Skip to content

Types

thehive4py.types

alert

InputAlertRequired

Bases: TypedDict

type instance-attribute
source instance-attribute
sourceRef instance-attribute
title instance-attribute
description instance-attribute

InputAlert

Bases: InputAlertRequired

date instance-attribute
severity instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
pap instance-attribute
customFields instance-attribute
summary instance-attribute
status instance-attribute
assignee instance-attribute
caseTemplate instance-attribute
observables instance-attribute
procedures instance-attribute

OutputAlertRequired

Bases: TypedDict

type instance-attribute
source instance-attribute
sourceRef instance-attribute
title instance-attribute
description instance-attribute
severity instance-attribute
severityLabel instance-attribute
date instance-attribute
tlp instance-attribute
tlpLabel instance-attribute
pap instance-attribute
papLabel instance-attribute
follow instance-attribute
observableCount instance-attribute
status instance-attribute
stage instance-attribute
extraData instance-attribute
newDate instance-attribute
timeToDetect instance-attribute

OutputAlert

Bases: OutputAlertRequired

tags instance-attribute
customFields instance-attribute
caseTemplate instance-attribute
caseId instance-attribute
assignee instance-attribute
summary instance-attribute
inProgressDate instance-attribute
closedDate instance-attribute
importedDate instance-attribute
timeToTriage instance-attribute
timeToQualify instance-attribute
timeToAcknowledge instance-attribute

InputUpdateAlert

Bases: TypedDict

type instance-attribute
source instance-attribute
sourceRef instance-attribute
title instance-attribute
description instance-attribute
severity instance-attribute
date instance-attribute
lastSyncDate instance-attribute
tags instance-attribute
tlp instance-attribute
pap instance-attribute
follow instance-attribute
customFields instance-attribute
status instance-attribute
summary instance-attribute
assignee instance-attribute
addTags instance-attribute
removeTags instance-attribute

InputBulkUpdateAlert

Bases: InputUpdateAlert

ids instance-attribute

InputPromoteAlert

Bases: TypedDict

title instance-attribute
description instance-attribute
severity instance-attribute
startDate instance-attribute
endDate instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
pap instance-attribute
status instance-attribute
summary instance-attribute
assignee instance-attribute
customFields instance-attribute
caseTemplate instance-attribute
tasks instance-attribute
pages instance-attribute
sharingParameters instance-attribute
taskRule instance-attribute
observableRule instance-attribute

attachment

InputAttachment

Bases: TypedDict

name instance-attribute
contentType instance-attribute
id instance-attribute

OutputAttachmentRequired

Bases: TypedDict

name instance-attribute
hashes instance-attribute
size instance-attribute
contentType instance-attribute
id instance-attribute
path instance-attribute
extraData instance-attribute

OutputAttachment

Bases: OutputAttachmentRequired

case

CaseStatusValue = Literal['New', 'InProgress', 'Indeterminate', 'FalsePositive', 'TruePositive', 'Other', 'Duplicated'] module-attribute

ImpactStatusValue = Literal['NotApplicable', 'WithImpact', 'NoImpact'] module-attribute

CaseStatus

New = 'New' class-attribute instance-attribute
InProgress = 'InProgress' class-attribute instance-attribute
Indeterminate = 'Indeterminate' class-attribute instance-attribute
FalsePositive = 'FalsePositive' class-attribute instance-attribute
TruePositive = 'TruePositive' class-attribute instance-attribute
Other = 'Other' class-attribute instance-attribute
Duplicated = 'Duplicated' class-attribute instance-attribute

ImpactStatus

NotApplicable = 'NotApplicable' class-attribute instance-attribute
WithImpact = 'WithImpact' class-attribute instance-attribute
NoImpact = 'NoImpact' class-attribute instance-attribute

InputCaseRequired

Bases: TypedDict

title instance-attribute
description instance-attribute

InputCase

Bases: InputCaseRequired

severity instance-attribute
startDate instance-attribute
endDate instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
pap instance-attribute
status instance-attribute
summary instance-attribute
assignee instance-attribute
access instance-attribute
customFields instance-attribute
caseTemplate instance-attribute
tasks instance-attribute
pages instance-attribute
sharingParameters instance-attribute
taskRule instance-attribute
observableRule instance-attribute

