Release Notes

2.0.3 (2025-10-29)

Deprecated

• #515 - Deprecate python 3.9 by @Kamforka in #517

Other

• #507 - Use TheHive v5.5.10 in integration tests by @Kamforka in #510
• #508 - Document case and alert comment usage by @Kamforka in #512
• #358 - Integrate examples into the test suite by @Kamforka in #513
• #509 - Document usage of task logs by @Kamforka in #511
• #514 - Add python 3.14 support by @Kamforka in #516

Full Changelog: 2.0.2...2.0.3

2.0.2 (2025-09-30)

Added

• #496 - Add missing cortex.bulk_create_analyzer_jobs and cortex.find_analyzer_jobs methods by @Kamforka in #502

Fixed

• #495 - Fix incorrectly typed properties (assignee, summary, impactStatus) of case.InputUpdateCase by @Kamforka in #501
• #499 - Fix maltyped date properties (_createdAt, _updatedAt, startDate, endDate) in cortex.OutputAnalyzerJob and cortex.OutputResponderAction types by @Kamforka in #505

Other

• #497 - Use TheHive v5.5.9 in integration tests by @Kamforka in #503
• #498 - Test and document bulk observable creation in alerts and cases by @Kamforka in #504

Full Changelog: 2.0.1...2.0.2

2.0.1 (2025-08-27)

Added

• #448 - Add comment.find method by @Kamforka in #487
• #491 - Add MISP connector endpoints by @Kamforka in #492

Changed

• #351 - Update alert.InputAlert and alert.OutputAlert types by @Kamforka in #490
• #351 - Update attachment.OutputAttachment type by @Kamforka in #490
• #351 - Update case.InputCase, case.OutputCase, case.InputImportCase, case.InputApplyCaseTemplate, case.OutputCaseLink, case.OutputImportCase and case.InputCaseOwnerOrganisation types by @Kamforka in #490
• #351 - Update cortex.OutputAnalyzer, cortex.OutputResponder, cortex.OutputAnalyzerJob, cortex.OutputResponderAction, cortex.InputResponderAction and cortex.InputAnalyzerJob types by @Kamforka in #490
• #351 - Update observable.InputObservable and observable.OutputObservable types by @Kamforka in #490
• #351 - Update organisation.InputBulkOrganisationLink, organisation.InputOrganisation and organisation.OutputOrganisation types by @Kamforka in #490
• #351 - Update page.InputCasePage and page.OutputCasePage types by @Kamforka in #490
• #351 - Update share.OutputShare and share.InputShare types by @Kamforka in #490
• #351 - Update task.InputTask and task.OutputTask types by @Kamforka in #490
• #351 - Update task_log.InputTaskLog and task.OutputTaskLog types by @Kamforka in #490
• #351 - Update user.InputUser, user.OrganisationLink, user.OutputOrganisationProfile, user.OutputUser and user.InputUserOrganisation types by @Kamforka in #490
• #447 - Update timeline.OutputTimelineEvent, timeline.InputCustomEvent and timeline.OutputCustomEvent types by @Kamforka in #488
• #448 - Update comment.OutputComment type by @Kamforka in #487

Other

• #447 - Add docstrings to timeline endpoints by @Kamforka in #488
• #448 - Add docstrings to comment endpoints by @Kamforka in #487
• #491 - Add docstrings to cortex endpoints by @Kamforka in #492

Full Changelog: 2.0.0...2.0.1

2.0.0 (2025-08-04)

Other

• #480 - Fix deploy_docs dev script by @Kamforka in #481
• #480 - Fix deploy_docs flag typo by @Kamforka in #482
• #483 - Use TheHive v5.5.7 in integration tests by @Kamforka in #484

Full Changelog: 2.0.0b13...2.0.0

2.0.0b13 (2025-07-15)

Added

• #441 - Add custom_field.CustomFieldType type by @Kamforka in #466
• #444 - Add procedure.get, procedure.bulk_create_in_case and procedure.bulk_create_in_alert methods by @Kamforka in #469

