Searching For Cases

[thehive-project]

Searching For Cases

[nadouani]

Hello,

You can find samples using the query builder utilities, at samples/test-case-search.py

If you need to have a search criteria on dates, you need to use thehive4py.query.Between method. This operator will be fixed in 1.4.4 release.

_from and _to should be timestamps.

[sebastianfon94]

Hello,

I want to create a query with date criteria, i used this one, but it only show me the last 10 created cases:

search("Case of title containing 'From TheHive4Py'", And(In('tags', ['TAG1'])), Between('startDate',1539406800,1541998800), [])

i tried to use the timestamps as string and as a number. Am i doing something wrong in the query?
@nadouani @nalibrahim

[nadouani]

The search() function is just wrapper used in the sample files.

By default it returns 10 items, so you need to call it by specifying the range 'all'

search("Case of title containing 'From TheHive4Py'", And(In('tags', ['TAG1'])), Between('startDate',1539406800,1541998800), 'all', [])

[sebastianfon94]

But the 'all' range it's an extra argument?, Because the query only accepts 4.

[nadouani]

# Get a client
api = TheHiveApi('http://127.0.0.1:9000', '**YOUR_API_KEY**')

# Build your query
query = And(...)

# Call the API
response = api.find_cases(query=query, range='all')

[sebastianfon94]

Something like this?

query = And(In('tags', ['TAG1']), Between('startDate', 1539406800, 1541998800))
response = api.find_cases(query=query, range='all', sort=sort)

in that way it give me 0 cases.

[sebastianfon94]

Any suggestion? @nadouani

[nadouani]

For me, this should work. Are you sure about your date interval?

[sebastianfon94]

i used this for convert date to timestamp,

time.mktime(datetime.datetime.strptime("13/10/2018", "%d/%m/%Y").timetuple()
time.mktime(datetime.datetime.strptime("12/11/2018", "%d/%m/%Y").timetuple()

and gave this timestamp's: 1539406800, 1541998800

i used a online timestamp-date converter to verify, and it's correct.

[nadouani]

What about

query = In('tags', ['TAG1'])
response = api.find_cases(query=query, range='all', sort=sort)

[sebastianfon94]

With that query, the script show me all cases with that tag, but I need with that tag, and all created cases in that date interval, that's why i'm trying to use the Between function.

[nadouani]

I think that the timestamps must be multiplied by 1000

[sebastianfon94]

Yep, that was the problem, thanks for your help, it was very helpfull!, why should i do that multiplication?

[nadouani]

TheHive use timestamps in milliseconds and python using time returns seconds

[sebastianfon94]

I understand, thanks again for your help!