OutputCaseRequired

Bases: TypedDict

number instance-attribute
title instance-attribute
description instance-attribute
severity instance-attribute
severityLabel instance-attribute
startDate instance-attribute
flag instance-attribute
tlp instance-attribute
tlpLabel instance-attribute
pap instance-attribute
papLabel instance-attribute
status instance-attribute
stage instance-attribute
access instance-attribute
extraData instance-attribute
newDate instance-attribute
timeToDetect instance-attribute

OutputCase

Bases: OutputCaseRequired

endDate instance-attribute
tags instance-attribute
summary instance-attribute
impactStatus instance-attribute
assignee instance-attribute
customFields instance-attribute
userPermissions instance-attribute
inProgressDate instance-attribute
closedDate instance-attribute
alertDate instance-attribute
alertNewDate instance-attribute
alertInProgressDate instance-attribute
alertImportedDate instance-attribute
timeToTriage instance-attribute
timeToQualify instance-attribute
timeToAcknowledge instance-attribute
timeToResolve instance-attribute
handlingDuration instance-attribute

InputUpdateCase

Bases: TypedDict

title instance-attribute
description instance-attribute
severity instance-attribute
startDate instance-attribute
endDate instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
pap instance-attribute
status instance-attribute
summary instance-attribute
assignee instance-attribute
impactStatus instance-attribute
customFields instance-attribute
taskRule instance-attribute
observableRule instance-attribute
addTags instance-attribute
removeTags instance-attribute

InputBulkUpdateCase

Bases: InputUpdateCase

ids instance-attribute

InputImportCaseRequired

Bases: TypedDict

password instance-attribute

InputImportCase

Bases: InputImportCaseRequired

sharingParameters instance-attribute
taskRule instance-attribute
observableRule instance-attribute

InputApplyCaseTemplateRequired

Bases: TypedDict

ids instance-attribute
caseTemplate instance-attribute

InputApplyCaseTemplate

Bases: InputApplyCaseTemplateRequired

updateTitlePrefix instance-attribute
updateDescription instance-attribute
updateTags instance-attribute
updateSeverity instance-attribute
updateFlag instance-attribute
updateTlp instance-attribute
updatePap instance-attribute
updateCustomFields instance-attribute
importTasks instance-attribute
importPages instance-attribute

OutputCaseObservableMerge

Bases: TypedDict

untouched instance-attribute
updated instance-attribute
deleted instance-attribute

OutputCaseLinkRequired

Bases: TypedDict

linksCount instance-attribute

Bases: OutputCase, OutputCaseLinkRequired

linkedWith instance-attribute

OutputImportCaseRequired

Bases: TypedDict

case instance-attribute

OutputImportCase

Bases: OutputImportCaseRequired

observables instance-attribute
procedures instance-attribute
errors instance-attribute

InputCaseOwnerOrganisationRequired

Bases: TypedDict

organisation instance-attribute

InputCaseOwnerOrganisation

Bases: InputCaseOwnerOrganisationRequired

keepProfile instance-attribute
taskRule instance-attribute
observableRule instance-attribute

InputCaseAccess

Bases: TypedDict

access instance-attribute

Bases: TypedDict

type instance-attribute
caseId instance-attribute

Bases: TypedDict

type instance-attribute
url instance-attribute

case_template

SeverityValue = Literal[1, 2, 3, 4] module-attribute

TlpValue = Literal[0, 1, 2, 3, 4] module-attribute

PapValue = Literal[0, 1, 2, 3] module-attribute

InputCaseTemplate

Bases: TypedDict

name instance-attribute
displayName instance-attribute
titlePrefix instance-attribute
description instance-attribute
severity instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
pap instance-attribute
summary instance-attribute
tasks instance-attribute
pageTemplateIds instance-attribute
customFields instance-attribute

OutputCaseTemplate

Bases: TypedDict

name instance-attribute
displayName instance-attribute
titlePrefix instance-attribute
description instance-attribute
severity instance-attribute
severityLabel instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
tlpLabel instance-attribute
pap instance-attribute
papLabel instance-attribute
summary instance-attribute
customFields instance-attribute
tasks instance-attribute
extraData instance-attribute

comment

InputComment

Bases: TypedDict

message instance-attribute

OutputCommentRequired

Bases: TypedDict

createdBy instance-attribute
createdAt instance-attribute
message instance-attribute
isEdited instance-attribute

