example input:
469468

@@ -486,11 +485,9 @@ Example output:
486485
"success": {}
487486
}
488487
```
489-
490488
### Triggers
491489

492490
*This plugin does not contain any triggers.*
493-
494491
### Tasks
495492

496493
*This plugin does not contain any tasks.*
@@ -594,12 +591,14 @@ Example output:
594591
|TLP|integer|None|None|Traffic Light Protocol level|None|
595592
|user|string|None|None|Observable user|None|
596593

594+
597595
## Troubleshooting
598596

599-
*There is no troubleshooting for this plugin.*
597+
*This plugin does not contain a troubleshooting.*
600598

601599
# Version History
602600

601+
* 5.0.2 - Updating requirements.txt | SDK bump to 6.2.0
603602
* 5.0.1 - Update requests module to version 2.31.0
604603
* 5.0.0 - Refactor: Fixed issues in previous refactor that caused connection issues and made the schemas for actions more compatible with outputs.
605604
* 4.0.0 - Added additional error handling for issues that occur outside the expected status codes | Action: `create_case` remade to not include task input
@@ -612,7 +611,7 @@ Example output:
612611
* 2.0.0 - Update to new credential types
613612
* 1.0.0 - Custom Field support added to Create Case action | Support web server mode
614613
* 0.2.0 - Bug fix, add more input variables for Close Case action
615-
* 0.1.2 - Bug fix for constant "waiting" in Status field | Updated to v2 architecture
614+
* 0.1.2 - Bug fix for constant 'waiting' in Status field | Updated to v2 architecture
616615
* 0.1.1 - SSL bug fix in SDK
617616
* 0.1.0 - Initial plugin
618617

@@ -622,4 +621,4 @@ Example output:
622621

623622
## References
624623

625-
* [thehive4py docs](https://github.com/TheHive-Project/TheHive4py/blob/master/thehive4py/api.py)
624+
* [thehive4py docs](https://github.com/TheHive-Project/TheHive4py/blob/master/thehive4py/api.py)

‎plugins/thehive/plugin.spec.yaml

Lines changed: 34 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ products: [insightconnect]
44
name: thehive
55
title: TheHive
66
description: "TheHive is a scalable, open source security incident response solution designed for SOCs & CERTs to collaborate, elaborate, analyze and get their job done"
7-
version: 5.0.1
7+
version: 5.0.2
8+
connection_version: 5
89
supported_versions: ["2023-05-17"]
910
vendor: rapid7
1011
support: community
@@ -14,8 +15,8 @@ resources:
1415
license_url: https://github.com/rapid7/insightconnect-plugins/blob/master/LICENSE
1516
vendor_url: https://thehive-project.org
1617
sdk:
17-
type: full
18-
version: 5
18+
type: slim
19+
version: 6.2.0
1920
user: nobody
2021
tags:
2122
- thehive
@@ -24,6 +25,36 @@ hub_tags:
2425
use_cases: [remediation_management]
2526
keywords: [thehive, intel]
2627
features: []
28+
requirements:
29+
- "TheHive instance hostname, usually an IP address"
30+
- "TheHive username and password"
31+
key_features:
32+
- "Retrieve a list of cases or a specific case by ID"
33+
- "Create a new case and close an existing case"
34+
- "Create new tasks within a case"
35+
- "Create new observables within a case"
36+
- "Get user information"
37+
links:
38+
- "[TheHive](https://thehive-project.org/)"
39+
references:
40+
- "[thehive4py docs](https://github.com/TheHive-Project/TheHive4py/blob/master/thehive4py/api.py)"
41+
version_history:
42+
- "5.0.2 - Updating requirements.txt | SDK bump to 6.2.0"
43+
- "5.0.1 - Update requests module to version 2.31.0"
44+
- "5.0.0 - Refactor: Fixed issues in previous refactor that caused connection issues and made the schemas for actions more compatible with outputs."
45+
- "4.0.0 - Added additional error handling for issues that occur outside the expected status codes | Action: `create_case` remade to not include task input"
46+
- "3.0.0 - Refactored plugin | Removed `thehive4py` dependency | Action: Split `get_user` into two new actions, `get_user_by_id` & `get_current_user`"
47+
- "2.0.5 - New spec and help.md format for the Extension Library. Update help key features and fix description capitalisation"
48+
- "2.0.4 - Update to use the `komand/python-2-27-slim-plugin` Docker image to reduce plugin size and to support SSL Verify"
49+
- "2.0.3 - Fix issue where SSL Verify was not used in actions that utilize requests | Updated test method and moved it to connection"
50+
- "2.0.2 - Fix issue where SSL Verify was not used in the connection"
51+
- "2.0.1 - Update descriptions"
52+
- "2.0.0 - Update to new credential types"
53+
- "1.0.0 - Custom Field support added to Create Case action | Support web server mode"
54+
- "0.2.0 - Bug fix, add more input variables for Close Case action"
55+
- "0.1.2 - Bug fix for constant 'waiting' in Status field | Updated to v2 architecture"
56+
- "0.1.1 - SSL bug fix in SDK"
57+
- "0.1.0 - Initial plugin"
2758
enable_cache: true
2859
language: python
2960
connection:

‎plugins/thehive/requirements.txt

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,4 @@
22
# All dependencies must be version-pinned, eg. requests==1.2.0
33
# See: https://pip.pypa.io/en/stable/user_guide/#requirements-files
44
python-magic==0.4.15
5-
requests==2.31.0
6-
parameterized==0.8.1
5+
parameterized==0.8.1

‎plugins/thehive/setup.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44

55
setup(name="thehive-rapid7-plugin",
6-
version="5.0.1",
6+
version="5.0.2",
77
description="TheHive is a scalable, open source security incident response solution designed for SOCs & CERTs to collaborate, elaborate, analyze and get their job done",
88
author="rapid7",
99
author_email="",

‎plugins/thehive/unit_test/__init__.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT
2+
import sys
3+
4+
sys.path.append("../")

0 commit comments

Comments
 (0)