search

Shuffle / python-apps

Apps to be used for Shuffle automation. 95 of Shuffle apps are generated from APIs, and not in this directory
https://shuffler.io/search
MIT License
99 stars 104 forks source link

[FR] TheHive: update/patch cases #205

Open pandvan opened 2 years ago

pandvan commented 2 years ago

Is your feature request related to a problem? Please describe. At the moment is only possible to update fields of an alert as of https://github.com/Shuffle/Shuffle-apps/blob/master/thehive/1.1.3/src/app.py#L468

Describe the solution you'd like I'd like to be able update fields also for cases.

Describe alternatives you've considered Leverage thehive4py to avoid direct API calls, https://thehive-project.github.io/TheHive4py/reference/api/#thehive4py.api.TheHiveApi.update_case But it doesn't seem very handy to use.

Additional context It's possible to achieve the same result using TheHive OpenAPI app but it would be more consistent to use only one app to execute all TheHive related actions.

frikky commented 2 years ago

Is your feature request related to a problem? Please describe. At the moment is only possible to update fields of an alert as of https://github.com/Shuffle/Shuffle-apps/blob/master/thehive/1.1.3/src/app.py#L468

Describe the solution you'd like I'd like to be able update fields also for cases.

Describe alternatives you've considered Leverage thehive4py to avoid direct API calls, https://thehive-project.github.io/TheHive4py/reference/api/#thehive4py.api.TheHiveApi.update_case But it doesn't seem very handy to use.

Additional context It's possible to achieve the same result using TheHive OpenAPI app but it would be more consistent to use only one app to execute all TheHive related actions.

Hey! This is a indeed a good idea.

I do however believe we'll end up migrating everything to OpenAPI now that it's more powerful, instead of manually adding more to the python one.

We could always add this action of course :fire:

D4rkw0lv3s commented 2 years ago

This is already possible...

You can update a case. For the customfields, you need to input the json for all customfields already present in the case. https://github.com/Shuffle/python-apps/blob/master/thehive/1.1.3/src/app.py#L667

To dynamically update a customfield you can in a previous node get the case data (json) copy the customfield json part and change the key value and call this new dict in the update case node.