Changed

• #441 - Update custom_field.InputCustomFieldValue, custom_field.InputCustomField and custom_field.OutputCustomField types by @Kamforka in #466
• #443 - Update observable_type.InputObservableType and observable_type.OutputObservableType types by @Kamforka in #468
• #444 - Update procedure.InputProcedure, procedure.OutputProcedure and procedure.InputUpdateProcedure types by @Kamforka in #469
• #445 - Update profile.InputProfile and profile.OutputProfile types by @Kamforka in #470

Other

• #441 - Add docstrings to custom_field endpoints by @Kamforka in #466
• #443 - Add docstrings to observable_type endpoints by @Kamforka in #468
• #444 - Add docstrings to procedure endpoints by @Kamforka in #469
• #445 - Add docstrings to profile endpoints by @Kamforka in #470
• #446 - Add docstrings to query endpoints by @Kamforka in #471
• #467 - Introduce nox to manage dev scripts by @Kamforka in #472
• #473 - Introduce ruff to replace flake8 and black by @Kamforka in #474
• #477 - Use TheHive v5.5.5 in integration tests by @Kamforka in #478

Full Changelog: 2.0.0b12...2.0.0b13

2.0.0b12 (2025-06-24)

Added

• #436 - Add user.change_password method by @Kamforka in #454
• #436 - Add user.InputUserType and user.OrganisationLink types by @Kamforka in #454
• #437 - Implement task.list_shares, task.share and task.unshare methods by @Kamforka in #460
• #442 - Add attachment.InputAttachment type by @Kamforka in #456
• #440 - Add case_template.link_page_templates and case_template.find_page_templates methods by @Kamforka in #462
• #440 - Introduce page_template endpoints and types by @Kamforka in #462
• #440 - Introduce new project dependency of typing_extensions to be able to support the new Required/NotRequired type annotations by @Kamforka in #462

Changed

• #436 - Update user.InputUser, user.OutputOrganisationProfile and user.InputUpdateUser types by @Kamforka in #454
• #442 - Update attachment.OutputAttachment, observable.InputObservable and observable. InputUpdateObservable types by @Kamforka in #456
• #457 - Organize API reference better by @Kamforka in #461
• #440 - Change case_template.InputCaseTemplate and case_template.OutputCaseTemplate types by @Kamforka in #462

Deprecated

• #436 - Deprecate user.lock and user.unlock methods in favour of user.update by @Kamforka in #454

Other

• #436 - Add docstrings to user endpoints by @Kamforka in #454
• #437 - Add docstrings task endpoints by @Kamforka in #460
• #442 - Add docstrings to observable endpoints by @Kamforka in #456
• #458 - Use TheHive v5.5.3 in integration tests by @Kamforka in #459
• #440- Add docstrings to case_template endpoints by @Kamforka in #462

Full Changelog: 2.0.0b11...2.0.0b12

2.0.0b11 (2025-05-31)

Added

• #302 - Add organisation.add_attachment, organisation.delete_attachment, organisation.download_attachment and organisation.find_attachments methods by @Kamforka in #432
• #434 - Add alert.import_into_case and alert.get_similar_observables methods by @Kamforka in #439
• #435 - Add case.change_owner_organisation, case.manage_access, case.get_similar_observables, case.link_case, case.delete_case_link, case.link_url, case.delete_url_link and case.get_link_types methods by @Kamforka in #450
• #435 - Add case.OutputCaseObservableMerge, case.OutputCaseLink, case.OutputImportCase, case.InputCaseOwnerOrganisation, case.InputCaseAccess, case.InputCaseLink and case.InputURLLink types by @Kamforka in #450
• #438 - Introduce task_log.add_attachment method to comply with the naming convention in other endpoints by @Kamforka in #451

Changed

• #428 - Update observable.OutputObservableRequired type by @3lina in #430
• #302 - Update organisation.InputBulkOrganisationLink type by @Kamforka in #432
• #435 - Update case.InputCase, case.OutputCase, case.InputUpdateCase and custom_field.OutputCustomFieldValue types by @Kamforka in #450
• #438 - Update task_log.create method to support creation of logs with attachments by @Kamforka in #451
• #438 - Update task_log.InputTaskLog and task_log.OutputTaskLog types by @Kamforka in #451

