API _search examples

[xme]

Hello *,

I'm fighting with the API to search for alerts... There is a lack of documentation regarding the 'range' & 'query' parameters. Any example of what can be used to filter alters?

/x

[nadouani]

Hello @xme this is very true :( We need to document the query syntax that TheHive (and Cortex also) support.

You can find the possible operators here https://github.com/TheHive-Project/TheHive4py/blob/master/thehive4py/query.py

Stay tuned

[nadouani]

That said, if you have a specific question regarding the query content, please shoot ;)

[xme]

Tx! I've a PS script that is trying to search for alerts. The JSON passed in the POST is:

$query = @{
   "range" = "all"
   "query" = @{"status" = "New"}
}
$json = $query | ConvertTo-Json

But it does not work... At least, I receive max 10 alerts... or the script fails with this error: An existing connection was forcibly closed by the remote host."

[nadouani]

The range and sort are query params, so typically a curl query could be:

curl -XPOST -H 'Content-Type: application/json' -H 'Autheorization: Bearer XXXX' 'http://server:port/api/alert/_search?range=0-100&sort=-createdAt' -d '{
   "query": {"status": "New"}
}'

[saadkadhi]

s/Autheorization/Authorization/ and range=all should work:

curl -XPOST -H 'Content-Type: application/json' -H 'Authorization: Bearer XXXX' 'http://server:port/api/alert/_search?range=all&sort=-createdAt' -d '{
   "query": {"status": "New"}
}'

I've just tested it and it works.

[xme]

Other value(s) that 'range' can accept? Or, by example, searching alerts before xx-xx-xxxx ?

[nadouani]

range can be either all or from-to (0-100, 101-200)

to filter alerts before xx-xx-xxxx you can use:

{
  "query": {
    "_lte": {
      "createdAt": TIMESTAMP
    }
  }
}

[indigocarmen]

Sorry to piggyback, but is this the only way to search alert indicators? It would be very handy to summarize alerts by indicator IP.

[Marsidi]

Hello, I am trying to make a query on alerts like this:

from thehive4py.api import TheHiveApi, Eq from thehive4py.query import And, Between

api = TheHiveApi(url, HIVE_APIKEY) sts = Eq('status', 'Ignored') between = Between("startDate", '1570485600000', '1570572000000') query = And(sts, between) alerts = api.find_alerts(query=query) response = json.loads(alerts.text)

I get alerts.status 200, but i get empty response list. If i remove 'between' from query it works but i need the alerts between two dates. PS:In this way is working perfectly to find the cases between two dates

[gKits]

Is it posisble to query for the customFields in a case e.g. if have a case like this:

{
    "severity": 1,
    "caseId": 1,
    ...
    "customFields": {
        "foo": {
            "bar": "baz"
        }
    }
}

would it be possible to write a query to find all cases where the customFields.foo.bar is equal to baz? Would this work:

{ "query": { "customFields.foo.bar": "baz" } }

[iiArrow]

Is it posisble to query for the customFields in a case e.g. if have a case like this:

{ "severity": 1, "caseId": 1, ... "customFields": { "foo": { "bar": "baz" } } } would it be possible to write a query to find all cases where the customFields.foo.bar is equal to baz? Would this work:

{ "query": { "customFields.foo.bar": "baz" } }

Hey @gKits, I managed to query a customfield on our environment, I used the below syntax.. hope it helps

params = {
        "query": {
            "_between": [
                {"_field": "customFields.rule", "_value": True},
            ]
        },
        "range": "0-100"
    }