OutputComment

Bases: OutputCommentRequired

updatedAt instance-attribute

InputUpdateComment

Bases: TypedDict

message instance-attribute

cortex

OutputAnalyzerRequired

Bases: TypedDict

id instance-attribute
name instance-attribute
version instance-attribute
description instance-attribute

OutputAnalyzer

Bases: OutputAnalyzerRequired

dataTypeList instance-attribute
cortexIds instance-attribute

OutputResponderRequired

Bases: TypedDict

id instance-attribute
name instance-attribute
version instance-attribute
description instance-attribute

OutputResponder

Bases: OutputResponderRequired

dataTypeList instance-attribute
cortexIds instance-attribute

OutputAnalyzerJobRequired

Bases: TypedDict

analyzerId instance-attribute
analyzerName instance-attribute
analyzerDefinition instance-attribute
status instance-attribute
startDate instance-attribute
cortexId instance-attribute
cortexJobId instance-attribute
id instance-attribute
operations instance-attribute

OutputAnalyzerJob

Bases: OutputAnalyzerJobRequired

endDate instance-attribute
report instance-attribute
case_artifact instance-attribute

OutputResponderActionRequired

Bases: TypedDict

responderId instance-attribute
status instance-attribute
startDate instance-attribute
cortexId instance-attribute
cortexJobId instance-attribute
id instance-attribute
operations instance-attribute

OutputResponderAction

Bases: OutputResponderActionRequired

endDate instance-attribute
report instance-attribute
responderName instance-attribute
responderDefinition instance-attribute

InputResponderActionRequired

Bases: TypedDict

objectId instance-attribute
objectType instance-attribute
responderId instance-attribute

InputResponderAction

Bases: InputResponderActionRequired

parameters instance-attribute
tlp instance-attribute

InputAnalyzerJobRequired

Bases: TypedDict

analyzerId instance-attribute
cortexId instance-attribute
artifactId instance-attribute

InputAnalyzerJob

Bases: InputAnalyzerJobRequired

parameters instance-attribute

custom_field

CustomFieldType = Literal['string', 'integer', 'float', 'boolean', 'date', 'url'] module-attribute

InputCustomFieldValue

Bases: TypedDict

name instance-attribute
value instance-attribute
order instance-attribute

OutputCustomFieldValue

Bases: TypedDict

name instance-attribute
type instance-attribute
value instance-attribute
order instance-attribute

InputCustomField

Bases: TypedDict

name instance-attribute
displayName instance-attribute
group instance-attribute
description instance-attribute
type instance-attribute
mandatory instance-attribute
options instance-attribute

OutputCustomField

Bases: TypedDict

name instance-attribute
displayName instance-attribute
group instance-attribute
description instance-attribute
type instance-attribute
options instance-attribute
mandatory instance-attribute
extraData instance-attribute

InputUpdateCustomField

Bases: TypedDict

displayName instance-attribute
group instance-attribute
description instance-attribute
type instance-attribute
options instance-attribute
mandatory instance-attribute

observable

InputObservableRequired

Bases: TypedDict

dataType instance-attribute

InputObservable

Bases: InputObservableRequired

data instance-attribute
message instance-attribute
startDate instance-attribute
attachment instance-attribute
tlp instance-attribute
pap instance-attribute
tags instance-attribute
ioc instance-attribute
sighted instance-attribute
sightedAt instance-attribute
ignoreSimilarity instance-attribute
isZip instance-attribute
zipPassword instance-attribute

OutputObservableRequired

Bases: TypedDict

dataType instance-attribute
startDate instance-attribute
tlp instance-attribute
tlpLabel instance-attribute
pap instance-attribute
papLabel instance-attribute
ioc instance-attribute
sighted instance-attribute
reports instance-attribute
extraData instance-attribute
ignoreSimilarity instance-attribute

OutputObservable

Bases: OutputObservableRequired

data instance-attribute
attachment instance-attribute
tags instance-attribute
sightedAt instance-attribute
message instance-attribute

InputUpdateObservable

Bases: TypedDict

dataType instance-attribute
message instance-attribute
tlp instance-attribute
pap instance-attribute
tags instance-attribute
ioc instance-attribute
sighted instance-attribute
sightedAt instance-attribute
ignoreSimilarity instance-attribute
addTags instance-attribute
removeTags instance-attribute

