Skip to content

Types

thehive4py.types

alert

InputAlert

Bases: TypedDict

type instance-attribute
source instance-attribute
sourceRef instance-attribute
title instance-attribute
description instance-attribute
severity instance-attribute
date instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
pap instance-attribute
customFields instance-attribute
summary instance-attribute
status instance-attribute
assignee instance-attribute
caseTemplate instance-attribute
observables instance-attribute
procedures instance-attribute

OutputAlert

Bases: TypedDict

type instance-attribute
source instance-attribute
sourceRef instance-attribute
title instance-attribute
description instance-attribute
severity instance-attribute
severityLabel instance-attribute
date instance-attribute
tags instance-attribute
tlp instance-attribute
tlpLabel instance-attribute
pap instance-attribute
papLabel instance-attribute
follow instance-attribute
customFields instance-attribute
caseTemplate instance-attribute
observableCount instance-attribute
caseId instance-attribute
status instance-attribute
stage instance-attribute
assignee instance-attribute
summary instance-attribute
extraData instance-attribute
newDate instance-attribute
inProgressDate instance-attribute
closedDate instance-attribute
importedDate instance-attribute
timeToDetect instance-attribute
timeToTriage instance-attribute
timeToQualify instance-attribute
timeToAcknowledge instance-attribute

InputUpdateAlert

Bases: TypedDict

type instance-attribute
source instance-attribute
sourceRef instance-attribute
title instance-attribute
description instance-attribute
severity instance-attribute
date instance-attribute
lastSyncDate instance-attribute
tags instance-attribute
tlp instance-attribute
pap instance-attribute
follow instance-attribute
customFields instance-attribute
status instance-attribute
summary instance-attribute
assignee instance-attribute
addTags instance-attribute
removeTags instance-attribute

InputBulkUpdateAlert

Bases: InputUpdateAlert

ids instance-attribute

InputPromoteAlert

Bases: TypedDict

title instance-attribute
description instance-attribute
severity instance-attribute
startDate instance-attribute
endDate instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
pap instance-attribute
status instance-attribute
summary instance-attribute
assignee instance-attribute
customFields instance-attribute
caseTemplate instance-attribute
tasks instance-attribute
pages instance-attribute
sharingParameters instance-attribute
taskRule instance-attribute
observableRule instance-attribute

attachment

InputAttachment

Bases: TypedDict

name instance-attribute
contentType instance-attribute
id instance-attribute

OutputAttachment

Bases: TypedDict

name instance-attribute
hashes instance-attribute
size instance-attribute
contentType instance-attribute
id instance-attribute
path instance-attribute
extraData instance-attribute

case

CaseStatusValue = Literal['New', 'InProgress', 'Indeterminate', 'FalsePositive', 'TruePositive', 'Other', 'Duplicated'] module-attribute

ImpactStatusValue = Literal['NotApplicable', 'WithImpact', 'NoImpact'] module-attribute

CaseStatus

New = 'New' class-attribute instance-attribute
InProgress = 'InProgress' class-attribute instance-attribute
Indeterminate = 'Indeterminate' class-attribute instance-attribute
FalsePositive = 'FalsePositive' class-attribute instance-attribute
TruePositive = 'TruePositive' class-attribute instance-attribute
Other = 'Other' class-attribute instance-attribute
Duplicated = 'Duplicated' class-attribute instance-attribute

ImpactStatus

NotApplicable = 'NotApplicable' class-attribute instance-attribute
WithImpact = 'WithImpact' class-attribute instance-attribute
NoImpact = 'NoImpact' class-attribute instance-attribute

InputCase

Bases: TypedDict

title instance-attribute
description instance-attribute
severity instance-attribute
startDate instance-attribute
endDate instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
pap instance-attribute
status instance-attribute
summary instance-attribute
assignee instance-attribute
access instance-attribute
customFields instance-attribute
caseTemplate instance-attribute
tasks instance-attribute
pages instance-attribute
sharingParameters instance-attribute
taskRule instance-attribute
observableRule instance-attribute

OutputCase

Bases: TypedDict

number instance-attribute
title instance-attribute
description instance-attribute
severity instance-attribute
severityLabel instance-attribute
startDate instance-attribute
endDate instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
tlpLabel instance-attribute
pap instance-attribute
papLabel instance-attribute
status instance-attribute
stage instance-attribute
summary instance-attribute
impactStatus instance-attribute
assignee instance-attribute
access instance-attribute
customFields instance-attribute
userPermissions instance-attribute
extraData instance-attribute
newDate instance-attribute
inProgressDate instance-attribute
closedDate instance-attribute
alertDate instance-attribute
alertNewDate instance-attribute
alertInProgressDate instance-attribute
alertImportedDate instance-attribute
timeToDetect instance-attribute
timeToTriage instance-attribute
timeToQualify instance-attribute
timeToAcknowledge instance-attribute
timeToResolve instance-attribute
handlingDuration instance-attribute

