mirror of
https://github.com/ail-project/ail-framework.git
synced 2024-11-10 08:38:28 +00:00
fix: [TheHive feeder] create alert
This commit is contained in:
parent
4306da666b
commit
97905367b6
1 changed files with 4 additions and 4 deletions
|
@ -58,15 +58,15 @@ from thehive4py.models import Case, CaseTask, CustomFieldHelper
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
def create_the_hive_alert(source, path, tag):
|
def create_the_hive_alert(source, item_id, tag):
|
||||||
# # TODO: check items status (processed by all modules)
|
# # TODO: check items status (processed by all modules)
|
||||||
# # TODO: add item metadata: decoded content, link to auto crawled content, pgp correlation, cryptocurrency correlation...
|
# # TODO: add item metadata: decoded content, link to auto crawled content, pgp correlation, cryptocurrency correlation...
|
||||||
# # # TODO: description, add AIL link:show items ?
|
# # # TODO: description, add AIL link:show items ?
|
||||||
tags = list( r_serv_metadata.smembers('tag:{}'.format(path)) )
|
tags = list( r_serv_metadata.smembers('tag:{}'.format(item_id)) )
|
||||||
|
|
||||||
artifacts = [
|
artifacts = [
|
||||||
AlertArtifact( dataType='uuid-ail', data=r_serv_db.get('ail:uuid') ),
|
AlertArtifact( dataType='uuid-ail', data=r_serv_db.get('ail:uuid') ),
|
||||||
AlertArtifact( dataType='file', data=path, tags=tags )
|
AlertArtifact( dataType='file', data=item_id, tags=tags )
|
||||||
]
|
]
|
||||||
|
|
||||||
# Prepare the sample Alert
|
# Prepare the sample Alert
|
||||||
|
@ -115,7 +115,7 @@ def feeder(message, count=0):
|
||||||
if HiveApi != False:
|
if HiveApi != False:
|
||||||
if int(r_serv_db.get('hive:auto-alerts')) == 1:
|
if int(r_serv_db.get('hive:auto-alerts')) == 1:
|
||||||
if r_serv_db.sismember('whitelist_hive', tag):
|
if r_serv_db.sismember('whitelist_hive', tag):
|
||||||
create_the_hive_alert(source, path, tag)
|
create_the_hive_alert(source, item_id, tag)
|
||||||
else:
|
else:
|
||||||
print('hive, auto alerts creation disable')
|
print('hive, auto alerts creation disable')
|
||||||
if flag_misp:
|
if flag_misp:
|
||||||
|
|
Loading…
Reference in a new issue