API Reference

`thehive4py`

`client`

`TheHiveApi(url, apikey=None, username=None, password=None, organisation=None, verify=True, max_retries=DEFAULT_RETRY)`

Create a client of TheHive API.

Parameters:

Name	Type	Description	Default
`url`	`str`	TheHive's url.	required
`apikey`	`Optional[str]`	TheHive's apikey. It's required if `username` and `password` is not provided.	`None`
`username`	`Optional[str]`	TheHive's username. It's required if `apikey` is not provided. Must be specified together with `password`.	`None`
`password`	`Optional[str]`	TheHive's password. It's required if `apikey` is not provided. Must be specified together with `username`.	`None`
`organisation`	`Optional[str]`	TheHive organisation to use in the session.	`None`
`verify`	`VerifyValue`	Either a boolean, in which case it controls whether we verify the server's TLS certificate, or a string, in which case it must be a path to a CA bundle to use.	`True`
`max_retries`	`RetryValue`	Either `None`, in which case we do not retry failed requests, or a `Retry` object.	`DEFAULT_RETRY`

Source code in thehive4py/client.py

def __init__(
    self,
    url: str,
    apikey: Optional[str] = None,
    username: Optional[str] = None,
    password: Optional[str] = None,
    organisation: Optional[str] = None,
    verify: VerifyValue = True,
    max_retries: RetryValue = DEFAULT_RETRY,
):
    """Create a client of TheHive API.

    Parameters:
        url: TheHive's url.
        apikey: TheHive's apikey. It's required if `username` and `password`
            is not provided.
        username: TheHive's username. It's required if `apikey` is not provided.
            Must be specified together with `password`.
        password: TheHive's password. It's required if `apikey` is not provided.
            Must be specified together with `username`.
        organisation: TheHive organisation to use in the session.
        verify: Either a boolean, in which case it controls whether we verify
            the server's TLS certificate, or a string, in which case it must be a
            path to a CA bundle to use.
        max_retries: Either `None`, in which case we do not retry failed requests,
            or a `Retry` object.

    """
    self.session = TheHiveSession(
        url=url,
        apikey=apikey,
        username=username,
        password=password,
        verify=verify,
        max_retries=max_retries,
    )
    self.session_organisation = organisation

    # case management endpoints
    self.alert = AlertEndpoint(self.session)
    self.case = CaseEndpoint(self.session)
    self.case_template = CaseTemplateEndpoint(self.session)
    self.comment = CommentEndpoint(self.session)
    self.observable = ObservableEndpoint(self.session)
    self.procedure = ProcedureEndpoint(self.session)
    self.task = TaskEndpoint(self.session)
    self.task_log = TaskLogEndpoint(self.session)
    self.timeline = TimelineEndpoint(self.session)

    # user management endpoints
    self.user = UserEndpoint(self.session)
    self.organisation = OrganisationEndpoint(self.session)
    self.profile = ProfileEndpoint(self.session)

    # entity endpoints
    self.custom_field = CustomFieldEndpoint(self.session)
    self.observable_type = ObservableTypeEndpoint(self.session)

    # connector endpoints
    self.cortex = CortexEndpoint(self.session)

    # standard endpoints
    self.query = QueryEndpoint(self.session)

`session = TheHiveSession(url=url, apikey=apikey, username=username, password=password, verify=verify, max_retries=max_retries)` `instance-attribute`

`alert = AlertEndpoint(self.session)` `instance-attribute`

`case = CaseEndpoint(self.session)` `instance-attribute`

`case_template = CaseTemplateEndpoint(self.session)` `instance-attribute`

`comment = CommentEndpoint(self.session)` `instance-attribute`

`observable = ObservableEndpoint(self.session)` `instance-attribute`

`procedure = ProcedureEndpoint(self.session)` `instance-attribute`

`task = TaskEndpoint(self.session)` `instance-attribute`

`task_log = TaskLogEndpoint(self.session)` `instance-attribute`

`timeline = TimelineEndpoint(self.session)` `instance-attribute`

`user = UserEndpoint(self.session)` `instance-attribute`

`organisation = OrganisationEndpoint(self.session)` `instance-attribute`

`profile = ProfileEndpoint(self.session)` `instance-attribute`

`custom_field = CustomFieldEndpoint(self.session)` `instance-attribute`

`observable_type = ObservableTypeEndpoint(self.session)` `instance-attribute`

`cortex = CortexEndpoint(self.session)` `instance-attribute`

`query = QueryEndpoint(self.session)` `instance-attribute`

`session_organisation` `property` `writable`

`session`

`DEFAULT_RETRY = Retry(total=5, backoff_factor=1, status_forcelist=[500, 502, 503, 504], allowed_methods=['GET', 'POST', 'PUT', 'PATCH', 'DELETE'], raise_on_status=False)` `module-attribute`