InputUpdateCase

Bases: TypedDict

title instance-attribute
description instance-attribute
severity instance-attribute
startDate instance-attribute
endDate instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
pap instance-attribute
status instance-attribute
summary instance-attribute
assignee instance-attribute
impactStatus instance-attribute
customFields instance-attribute
taskRule instance-attribute
observableRule instance-attribute
addTags instance-attribute
removeTags instance-attribute

InputBulkUpdateCase

Bases: InputUpdateCase

ids instance-attribute

InputImportCase

Bases: TypedDict

password instance-attribute
sharingParameters instance-attribute
taskRule instance-attribute
observableRule instance-attribute

InputApplyCaseTemplate

Bases: TypedDict

ids instance-attribute
caseTemplate instance-attribute
updateTitlePrefix instance-attribute
updateDescription instance-attribute
updateTags instance-attribute
updateSeverity instance-attribute
updateFlag instance-attribute
updateTlp instance-attribute
updatePap instance-attribute
updateCustomFields instance-attribute
importTasks instance-attribute
importPages instance-attribute

OutputCaseObservableMerge

Bases: TypedDict

untouched instance-attribute
updated instance-attribute
deleted instance-attribute

Bases: OutputCase

linksCount instance-attribute
linkedWith instance-attribute

OutputImportCase

Bases: TypedDict

case instance-attribute
observables instance-attribute
procedures instance-attribute
errors instance-attribute

InputCaseOwnerOrganisation

Bases: TypedDict

organisation instance-attribute
keepProfile instance-attribute
taskRule instance-attribute
observableRule instance-attribute

InputCaseAccess

Bases: TypedDict

access instance-attribute

Bases: TypedDict

type instance-attribute
caseId instance-attribute

Bases: TypedDict

type instance-attribute
url instance-attribute

case_template

SeverityValue = Literal[1, 2, 3, 4] module-attribute

TlpValue = Literal[0, 1, 2, 3, 4] module-attribute

PapValue = Literal[0, 1, 2, 3] module-attribute

InputCaseTemplate

Bases: TypedDict

name instance-attribute
displayName instance-attribute
titlePrefix instance-attribute
description instance-attribute
severity instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
pap instance-attribute
summary instance-attribute
tasks instance-attribute
pageTemplateIds instance-attribute
customFields instance-attribute

OutputCaseTemplate

Bases: TypedDict

name instance-attribute
displayName instance-attribute
titlePrefix instance-attribute
description instance-attribute
severity instance-attribute
severityLabel instance-attribute
tags instance-attribute
flag instance-attribute
tlp instance-attribute
tlpLabel instance-attribute
pap instance-attribute
papLabel instance-attribute
summary instance-attribute
customFields instance-attribute
tasks instance-attribute
extraData instance-attribute

comment

InputComment

Bases: TypedDict

message instance-attribute

OutputComment

Bases: TypedDict

createdBy instance-attribute
createdAt instance-attribute
updatedAt instance-attribute
updatedBy instance-attribute
message instance-attribute
isEdited instance-attribute
extraData instance-attribute

InputUpdateComment

Bases: TypedDict

message instance-attribute

cortex

OutputAnalyzer

Bases: TypedDict

id instance-attribute
name instance-attribute
version instance-attribute
description instance-attribute
dataTypeList instance-attribute
cortexIds instance-attribute

OutputResponder

Bases: TypedDict

id instance-attribute
name instance-attribute
version instance-attribute
description instance-attribute
dataTypeList instance-attribute
cortexIds instance-attribute

OutputAnalyzerJob

Bases: TypedDict

analyzerId instance-attribute
analyzerName instance-attribute
analyzerDefinition instance-attribute
status instance-attribute
startDate instance-attribute
endDate instance-attribute
report instance-attribute
cortexId instance-attribute
cortexJobId instance-attribute
id instance-attribute
case_artifact instance-attribute
operations instance-attribute

OutputResponderAction

Bases: TypedDict

responderId instance-attribute
responderName instance-attribute
responderDefinition instance-attribute
cortexId instance-attribute
cortexJobId instance-attribute
objectType instance-attribute
objectId instance-attribute
status instance-attribute
startDate instance-attribute
endDate instance-attribute
operations instance-attribute
report instance-attribute

InputResponderAction

Bases: TypedDict

responderId instance-attribute
cortexId instance-attribute
objectType instance-attribute
objectId instance-attribute
parameters instance-attribute
tlp instance-attribute

InputAnalyzerJob

Bases: TypedDict

analyzerId instance-attribute
cortexId instance-attribute
artifactId instance-attribute
parameters instance-attribute

custom_field

CustomFieldType = Literal['string', 'integer', 'float', 'boolean', 'date', 'url'] module-attribute

