unable to delete alerts via api

[robomotic]

Hello folks, here's my problem, I am in a test environment and I want to delete all the existing alerts, so I do this:

api = TheHiveApi('http://{0}:9000'.format(dev_ip),dev_api,cert=False)


alerts = api.find_alerts()

for alert in alerts.json():
    print(alert['id'])
    ok = delete_alert(alert['id'])
    print(ok)
    case = api.get_alert(alert['id'])
    print(case.json()['title'])

This is the delete function:

alert_url = dev_base_url + r'api/alert/'
headers = {'Authorization':'Bearer {0}'.format(prod_api)}

def delete_alert(alertid):

    r = requests.delete(alert_url+'{0}'.format(alertid),headers=headers,verify=False)

    return r.status_code

None of the alerts are deleted even though the server responds with a 204:

84af528aff1695a8e3047f50da84deb1
204
GandCrab v5.1
332a1ca880c4445bd94139d766a36df6
204
New Alert

[crackytsi]

Hi, I understand it that delete an alert means Setting it in Status "Ignored". So thats the reason why you get an 204 error.

There is currently no way to really "delete" an alert except doing it on DB Level.

[mathgirl26]

Hi,

I have the same issue. And how to do it on the DB level? Do you have some documentation?

Thank you.

[devinbfergy]

I would google how to delete documents out of elasticsearch instance. Then search through the hive index for the alert documents and delete them.

[troal]

i have the same need, anybody already know thehive indexes structure in ELK? the correct curl delete call would be very nice to have :)

[cudeso]

See https://github.com/TheHive-Project/TheHive4py/pull/137

[gonrada]

Why is the default behavior to "ignore" the alerts on a http delete?

[graememeyer]

For some reason you need to append "?force=1" as a query string to the url to delete alerts with this method. If you inspect the traffic from the actual web gui, that's what the application actually does. You can replicate this with curl:

Doesn't work:

curl -X DELETE -H 'Authorization: Bearer your_api_token_here' -H 'Content-Type: application/json' http://thehive3.local:9000/api/alert/ba61f5dc2952d98c855d0bbb17344e2b

Does work:

curl -X DELETE -H 'Authorization: Bearer your_api_token_here' -H 'Content-Type: application/json' http://thehive3.local:9000/api/alert/ba61f5dc2952d98c855d0bbb17344e2b?force=1