`RetryValue = Union[Retry, int, None]` `module-attribute`

`VerifyValue = Union[bool, str]` `module-attribute`

`TheHiveSession(url, apikey=None, username=None, password=None, verify=True, max_retries=DEFAULT_RETRY)`

Bases: Session

Source code in thehive4py/session.py

def __init__(
    self,
    url: str,
    apikey: Optional[str] = None,
    username: Optional[str] = None,
    password: Optional[str] = None,
    verify: VerifyValue = True,
    max_retries: RetryValue = DEFAULT_RETRY,
):
    super().__init__()
    self.hive_url = self._sanitize_hive_url(url)
    self.verify = verify
    self.headers["User-Agent"] = f"thehive4py/{__version__}"
    self._set_retries(max_retries=max_retries)

    if username and password:
        self.headers["Authorization"] = requests.auth._basic_auth_str(
            username, password
        )
    elif apikey:
        self.headers["Authorization"] = f"Bearer {apikey}"
    else:
        raise TheHiveError(
            "Either apikey or the username/password combination must be provided!"
        )

`hive_url = self._sanitize_hive_url(url)` `instance-attribute`

`verify = verify` `instance-attribute`

`make_request(method, path, params=None, data=None, json=None, files=None, download_path=None)`

Source code in thehive4py/session.py

def make_request(
    self,
    method: str,
    path: str,
    params=None,
    data=None,
    json=None,
    files=None,
    download_path: Union[str, PathLike, None] = None,
) -> Any:
    endpoint_url = f"{self.hive_url}{path}"

    headers = {**self.headers}
    if json:
        data = jsonlib.dumps(json, cls=_SessionJSONEncoder)
        headers = {**headers, "Content-Type": "application/json"}

    response = self.request(
        method,
        url=endpoint_url,
        params=params,
        data=data,
        files=files,
        headers=headers,
        verify=self.verify,
        stream=bool(download_path),
    )

    return self._process_response(response, download_path=download_path)

`endpoints`

`alert`

`AlertEndpoint(session)`

Bases: EndpointBase

Source code in thehive4py/endpoints/_base.py

def __init__(self, session: TheHiveSession):
    self._session = session

`create(alert, attachment_map=None)`

Create an alert.

Parameters:

Name	Type	Description	Default
`alert`	`InputAlert`	The body of the alert.	required
`attachment_map`	`Optional[Dict[str, str]]`	An optional mapping of observable attachment keys and paths.	`None`

Returns:

Type	Description
`OutputAlert`	The created alert.

Source code in thehive4py/endpoints/alert.py

def create(
    self, alert: InputAlert, attachment_map: Optional[Dict[str, str]] = None
) -> OutputAlert:
    """Create an alert.

    Args:
        alert: The body of the alert.
        attachment_map: An optional mapping of observable attachment keys and paths.

    Returns:
        The created alert.
    """
    if attachment_map:
        files: Dict[str, Any] = {
            key: self._fileinfo_from_filepath(path)
            for key, path in attachment_map.items()
        }
        files["_json"] = jsonlib.dumps(alert)
        kwargs: dict = {"files": files}
    else:
        kwargs = {"json": alert}
    return self._session.make_request("POST", path="/api/v1/alert", **kwargs)

`get(alert_id)`

Get an alert by id.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required

Returns:

Type	Description
`OutputAlert`	The alert specified by the id.

Source code in thehive4py/endpoints/alert.py

def get(self, alert_id: str) -> OutputAlert:
    """Get an alert by id.

    Args:
        alert_id: The id of the alert.

    Returns:
        The alert specified by the id.
    """

    return self._session.make_request("GET", path=f"/api/v1/alert/{alert_id}")

`update(alert_id, fields)`

Update an alert.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required
`fields`	`InputUpdateAlert`	The fields of the alert to update.	required

Returns:

Type	Description
`None`	N/A

Source code in thehive4py/endpoints/alert.py

def update(self, alert_id: str, fields: InputUpdateAlert) -> None:
    """Update an alert.