InputCustomFieldValue

Bases: TypedDict

name instance-attribute
value instance-attribute
order instance-attribute

OutputCustomFieldValue

Bases: TypedDict

name instance-attribute
type instance-attribute
value instance-attribute
order instance-attribute

InputCustomField

Bases: TypedDict

name instance-attribute
displayName instance-attribute
group instance-attribute
description instance-attribute
type instance-attribute
mandatory instance-attribute
options instance-attribute

OutputCustomField

Bases: TypedDict

name instance-attribute
displayName instance-attribute
group instance-attribute
description instance-attribute
type instance-attribute
options instance-attribute
mandatory instance-attribute
extraData instance-attribute

InputUpdateCustomField

Bases: TypedDict

displayName instance-attribute
group instance-attribute
description instance-attribute
type instance-attribute
options instance-attribute
mandatory instance-attribute

misp

OutputMISPStatus

Bases: TypedDict

status instance-attribute
syncInProgress instance-attribute

InputMISPImportCase

Bases: TypedDict

caseTemplate instance-attribute
assignee instance-attribute
tasks instance-attribute
pages instance-attribute
customFields instance-attribute
sharingParameters instance-attribute
taskRule instance-attribute
observableRule instance-attribute

observable

InputObservable

Bases: TypedDict

dataType instance-attribute
data instance-attribute
message instance-attribute
startDate instance-attribute
attachment instance-attribute
tlp instance-attribute
pap instance-attribute
tags instance-attribute
ioc instance-attribute
sighted instance-attribute
sightedAt instance-attribute
ignoreSimilarity instance-attribute
isZip instance-attribute
zipPassword instance-attribute

OutputObservable

Bases: TypedDict

dataType instance-attribute
data instance-attribute
startDate instance-attribute
attachment instance-attribute
tlp instance-attribute
tlpLabel instance-attribute
pap instance-attribute
papLabel instance-attribute
tags instance-attribute
ioc instance-attribute
sighted instance-attribute
sightedAt instance-attribute
reports instance-attribute
message instance-attribute
extraData instance-attribute
ignoreSimilarity instance-attribute

InputUpdateObservable

Bases: TypedDict

dataType instance-attribute
message instance-attribute
tlp instance-attribute
pap instance-attribute
tags instance-attribute
ioc instance-attribute
sighted instance-attribute
sightedAt instance-attribute
ignoreSimilarity instance-attribute
addTags instance-attribute
removeTags instance-attribute

InputBulkUpdateObservable

Bases: InputUpdateObservable

ids instance-attribute

observable_type

InputObservableType

Bases: TypedDict

name instance-attribute
isAttachment instance-attribute

OutputObservableType

Bases: TypedDict

name instance-attribute
isAttachment instance-attribute

organisation

Bases: TypedDict

linkType instance-attribute
otherLinkType instance-attribute

Bases: TypedDict

toOrganisation instance-attribute
avatar instance-attribute
linkType instance-attribute
otherLinkType instance-attribute

OutputSharingProfile

Bases: TypedDict

name instance-attribute
description instance-attribute
autoShare instance-attribute
editable instance-attribute
permissionProfile instance-attribute
taskRule instance-attribute
observableRule instance-attribute

InputOrganisation

Bases: TypedDict

name instance-attribute
description instance-attribute
taskRule instance-attribute
observableRule instance-attribute
locked instance-attribute

OutputOrganisation

Bases: TypedDict

name instance-attribute
description instance-attribute
taskRule instance-attribute
observableRule instance-attribute
avatar instance-attribute
locked instance-attribute
extraData instance-attribute

InputUpdateOrganisation

Bases: TypedDict

name instance-attribute
description instance-attribute
taskRule instance-attribute
observableRule instance-attribute
locked instance-attribute
avatar instance-attribute

Bases: TypedDict

linkType instance-attribute
otherLinkType instance-attribute
organisation instance-attribute

page

InputCasePage

Bases: TypedDict

title instance-attribute
content instance-attribute
order instance-attribute
category instance-attribute

OutputCasePage

Bases: TypedDict

title instance-attribute
content instance-attribute
order instance-attribute
category instance-attribute
extraData instance-attribute

InputUpdateCasePage

Bases: TypedDict

title instance-attribute
content instance-attribute
category instance-attribute
order instance-attribute

page_template

InputPageTemplate

Bases: TypedDict

title instance-attribute
content instance-attribute
order instance-attribute
category instance-attribute

OutputPageTemplate

Bases: TypedDict

title instance-attribute
content instance-attribute
order instance-attribute
category instance-attribute
extraData instance-attribute

InputUpdatePageTemplate

Bases: TypedDict

title instance-attribute
content instance-attribute
order instance-attribute
category instance-attribute

procedure

InputProcedure

Bases: TypedDict

occurDate instance-attribute
patternId instance-attribute
tactic instance-attribute
description instance-attribute