InputBulkUpdateObservable

Bases: InputUpdateObservable

ids instance-attribute

observable_type

InputObservableType

Bases: TypedDict

name instance-attribute
isAttachment instance-attribute

OutputObservableType

Bases: TypedDict

name instance-attribute
isAttachment instance-attribute

organisation

Bases: TypedDict

linkType instance-attribute
otherLinkType instance-attribute

InputBulkOrganisationLinkRequired

Bases: TypedDict

toOrganisation instance-attribute
linkType instance-attribute
otherLinkType instance-attribute

Bases: InputBulkOrganisationLinkRequired

avatar instance-attribute

OutputSharingProfile

Bases: TypedDict

name instance-attribute
description instance-attribute
autoShare instance-attribute
editable instance-attribute
permissionProfile instance-attribute
taskRule instance-attribute
observableRule instance-attribute

InputOrganisationRequired

Bases: TypedDict

name instance-attribute
description instance-attribute

InputOrganisation

Bases: InputOrganisationRequired

taskRule instance-attribute
observableRule instance-attribute
locked instance-attribute

OutputOrganisationRequired

Bases: TypedDict

name instance-attribute
description instance-attribute
taskRule instance-attribute
observableRule instance-attribute
locked instance-attribute
extraData instance-attribute

OutputOrganisation

Bases: OutputOrganisationRequired

avatar instance-attribute

InputUpdateOrganisation

Bases: TypedDict

name instance-attribute
description instance-attribute
taskRule instance-attribute
observableRule instance-attribute
locked instance-attribute
avatar instance-attribute

Bases: TypedDict

linkType instance-attribute
otherLinkType instance-attribute
organisation instance-attribute

page

InputCasePageRequired

Bases: TypedDict

title instance-attribute
content instance-attribute
category instance-attribute

InputCasePage

Bases: InputCasePageRequired

order instance-attribute

OutputCasePageRequired

Bases: TypedDict

id instance-attribute
createdBy instance-attribute
createdAt instance-attribute
title instance-attribute
content instance-attribute
slug instance-attribute
order instance-attribute
category instance-attribute

OutputCasePage

Bases: OutputCasePageRequired

updatedBy instance-attribute
updatedAt instance-attribute

InputUpdateCasePage

Bases: TypedDict

title instance-attribute
content instance-attribute
category instance-attribute
order instance-attribute

page_template

InputPageTemplate

Bases: TypedDict

title instance-attribute
content instance-attribute
order instance-attribute
category instance-attribute

OutputPageTemplate

Bases: TypedDict

title instance-attribute
content instance-attribute
order instance-attribute
category instance-attribute
extraData instance-attribute

InputUpdatePageTemplate

Bases: TypedDict

title instance-attribute
content instance-attribute
order instance-attribute
category instance-attribute

procedure

InputProcedure

Bases: TypedDict

occurDate instance-attribute
patternId instance-attribute
tactic instance-attribute
description instance-attribute

OutputProcedure

Bases: TypedDict

description instance-attribute
occurDate instance-attribute
patternId instance-attribute
patternName instance-attribute
tactic instance-attribute
tacticLabel instance-attribute
extraData instance-attribute

InputUpdateProcedure

Bases: TypedDict

description instance-attribute
occurDate instance-attribute
patternId instance-attribute
tactic instance-attribute

profile

InputProfileRequired

Bases: TypedDict

name instance-attribute

InputProfile

Bases: InputProfileRequired

permissions instance-attribute

OutputProfileRequired

Bases: TypedDict

name instance-attribute
editable instance-attribute
isAdmin instance-attribute

OutputProfile

Bases: OutputProfileRequired

permissions instance-attribute

InputUpdateProfile

Bases: TypedDict

name instance-attribute
permissions instance-attribute

share

OutputShareRequired

Bases: TypedDict

caseId instance-attribute
profileName instance-attribute
organisationName instance-attribute
owner instance-attribute
taskRule instance-attribute
observableRule instance-attribute

OutputShare

Bases: OutputShareRequired

InputShareRequired

Bases: TypedDict

organisation instance-attribute

InputShare

Bases: InputShareRequired

share instance-attribute
profile instance-attribute
taskRule instance-attribute
observableRule instance-attribute

task

InputTaskRequired

Bases: TypedDict

title instance-attribute

InputTask

Bases: InputTaskRequired

group instance-attribute
description instance-attribute
status instance-attribute
flag instance-attribute
startDate instance-attribute
endDate instance-attribute
order instance-attribute
dueDate instance-attribute
assignee instance-attribute
mandatory instance-attribute

