Open remg427 opened 6 years ago
I am going to work on this topic. Any help welcome
Excited to see this happen, but I‘ve no knowledge in customizing otrs. Will ask a colleague about that, maybe he has a hint.
Basically OTRS -> TH can be done using the TH api, but is there an OTRS api? I really don‘t know.
@To-om maybe something similar to the MISP export possible?
I think this should be more open than just OTRS.
See #201
Hi,
OTRS has an API (here is the documentation: http://doc.otrs.com/doc/manual/admin/stable/en/html/genericinterface.html#genericinterface-connectors).
We did on our side an integration with OTRS using a thrid-party tool which interacts with both API (TheHive and OTRS) to extract case data from TheHive in ordre to create tickets in OTRS. We didn't need the "OTRS to TheHive" flow so we hadn't implemented it.
Here is the workflow we implemented:
ticket:type=otrs
(if handling several type of ticketing), ticket:id=<internal_ticket_id>
(for automated systems in case the ticket needs to be updated) and ticket:ref=<ticket_number>
(for human understanding)We haven't managed yet the fact that a ticket needs to be updated or how to deal with merged cases if at least one is linked to a ticket but are planning to. We are also working to integrate properly the injection of the case IOCs in OTRS.
This is a typical topic that can be discussed/implemented during a hackathon :)
@srilumpa what thrid-party tool you use?
Hi, a first working solution OTRS ticket to TheHive case has been published. https://github.com/remg427/otrs-th @srilumpa I would also interested in more details on the 3rd-party tool. Has anyone tried to use OTRS webservice to process the webhook request from TheHive?
@remg427, @andreaconsadoriw we are using Apache NiFi. We integrated in it the workflow to poll TheHive tasks to be automatically processed and, among those, the workflow to process OTRS tickets creation through the OTRS webservice.
@remg427 Thanks for sharing!
I still need to fix an issue with _OTRS value tonight
Le 18 mai 2018 10:58:28 GMT+02:00, Nils Kuhnert notifications@github.com a écrit :
@remg427 Thanks for sharing!
-- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: https://github.com/TheHive-Project/TheHive/issues/461#issuecomment-390142668
-- Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma brièveté.
worked on version 1.0.2 which creates a case in TH and keep records of both caseId (human readable) and id (for link in ticket zoom view) https://github.com/remg427/otrs-th. feeback more than welcome.
Will definitely try it out on a test instance, but I don't think I'm able to do it this week.
@srilumpa is your third-party tool that integrates OTRS and TheHive opensource?
Yes it is. You can find more information about NiFi here: https://nifi.apache.org/.
Keep in mind this is not a connector per say. NiFi handles data workflow. We are using for many other use cases than only to connect TheHive with OTRS (for example, we are using it to feed automatically TheHive with alerts, to transfer data from raw sources to aggregated datafeed for our reporting and so on...).
Integrating the workflow to create an OTRS ticket from a TheHive case was not out-of-the-box and needed to develop a bunch of scripts that are too specific to share, I'm afraid.
It is strongly possible that we migrate out of this mechanism as soon as #609 and/or TheHive-Project/Cortex#110 are available.
Thanks Srilumpa for sharing. I am going to test it for TH > OTRS
The python extension at https://github.com/remg427/otrs-th does create a case (using templates) in The_Hive from articles and dynamic_fields in OTRS (5.x or 6.x). next version will also process article attachments (emails) to extract observables (likely using imap2thehive.py )
Request Type
Feature Request
Integrate TheHive and OTRS 1-From OTRS ticket, create a case in TheHive: