The alert model API documentation lists "tags" as a required attribute, but TheHive version 3 doesn't include tags in the alert objects that are returned via the API if there aren't any and doesn't require them in alert objects that are submitted via the API.
I would suggest moving this to the "optional attributes" section
Example alert returned from TheHive 3 API:
date : 1601796212439
severity : 1
_routing : 230695f5a6b5610995b66403ba1656e1
updatedBy : admin
customFields :
_type : alert
description : Testing an alert. 1xjjnf5d ...some extra content
lastSyncDate : 1601796212614
source : Pester
title : Test alert: 1xjjnf5d [EDITED]
type : API
follow : True
createdAt : 1601796212612
_parent :
createdBy : admin
tlp : 2
_id : 230695f5a6b5610995b66403ba1656e1
id : 230695f5a6b5610995b66403ba1656e1
sourceRef : 70959
_version : 3
case : yH1SP3QBHNu4QDwp8Al7
artifacts : {}
updatedAt : 1601796220143
status : Imported
Edit: it looks like the same is true of the case model, which lists tags as "required" when they're not included in the objects returned by the API:
severity : 2
owner : admin
_routing : yH1SP3QBHNu4QDwp8Al7
flag : False
updatedBy : admin
customFields :
_type : case
description : Testing an alert.
#### Merged with alert #70959 Test alert: 1xjjnf5d [EDITED]
Testing an alert. 1xjjnf5d ...some extra content
title : Test alert
createdAt : 1598790233283
_parent :
createdBy : admin
caseId : 7
tlp : 2
metrics :
_id : yH1SP3QBHNu4QDwp8Al7
id : yH1SP3QBHNu4QDwp8Al7
_version : 5
pap : 2
startDate : 1598623605889
updatedAt : 1601796220104
status : Open
The alert model API documentation lists "tags" as a required attribute, but TheHive version 3 doesn't include tags in the alert objects that are returned via the API if there aren't any and doesn't require them in alert objects that are submitted via the API.
I would suggest moving this to the "optional attributes" section
Example alert returned from TheHive 3 API:
Edit: it looks like the same is true of the case model, which lists tags as "required" when they're not included in the objects returned by the API: