Add the ability to search for all active observables where ioc:true without knowing caseIds

[thehive-project]

Add the ability to search for all active observables where ioc:true without knowing caseIds

[mnmnc]

i think you can use function __find_rows for that. It basically works as if you use REST API /case/artifact/_search endpoint. You just have to submit search path. Resulting Json will contain case Id unter _parent IIRC.

[nadouani]

This will be part of the library re writing #85

[nadouani]

i think you can use function __find_rows for that. It basically works as if you use REST API /case/artifact/_search endpoint. You just have to submit search path. Resulting Json will contain case Id unter _parent IIRC.

This is 100% valid.

[NeilPalmere]

So, using a generalized search, it would look something like:

api = TheHiveApi("https://thehive.company.com", username, password)

refinement = {"_string":"!_type:audit AND !_type:data AND !_type:user AND !_type:analyzer AND !_type:alert AND !_type:case_artifact_job_log AND !status:Deleted"}

searchTerm = 'ioc:true'

ioc_query = {
"_and": [
{"_string": searchTerm},
refinement
]
}
ioc_rows = api.__find_rows("/api/_search?nparent=10", query=ioc_query)

[nadouani]

No your can directly call /api/case/artifact/_search with {"ioc":true}

ioc_query = {"ioc":true}
api.__find_rows(`/api/case/artifact/_search?nparent=1`, query=ioc_query)