[TheHive] add comment #4240
[TheHive] add comment #4240
Conversation
There was a problem hiding this comment.
Hello @MohamedMerimi : Thanks for your contribution and sorry for the late reply.
I open a PR this morning to solve an issue related to SSL verification. Can you integrate the fix in your PR to close my own (#4419)
| @@ -123,6 +124,7 @@ def __init__(self): | |||
| self.severity_mapping[int(mapping.split(":")[0])] = mapping.split(":")[1] | |||
|
|
|||
| self.thehive_api = TheHiveApi(self.thehive_url, self.thehive_api_key) | |||
There was a problem hiding this comment.
Can we use the "check_ssl" connector option instead of disabling SSL verification by default?
self.thehive_api = TheHiveApi(
self.thehive_url, self.thehive_api_key, verify=self.thehive_check_ssl
)
There was a problem hiding this comment.
It's done on my side but i have a problem CircleCI detected vulnerable package, It's the same problem as my pull request zscaler
| @@ -230,7 +232,7 @@ def generate_alert_bundle(self, alert): | |||
| return {} | |||
|
|
|||
| def generate_case_bundle(self, case): | |||
| """Generate a stix bundle from a given case.""" | |||
| """Génère un STIX bundle à partir d'un cas TheHive (sans attachments).""" | |||
There was a problem hiding this comment.
Can you keep the comment in English ?
|
@MohamedMerimi can you rebase master in your branch? The starlette library have been updated in the 6.7.6. |
|
I had update my branch last week , i checked today and my branch is already up to date, so i can't push "nothing to comite" |
|
@MohamedMerimi To handle the issue and rebase properly, you should have your master aligned with the current master and here are the steps to help you:
By following those steps, you will be realigned :) Hope that helps |
MohamedMerimi
force-pushed
the
Add-comment-Thehive
branch
from
6d725f9 to
839073a
Compare
|
Thank you Helene for your help, it's done I rebase and update my master branch |
Summary
This PR adds support for importing case comments from TheHive into OpenCTI.
Details
Introduced a new method process_comments() that retrieves and processes all comments related to a TheHive case.
Each comment is converted into a STIX note object.
The notes are linked to the corresponding case using object_refs.
Handles edge cases where _createdAt is missing by falling back to case creation date or current timestamp.
Case comments in TheHive often contain useful context and investigation insights. Bringing them into OpenCTI helps improve collaboration and enriches case history.
Impact
This does not break existing functionality.
Controlled via the case import logic and fits into the existing connector structure.
Further comments