    Args:
        alert_id: The id of the alert.
        fields: The fields of the alert to update.

    Returns:
        N/A
    """
    return self._session.make_request(
        "PATCH", path=f"/api/v1/alert/{alert_id}", json=fields
    )

`delete(alert_id)`

Delete an alert.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required

Returns:

Type	Description
`None`	N/A

Source code in thehive4py/endpoints/alert.py

def delete(self, alert_id: str) -> None:
    """Delete an alert.

    Args:
        alert_id: The id of the alert.

    Returns:
        N/A
    """
    return self._session.make_request("DELETE", path=f"/api/v1/alert/{alert_id}")

`bulk_update(fields)`

Update multiple alerts with the same values.

Parameters:

Name	Type	Description	Default
`fields`	`InputBulkUpdateAlert`	The ids and the fields of the alerts to update.	required

Returns:

Type	Description
`None`	N/A

Source code in thehive4py/endpoints/alert.py

def bulk_update(self, fields: InputBulkUpdateAlert) -> None:
    """Update multiple alerts with the same values.

    Args:
        fields: The ids and the fields of the alerts to update.

    Returns:
        N/A
    """
    return self._session.make_request(
        "PATCH", path="/api/v1/alert/_bulk", json=fields
    )

`bulk_delete(ids)`

Delete multiple alerts.

Parameters:

Name	Type	Description	Default
`ids`	`List[str]`	The ids of the alerts to delete.	required

Returns:

Type	Description
`None`	N/A

Source code in thehive4py/endpoints/alert.py

def bulk_delete(self, ids: List[str]) -> None:
    """Delete multiple alerts.

    Args:
        ids: The ids of the alerts to delete.

    Returns:
        N/A
    """
    return self._session.make_request(
        "POST", path="/api/v1/alert/delete/_bulk", json={"ids": ids}
    )

`follow(alert_id)`

Follow an alert.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required

Returns:

Type	Description
`None`	N/A

Source code in thehive4py/endpoints/alert.py

def follow(self, alert_id: str) -> None:
    """Follow an alert.

    Args:
        alert_id: The id of the alert.

    Returns:
        N/A
    """
    self._session.make_request("POST", path=f"/api/v1/alert/{alert_id}/follow")

`unfollow(alert_id)`

Unfollow an alert.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required

Returns:

Type	Description
`None`	N/A

Source code in thehive4py/endpoints/alert.py

def unfollow(self, alert_id: str) -> None:
    """Unfollow an alert.

    Args:
        alert_id: The id of the alert.

    Returns:
        N/A
    """
    self._session.make_request("POST", path=f"/api/v1/alert/{alert_id}/unfollow")

`promote_to_case(alert_id, fields={})`

Promote an alert into a case.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required
`fields`	`InputPromoteAlert`	Override for the fields of the case created from the alert.	`{}`

Returns:

Type	Description
`OutputCase`	The case from the promoted alert.

Source code in thehive4py/endpoints/alert.py

def promote_to_case(
    self, alert_id: str, fields: InputPromoteAlert = {}
) -> OutputCase:
    """Promote an alert into a case.

    Args:
        alert_id: The id of the alert.
        fields: Override for the fields of the case created from the alert.

    Returns:
        The case from the promoted alert.
    """
    return self._session.make_request(
        "POST",
        path=f"/api/v1/alert/{alert_id}/case",
        json=fields,
    )

`create_observable(alert_id, observable, observable_path=None)`

Create an observable in an alert.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required
`observable`	`InputObservable`	The fields of the observable to create.	required
`observable_path`	`Optional[str]`	Optional path in case of a file based observable.	`None`

Returns:

Type	Description
`List[OutputObservable]`	The created alert observables.

Source code in thehive4py/endpoints/alert.py

def create_observable(
    self,
    alert_id: str,
    observable: InputObservable,
    observable_path: Optional[str] = None,
) -> List[OutputObservable]:
    """Create an observable in an alert.

    Args:
        alert_id: The id of the alert.
        observable: The fields of the observable to create.
        observable_path: Optional path in case of a file based observable.

