There will be a new version of Elastalert to be able to integrate new versions of Thehive 5 after the vendor deactivate API v0, maybe in v. 5.6.0??

[b4lh4ck]

Hello everyone

I have one question

There will be a new version of Elastalert to be able to integrate new versions of Thehive 5 after the vendor deactivate API v0, maybe in v. 5.6.0??

[nsano-rururu]

@b4lh4ck
I've never used theHive, so I can't provide a solution, but I think if we don't organize information on what needs to be done, no one will be able to fix it, so I'd like to ask a question.

1. Has theHive 5.6.0 been released yet? Or will it be released soon?
2. Do you know what changes need to be made to the source code for theHive currently compatible with elastalert2? Is there a URL for information on breaking changes in theHive 5.6.0?
3. I don't use TheHive4py with elastalert2, but should I use it?

[nsano-rururu]

@b4lh4ck

https://github.com/jertel/elastalert2/blob/master/elastalert/alerters/thehive.py#L154

current

 req = f'{hive_host}:{hive_port}/api/alert'

Added hive_api_version setting. The default value is v0. If v0 is used, it will be the previous api/alert. If v1 is set, it will be changed to api/v1/alert for TheHive 5.6.0 or later.

after

yaml

Setting image. Only a part of it is shown.

hive_connection:
  hive_host: "http://thehive.example.com"
  hive_port: 9000
  hive_apikey: "xxxxxxxx"
  hive_api_version: "v1" 

self.hive_api_version =connection_details.get('hive_api_version', 'v0')
if self.hive_api_version == 'v0':
    # API v0 routes
    req = f'{hive_host}:{hive_port}/api/alert'
else:
    # API v1 routes
    req = f'{hive_host}:{hive_port}/api/v1/alert'

[nsano-rururu]

I don't intend to move forward with this matter until I receive a response from the issue originator.

[b4lh4ck]

I don't intend to move forward with this matter until I receive a response from the issue originator.

Thank you so much for your help @nsano-rururu , we are working applying the steps that you suggested

[ptobis]

Please take into account that according to TheHive API docs, observables need to be used instead of artifacts in https://github.com/jertel/elastalert2/blob/master/elastalert/alerters/thehive.py#L121.

[b4lh4ck]

Please take into account that according to TheHive API docs, observables need to be used instead of artifacts in https://github.com/jertel/elastalert2/blob/master/elastalert/alerters/thehive.py#L121.

thanks for your answer @ptobis, I'm going to take it into account

Thanks again @nsano-rururu , We add the v1 in the url /api/v1/alert and it works

[b4lh4ck]

thanks to everyone

I closed the discussion