The Hive Notification

[frantz45]

Create a new Notification plugin to interact with The Hive v5 API to create and update Alerts

[frantz45]

It must handle custom_fields, TTPs...

Need to think how to map Graylog fields with Observables.
Maybe configure in each Notification an array :

observable name	observable type	observable tags	graylog field
src_ip	ip	source, malware, c2	srcIp

Limit observable type to the existing ones.
I didn't put all the observables settings but I think we can add tlp, pap, ioc, similarity...
It should get all the values present in backlog for the indicated Graylog field.

Need a configuration page to set the TheHive URL and API token, and a default Observabel mapping array.

Need a buffer in case TheHive is ont available (in memory or a more robust one ?)