    Returns:
        The created alert observables.
    """

    kwargs = self._build_observable_kwargs(
        observable=observable, observable_path=observable_path
    )
    return self._session.make_request(
        "POST", path=f"/api/v1/alert/{alert_id}/observable", **kwargs
    )

`add_attachment(alert_id, attachment_paths)`

Create an observable in an alert.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required
`attachment_paths`	`List[str]`	List of paths to the attachments to create.	required

Returns:

Type	Description
`List[OutputAttachment]`	The created alert attachments.

Source code in thehive4py/endpoints/alert.py

def add_attachment(
    self, alert_id: str, attachment_paths: List[str]
) -> List[OutputAttachment]:
    """Create an observable in an alert.

    Args:
        alert_id: The id of the alert.
        attachment_paths: List of paths to the attachments to create.

    Returns:
        The created alert attachments.
    """
    files = [
        ("attachments", self._fileinfo_from_filepath(attachment_path))
        for attachment_path in attachment_paths
    ]
    return self._session.make_request(
        "POST", f"/api/v1/alert/{alert_id}/attachments", files=files
    )["attachments"]

`download_attachment(alert_id, attachment_id, attachment_path)`

Download an alert attachment.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required
`attachment_id`	`str`	The id of the alert attachment.	required
`attachment_path`	`str`	The local path to download the attachment to.	required

Returns:

Type	Description
`None`	N/A

Source code in thehive4py/endpoints/alert.py

def download_attachment(
    self, alert_id: str, attachment_id: str, attachment_path: str
) -> None:
    """Download an alert attachment.

    Args:
        alert_id: The id of the alert.
        attachment_id: The id of the alert attachment.
        attachment_path: The local path to download the attachment to.

    Returns:
        N/A
    """
    return self._session.make_request(
        "GET",
        path=f"/api/v1/alert/{alert_id}/attachment/{attachment_id}/download",
        download_path=attachment_path,
    )

`delete_attachment(alert_id, attachment_id)`

Delete an alert attachment.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required
`attachment_id`	`str`	The id of the alert attachment.	required

Returns:

Type	Description
`None`	N/A

Source code in thehive4py/endpoints/alert.py

def delete_attachment(self, alert_id: str, attachment_id: str) -> None:
    """Delete an alert attachment.

    Args:
        alert_id: The id of the alert.
        attachment_id: The id of the alert attachment.

    Returns:
        N/A
    """

    return self._session.make_request(
        "DELETE", path=f"/api/v1/alert/{alert_id}/attachment/{attachment_id}"
    )

`merge_into_case(alert_id, case_id)`

Merge an alert into an existing case.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert to merge.	required
`case_id`	`str`	The id of the case to merge the alert into.	required

Returns:

Type	Description
`OutputCase`	The case into which the alert was merged.

Source code in thehive4py/endpoints/alert.py

def merge_into_case(self, alert_id: str, case_id: str) -> OutputCase:
    """Merge an alert into an existing case.

    Args:
        alert_id: The id of the alert to merge.
        case_id: The id of the case to merge the alert into.

    Returns:
        The case into which the alert was merged.
    """
    return self._session.make_request(
        "POST", path=f"/api/v1/alert/{alert_id}/merge/{case_id}"
    )

`bulk_merge_into_case(case_id, alert_ids)`

Merge an alert into an existing case.

Parameters:

Name	Type	Description	Default
`case_id`	`str`	The id of the case to merge the alerts into.	required
`alert_ids`	`List[str]`	The list of alert ids to merge.	required

Returns:

Type	Description
`OutputCase`	The case into which the alerts were merged.

Source code in thehive4py/endpoints/alert.py

def bulk_merge_into_case(self, case_id: str, alert_ids: List[str]) -> OutputCase:
    """Merge an alert into an existing case.

    Args:
        case_id: The id of the case to merge the alerts into.
        alert_ids: The list of alert ids to merge.

    Returns:
        The case into which the alerts were merged.
    """
    return self._session.make_request(
        "POST",
        path="/api/v1/alert/merge/_bulk",
        json={"caseId": case_id, "alertIds": alert_ids},
    )

`find(filters=None, sortby=None, paginate=None)`

Find multiple alerts.