Deprecated

• #434 - Deprecate alert.download_attachment method in favour of organisation.download_attachment by @Kamforka in #439
• #435 - Deprecate case.download_attachment method in favour of organisation.download_attachment by @Kamforka in #450
• #438 - Deprecate task_log.add_attachments method in favour of task_log.add_attachment (note the missing s at the end) to comply with the naming convention in other endpoints by @Kamforka in #451

Other

• #302 - Add docstrings to the organisation endpoints by @Kamforka in #432
• #425 - Use TheHive v5.5.2 in integration tests by @Kamforka in #433
• #438 - Add docstrings to the task_log endpoints by @Kamforka in #451

New Contributors

• @3lina made their first contribution in #430

Full Changelog: 2.0.0b10...2.0.0b11

2.0.0b10 (2025-05-13)

Removed

• #401 - Remove support for python 3.8 by @Kamforka in #407

Fixed

• #410 - Review and fix alert docs by @Kamforka in #412
• #417 - consider empty dicts in json requests by @Kamforka in #418

Other

• #411 - Fix changelog linkification script by @Kamforka in #413
• #408 - Use TheHive 5.4.8 in integration tests by @Kamforka in #409
• #414 - Use TheHive v5.4.9 in integration tests by @Kamforka in #415
• #419 - Use TheHive v5.5.1 in integration tests by @Kamforka in #421

Full Changelog: 2.0.0b9...2.0.0b10

2.0.0b9 (2025-02-25)

Added

• #390 - Extend CaseEndpoint with apply_case_template method by @Kamforka in #391
• #354 - Add case endpoint docstrings by @Kamforka in #399
• #355 - Add changelog to docs by @Kamforka in #400

Removed

• #398 - Remove update_share method from case endpoint by @Kamforka in #402

Fixed

• #388 - Enhance session's error parse method by @Kamforka in #393
• #389 - Fix types.cortex.OutputAnalyzerJob by @Kamforka in #392
• #395 - Fix InputAnalyzerJob type and add regression test by @JuanTecedor in #397

Other

• #386 - Use TheHive 5.4.7 in integration tests by @Kamforka in #387
• #354 - Add case endpoint docs by @Kamforka in #394

Full Changelog: 2.0.0b8...2.0.0b9

2.0.0b8 (2025-01-15)

Added

• #376 - Add Has query filter and fix deprecations, add warning for Contains filter by @JuanTecedor in #377
• #374 - Add new endpoint to be able to manage case templates by @Anko59 in #375

Changed

• #370 - Enhance cortex endpoint with additional methods and types by @Anko59 in #371
• #376 - Fix outdated query filters to address corresponding TheHive warnings by @JuanTecedor in #377
• #380 - Update case and alert endpoint types by @Kamforka in #383

Deprecated

• #361 - Add deprecation warning for python 3.8 by @Kamforka in #384
• #376 - Deprecate Contains query filter in favour of Has by @JuanTecedor in #377

Other

• #362 - Add release.yml to better control auto generated release notes by @Kamforka in #379
• #372 - Use TheHive 5.4.5 in integration tests by @Kamforka in #373
• #381 - Use TheHive 5.4.6 in integration tests by @Kamforka in #382

New Contributors

• @Anko59 made their first contribution in #371
• @JuanTecedor made their first contribution in #377

Full Changelog: 2.0.0b7...2.0.0b8

2.0.0b7 (2024-11-24)

Breaking changes

• TheHiveApi client's verify argument was improperly set to the default value of None, which only raised a warning when the client was connecting to a TheHive instance with an https:// base url. From now on verify will default to True that might lead to an SSL verification error, so to fix that one can:

  • pass the path to the cert bundle to be used by the client, e.g.: verify=/path/to/cert/bundle.crt
  • export the REQUESTS_CA_BUNDLE with the cert bundle path, e.g.: REQUESTS_CA_BUNDLE=/path/to/cert/bundle.crt
  • disable SSL verification like before - not recommended - e.g.: verify=None

Deprecated

• TheHiveApi.case.update method's case argument is going to be retired in favor of the fields argument to conform with other endpoints update methods.