OutputTaskRequired

Bases: TypedDict

title instance-attribute
group instance-attribute
status instance-attribute
flag instance-attribute
order instance-attribute
mandatory instance-attribute
extraData instance-attribute

OutputTask

Bases: OutputTaskRequired

description instance-attribute
startDate instance-attribute
endDate instance-attribute
assignee instance-attribute
dueDate instance-attribute

InputUpdateTask

Bases: TypedDict

title instance-attribute
group instance-attribute
description instance-attribute
status instance-attribute
flag instance-attribute
startDate instance-attribute
endDate instance-attribute
order instance-attribute
dueDate instance-attribute
assignee instance-attribute
mandatory instance-attribute

InputBulkUpdateTask

Bases: InputUpdateTask

ids instance-attribute

task_log

InputTaskLogRequired

Bases: TypedDict

message instance-attribute

InputTaskLog

Bases: InputTaskLogRequired

startDate instance-attribute
includeInTimeline instance-attribute
attachments instance-attribute

OutputTaskLogRequired

Bases: TypedDict

message instance-attribute
date instance-attribute
owner instance-attribute
extraData instance-attribute

OutputTaskLog

Bases: OutputTaskLogRequired

attachments instance-attribute
includeInTimeline instance-attribute

InputUpdateTaskLog

Bases: TypedDict

message instance-attribute
includeInTimeline instance-attribute

timeline

OutputTimelineEventRequired

Bases: TypedDict

date instance-attribute
kind instance-attribute
entity instance-attribute
entityId instance-attribute
details instance-attribute

OutputTimelineEvent

Bases: OutputTimelineEventRequired

endDate instance-attribute

OutputTimeline

Bases: TypedDict

events instance-attribute

InputCustomEventRequired

Bases: TypedDict

date instance-attribute
title instance-attribute

InputCustomEvent

Bases: InputCustomEventRequired

endDate instance-attribute
description instance-attribute

OutputCustomEventRequired

Bases: TypedDict

date instance-attribute
title instance-attribute

OutputCustomEvent

Bases: OutputCustomEventRequired

endDate instance-attribute
description instance-attribute

InputUpdateCustomEvent

Bases: TypedDict

date instance-attribute
endDate instance-attribute
title instance-attribute
description instance-attribute

user

InputUserType = Literal['Normal', 'Service'] module-attribute

InputUserRequired

Bases: TypedDict

login instance-attribute
name instance-attribute
profile instance-attribute

InputUser

Bases: InputUserRequired

email instance-attribute
password instance-attribute
organisation instance-attribute
type instance-attribute

OrganisationLinkRequired

Bases: TypedDict

toOrganisation instance-attribute
linkType instance-attribute
otherLinkType instance-attribute

Bases: OrganisationLinkRequired

avatar instance-attribute

OutputOrganisationProfileRequired

Bases: TypedDict

organisationId instance-attribute
organisation instance-attribute
profile instance-attribute

OutputOrganisationProfile

Bases: OutputOrganisationProfileRequired

avatar instance-attribute

OutputUserRequired

Bases: TypedDict

login instance-attribute
name instance-attribute
hasKey instance-attribute
hasPassword instance-attribute
hasMFA instance-attribute
locked instance-attribute
profile instance-attribute
organisation instance-attribute
type instance-attribute
extraData instance-attribute

OutputUser

Bases: OutputUserRequired

email instance-attribute
permissions instance-attribute
avatar instance-attribute
organisations instance-attribute
defaultOrganisation instance-attribute

InputUpdateUser

Bases: TypedDict

name instance-attribute
organisation instance-attribute
profile instance-attribute
locked instance-attribute
avatar instance-attribute
email instance-attribute
defaultOrganisation instance-attribute
type instance-attribute

InputUserOrganisationRequired

Bases: TypedDict

organisation instance-attribute
profile instance-attribute

InputUserOrganisation

Bases: InputUserOrganisationRequired

default instance-attribute

OutputUserOrganisation

Bases: TypedDict

organisation instance-attribute
profile instance-attribute
default instance-attribute