Parameters:

Name	Type	Description	Default
`filters`	`Optional[FilterExpr]`	The filter expressions to apply in the query.	`None`
`sortby`	`Optional[SortExpr]`	The sort expressions to apply in the query.	`None`
`paginate`	`Optional[Paginate]`	The pagination experssion to apply in the query.	`None`

Returns:

Type	Description
`List[OutputAlert]`	The list of alerts matched by the query or an empty list.

Source code in thehive4py/endpoints/alert.py

def find(
    self,
    filters: Optional[FilterExpr] = None,
    sortby: Optional[SortExpr] = None,
    paginate: Optional[Paginate] = None,
) -> List[OutputAlert]:
    """Find multiple alerts.

    Args:
        filters: The filter expressions to apply in the query.
        sortby: The sort expressions to apply in the query.
        paginate: The pagination experssion to apply in the query.

    Returns:
        The list of alerts matched by the query or an empty list.
    """
    query: QueryExpr = [
        {"_name": "listAlert"},
        *self._build_subquery(filters=filters, sortby=sortby, paginate=paginate),
    ]

    return self._session.make_request(
        "POST",
        path="/api/v1/query",
        params={"name": "alerts"},
        json={"query": query},
    )

`count(filters=None)`

Count alerts.

Parameters:

Name	Type	Description	Default
`filters`	`Optional[FilterExpr]`	The filter expressions to apply in the query.	`None`

Returns:

Type	Description
`int`	The count of alerts matched by the query.

Source code in thehive4py/endpoints/alert.py

def count(self, filters: Optional[FilterExpr] = None) -> int:
    """Count alerts.

    Args:
        filters: The filter expressions to apply in the query.

    Returns:
        The count of alerts matched by the query.
    """

    query: QueryExpr = [
        {"_name": "listAlert"},
        *self._build_subquery(filters=filters),
        {"_name": "count"},
    ]

    return self._session.make_request(
        "POST",
        path="/api/v1/query",
        params={"name": "alerts.count"},
        json={"query": query},
    )

`find_observables(alert_id, filters=None, sortby=None, paginate=None)`

Find observable related to an alert.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required
`filters`	`Optional[FilterExpr]`	The filter expressions to apply in the query.	`None`
`sortby`	`Optional[SortExpr]`	The sort expressions to apply in the query.	`None`
`paginate`	`Optional[Paginate]`	The pagination experssion to apply in the query.	`None`

Returns:

Type	Description
`List[OutputObservable]`	The list of alert observables matched by the query or an empty list.

Source code in thehive4py/endpoints/alert.py

def find_observables(
    self,
    alert_id: str,
    filters: Optional[FilterExpr] = None,
    sortby: Optional[SortExpr] = None,
    paginate: Optional[Paginate] = None,
) -> List[OutputObservable]:
    """Find observable related to an alert.

    Args:
        alert_id: The id of the alert.
        filters: The filter expressions to apply in the query.
        sortby: The sort expressions to apply in the query.
        paginate: The pagination experssion to apply in the query.

    Returns:
        The list of alert observables matched by the query or an empty list.
    """
    query: QueryExpr = [
        {"_name": "getAlert", "idOrName": alert_id},
        {"_name": "observables"},
        *self._build_subquery(filters=filters, sortby=sortby, paginate=paginate),
    ]
    return self._session.make_request(
        "POST",
        path="/api/v1/query",
        params={"name": "alert-observables"},
        json={"query": query},
    )

`find_comments(alert_id, filters=None, sortby=None, paginate=None)`

Find comments related to an alert.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required
`filters`	`Optional[FilterExpr]`	The filter expressions to apply in the query.	`None`
`sortby`	`Optional[SortExpr]`	The sort expressions to apply in the query.	`None`
`paginate`	`Optional[Paginate]`	The pagination experssion to apply in the query.	`None`

Returns:

Type	Description
`List[OutputComment]`	The list of alert comments matched by the query or an empty list.

Source code in thehive4py/endpoints/alert.py

def find_comments(
    self,
    alert_id: str,
    filters: Optional[FilterExpr] = None,
    sortby: Optional[SortExpr] = None,
    paginate: Optional[Paginate] = None,
) -> List[OutputComment]:
    """Find comments related to an alert.

    Args:
        alert_id: The id of the alert.
        filters: The filter expressions to apply in the query.
        sortby: The sort expressions to apply in the query.
        paginate: The pagination experssion to apply in the query.