Added

• #339 - add codecov action by @Kamforka in #342
• #339 - add workflow trigger on merge to main by @Kamforka in #343
• #347 - Add support for Python 3.13 by @Kamforka in #349
• #345 - Add initial mkdocs page by @Kamforka in #346
• #301 - Add client, alert and api reference docs by @Kamforka in #350
• #340 - Add retry mechanism by @Kamforka in #344

Changed

• Patch important note sections in README by @Kamforka in #337
• Bump actions/download-artifact from 3 to 4.1.7 in /.github/workflows by @dependabot in #338
• #301 - Adjust thehive4py title's font size by @Kamforka in #357
• #359 - Upgrade test integrator to use v5.4.2 by @Kamforka in #360

New Contributors

• @dependabot made their first contribution in #338

Full Changelog: 2.0.0b6...2.0.0b7

2.0.0b6 (2024-08-28)

What's Changed

• Review task type hints by @Kamforka in #318
• Extend alert endpoint with attachment methods by @Kamforka in #321
• Rework test container by @Kamforka in #326
• Align pyproject.toml to Git Repo License of MIT by @jamesmckibbenathrb in #330
• Update TheHive icon link in README.md by @Kamforka in #331
• Add a generic query endpoint and align case update fields with other update methods by @Kamforka in #334

New Contributors

• @jamesmckibbenathrb made their first contribution in #330

Full Changelog: 2.0.0b5...2.0.0b6

2.0.0b5 (2023-10-13)

What's Changed

Merged Pull Requests * Delete unused setup.py by @Kamforka in #298 * Actualize main with develop by @Kamforka in #297 * Enhance readme by @Kamforka in #299 * Add deployment workflow by @Kamforka in #300 * Update important note and add query examples by @Kamforka in #305 * Change to MIT license by @Kamforka in #306 * Get rid of setup.cfg by @Kamforka in #309 * Fix and update filters by @Kamforka in #310 * Bump thehive4py-integrator to v5.2.5 by @Kamforka in #312

Full Changelog: 2.0.0b4...2.0.0b5

2.0.0b4 (2023-01-20)

What's Changed

Full Changelog

Closed issues:

• Add case and alert TTPs operations #268
• How to perform a bulk-insert of observables #263

Merged pull requests:

• add py.typed to the project to please mypy and make the library PEP-561 compliant #272 (Kamforka)
• 268 add case and alert ttps operations #271 (Kamforka)
• Test observable attachment download #270 (Kamforka)
• Add parameters to method alert.promote_to_case() #269 (vdebergue)
• Update README.md #267 (ater49)
• Download an attachment from an observable #266 (mike1796)
• Create local ci commands for devs #265 (Kamforka)
• Add observableType endpoints #264 (Black-Pearl25)
• Migrate to pyproject.toml #262 (Kamforka)
• Add basic ci workflow #261 (Kamforka)

2.0.0b3 (2022-10-24)

What's Changed

Full Changelog

Closed issues:

• Use between with 2 dates #257
• JSONDecodeError not caught correctly when using AWS Lambda #255
• thehive4py==1.8.1 Code Erroe #254

Merged pull requests:

• Set InputAlert's date property as optional #260 (Kamforka)
• Use json.loads instead of relying on requests' json method #259 (Kamforka)
• Persist error response data in TheHiveError #258 (Kamforka)

2.0.0b2 (2022-08-20)

What's Changed

• #250 - Implement list comment methods for alerts and cases by @Kamforka in #251
• [fr] ability to manage multi valued customfields by @Kamforka in #253

Full Changelog: 2.0.0b1..2.0.0b2

2.0.0b1 (2022-08-05)

What's Changed

• #250 - Implement list comment methods for alerts and cases by @Kamforka in #251

Full Changelog: 2.0.0b0...2.0.0b1

2.0.0b0 (2022-08-05)

What's Changed

• Update for 5.0.1 by @vdebergue in #241
• added case.set_share by @migueldo in #242

New Contributors

• @vdebergue made their first contribution in #241
• @migueldo made their first contribution in #242

Full Changelog: 2.0.0b0