thehive alerter: allow using field values for TLP and severity

Yelp / elastalert

Easy & Flexible Alerting With ElasticSearch

https://elastalert.readthedocs.org

Apache License 2.0

7.99k stars 1.74k forks source link

Open problematiq opened 5 years ago

problematiq commented 5 years ago

If not already possible, can we get the ability to use field values for the tlp: and severity: for hive alert? e.g:

tlp: '{match[alert.tlp]}'
severity: '{match[alert.severity]}'

ptobis commented 5 years ago

I vote for it and I also suggest to have this ability in the customFields: in TheHive alerter.

mdennison-ntc commented 4 years ago

I would also like this feature. Is it possible at the moment? What needs to be done to get this working?