TheHive4py#
TheHive4py is a Python API client for TheHive, a scalable 3-in-1 open source and free security incident response platform designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly.
TheHive4py allows analysts to send alerts to TheHive out of different sources. Those alerts can then be previewed and imported into cases using pre-defined templates.
For example, a SOC may ask its constituency to send suspicious email reports to a specific mailbox that a script polls at regular intervals. When a new email is received, the script parses it then calls TheHive4py to create a corresponding alert in TheHive. Once the alert is raised, SOC analysts will get a notification thanks to TheHive's live stream so they can preview it and import it if deemed worth investigating using a specific template.
Features#
TheHive4py allows the following features:
- Search for alerts
- Create alert
- Get alert
- Update alert
- Mark alert as Read
- Mark alert as Read
- Promote alert to case
- Delete alert
- Create case from many alert
- Merge alert into an existing case
- Run responder on an alert
- Search for cases
- Get first case
- Create case
- Update case
- Delete case
- Get related cases
- Run responder on a case
- Search for tasks
- Create tasks
- Get task by id
- Update tasks
- Delete tasks
- Create task logs
- Get log by id
- List task logs by task id
- Search for task logs
- Download log attachment
- Run responder on a task
Installation#
On macOS and Linux, type:
sudo pip install thehive4py
or if you already installed it, update it by typing
sudo pip install -U thehive4py
If you are using Python on a Windows operating system, please forgo the sudo command.
License#
TheHive4py is an open source and free software released under the AGPL (Affero General Public License). We, TheHive Project, are committed to ensure that TheHive4py will remain a free and open source project on the long-run.
Updates#
Information, news and updates are regularly posted on TheHive Project Twitter account and on the blog.
Contributing#
We welcome your contributions. Please feel free to fork the code, play with it, make some patches and send us pull requests using issues.
We do have a Code of conduct. Make sure to check it out before contributing.
Support#
Please open an issue on GitHub if you'd like to report a bug or request a feature. We are also available on Gitter to help you out.
If you need to contact the project team, send an email to support@thehive-project.org.
Community Discussions#
We have set up a Google forum at https://groups.google.com/a/thehive-project.org/d/forum/users. To request access, you need a Google account. You may create one using a Gmail address or without one.