OutputProcedure

Bases: TypedDict

description instance-attribute
occurDate instance-attribute
patternId instance-attribute
patternName instance-attribute
tactic instance-attribute
tacticLabel instance-attribute
extraData instance-attribute

InputUpdateProcedure

Bases: TypedDict

description instance-attribute
occurDate instance-attribute
patternId instance-attribute
tactic instance-attribute

profile

InputProfile

Bases: TypedDict

name instance-attribute
permissions instance-attribute

OutputProfile

Bases: TypedDict

name instance-attribute
permissions instance-attribute
editable instance-attribute
forAdmin instance-attribute
forOrg instance-attribute
consumesLicense instance-attribute

InputUpdateProfile

Bases: TypedDict

name instance-attribute
permissions instance-attribute

share

OutputShare

Bases: TypedDict

caseId instance-attribute
profileName instance-attribute
organisationName instance-attribute
owner instance-attribute
taskRule instance-attribute
observableRule instance-attribute

InputShare

Bases: TypedDict

organisation instance-attribute
share instance-attribute
profile instance-attribute
taskRule instance-attribute
observableRule instance-attribute

task

InputTask

Bases: TypedDict

title instance-attribute
group instance-attribute
description instance-attribute
status instance-attribute
flag instance-attribute
startDate instance-attribute
endDate instance-attribute
order instance-attribute
dueDate instance-attribute
assignee instance-attribute
mandatory instance-attribute

OutputTask

Bases: TypedDict

title instance-attribute
group instance-attribute
description instance-attribute
status instance-attribute
flag instance-attribute
startDate instance-attribute
endDate instance-attribute
assignee instance-attribute
order instance-attribute
dueDate instance-attribute
mandatory instance-attribute
extraData instance-attribute

InputUpdateTask

Bases: TypedDict

title instance-attribute
group instance-attribute
description instance-attribute
status instance-attribute
flag instance-attribute
startDate instance-attribute
endDate instance-attribute
order instance-attribute
dueDate instance-attribute
assignee instance-attribute
mandatory instance-attribute

InputBulkUpdateTask

Bases: InputUpdateTask

ids instance-attribute

task_log

InputTaskLog

Bases: TypedDict

message instance-attribute
startDate instance-attribute
includeInTimeline instance-attribute
attachments instance-attribute

OutputTaskLog

Bases: TypedDict

message instance-attribute
date instance-attribute
attachments instance-attribute
owner instance-attribute
includeInTimeline instance-attribute
extraData instance-attribute

InputUpdateTaskLog

Bases: TypedDict

message instance-attribute
includeInTimeline instance-attribute

timeline

OutputTimelineEvent

Bases: TypedDict

date instance-attribute
kind instance-attribute
entity instance-attribute
entityId instance-attribute
details instance-attribute
endDate instance-attribute

OutputTimeline

Bases: TypedDict

events instance-attribute

InputCustomEvent

Bases: TypedDict

date instance-attribute
endDate instance-attribute
title instance-attribute
description instance-attribute

OutputCustomEvent

Bases: TypedDict

date instance-attribute
endDate instance-attribute
title instance-attribute
description instance-attribute

InputUpdateCustomEvent

Bases: TypedDict

date instance-attribute
endDate instance-attribute
title instance-attribute
description instance-attribute

user

InputUserType = Literal['Normal', 'Service'] module-attribute

InputUser

Bases: TypedDict

login instance-attribute
name instance-attribute
email instance-attribute
password instance-attribute
profile instance-attribute
organisation instance-attribute
type instance-attribute

Bases: TypedDict

toOrganisation instance-attribute
linkType instance-attribute
otherLinkType instance-attribute
avatar instance-attribute

OutputOrganisationProfile

Bases: TypedDict

organisationId instance-attribute
organisation instance-attribute
profile instance-attribute
avatar instance-attribute

OutputUser

Bases: TypedDict

login instance-attribute
name instance-attribute
email instance-attribute
hasKey instance-attribute
hasPassword instance-attribute
hasMFA instance-attribute
locked instance-attribute
profile instance-attribute
permissions instance-attribute
organisation instance-attribute
avatar instance-attribute
organisations instance-attribute
type instance-attribute
defaultOrganisation instance-attribute
extraData instance-attribute

InputUpdateUser

Bases: TypedDict

name instance-attribute
organisation instance-attribute
profile instance-attribute
locked instance-attribute
avatar instance-attribute
email instance-attribute
defaultOrganisation instance-attribute
type instance-attribute

InputUserOrganisation

Bases: TypedDict

organisation instance-attribute
profile instance-attribute
default instance-attribute

OutputUserOrganisation

Bases: TypedDict

organisation instance-attribute
profile instance-attribute
default instance-attribute