    Returns:
        The list of alert comments matched by the query or an empty list.
    """
    query: QueryExpr = [
        {"_name": "getAlert", "idOrName": alert_id},
        {"_name": "comments"},
        *self._build_subquery(filters=filters, sortby=sortby, paginate=paginate),
    ]
    return self._session.make_request(
        "POST",
        path="/api/v1/query",
        params={"name": "alert-comments"},
        json={"query": query},
    )

`create_procedure(alert_id, procedure)`

Create an alert procedure.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required
`procedure`	`InputProcedure`	The fields of the procedure to create.	required

Returns:

Type	Description
`OutputProcedure`	The created alert procedure.

Source code in thehive4py/endpoints/alert.py

def create_procedure(
    self, alert_id: str, procedure: InputProcedure
) -> OutputProcedure:
    """Create an alert procedure.

    Args:
        alert_id: The id of the alert.
        procedure: The fields of the procedure to create.

    Returns:
        The created alert procedure.
    """
    return self._session.make_request(
        "POST", path=f"/api/v1/alert/{alert_id}/procedure", json=procedure
    )

`find_procedures(alert_id, filters=None, sortby=None, paginate=None)`

Find procedures related to an alert.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required
`filters`	`Optional[FilterExpr]`	The filter expressions to apply in the query.	`None`
`sortby`	`Optional[SortExpr]`	The sort expressions to apply in the query.	`None`
`paginate`	`Optional[Paginate]`	The pagination experssion to apply in the query.	`None`

Returns:

Type	Description
`List[OutputProcedure]`	The list of alert procedures matched by the query or an empty list.

Source code in thehive4py/endpoints/alert.py

def find_procedures(
    self,
    alert_id: str,
    filters: Optional[FilterExpr] = None,
    sortby: Optional[SortExpr] = None,
    paginate: Optional[Paginate] = None,
) -> List[OutputProcedure]:
    """Find procedures related to an alert.

    Args:
        alert_id: The id of the alert.
        filters: The filter expressions to apply in the query.
        sortby: The sort expressions to apply in the query.
        paginate: The pagination experssion to apply in the query.

    Returns:
        The list of alert procedures matched by the query or an empty list.
    """
    query: QueryExpr = [
        {"_name": "getAlert", "idOrName": alert_id},
        {"_name": "procedures"},
        *self._build_subquery(filters=filters, sortby=sortby, paginate=paginate),
    ]

    return self._session.make_request(
        "POST",
        path="/api/v1/query",
        params={"name": "alert-procedures"},
        json={"query": query},
    )

`find_attachments(alert_id, filters=None, sortby=None, paginate=None)`

Find attachments related to an alert.

Parameters:

Name	Type	Description	Default
`alert_id`	`str`	The id of the alert.	required
`filters`	`Optional[FilterExpr]`	The filter expressions to apply in the query.	`None`
`sortby`	`Optional[SortExpr]`	The sort expressions to apply in the query.	`None`
`paginate`	`Optional[Paginate]`	The pagination experssion to apply in the query.	`None`

Returns:

Type	Description
`List[OutputAttachment]`	The list of alert attachments matched by the query or an empty list.

Source code in thehive4py/endpoints/alert.py

def find_attachments(
    self,
    alert_id: str,
    filters: Optional[FilterExpr] = None,
    sortby: Optional[SortExpr] = None,
    paginate: Optional[Paginate] = None,
) -> List[OutputAttachment]:
    """Find attachments related to an alert.

    Args:
        alert_id: The id of the alert.
        filters: The filter expressions to apply in the query.
        sortby: The sort expressions to apply in the query.
        paginate: The pagination experssion to apply in the query.

    Returns:
        The list of alert attachments matched by the query or an empty list.
    """
    query: QueryExpr = [
        {"_name": "getAlert", "idOrName": alert_id},
        {"_name": "attachments"},
        *self._build_subquery(filters=filters, sortby=sortby, paginate=paginate),
    ]
    return self._session.make_request(
        "POST",
        path="/api/v1/query",
        params={"name": "alert-attachments"},
        json={"query": query},
    )

`case`

`CaseId = Union[str, int]` `module-attribute`

`CaseEndpoint(session)`

Bases: EndpointBase

Source code in thehive4py/endpoints/_base.py

def __init__(self, session: TheHiveSession):
    self._session = session