There will be a new version of Elastalert to be able to integrate new versions of Thehive 5 after the vendor deactivate API v0, maybe in v. 5.6.0??

[b4lh4ck]

Hello everyone

I have one question

There will be a new version of Elastalert to be able to integrate new versions of Thehive 5 after the vendor deactivate API v0, maybe in v. 5.6.0??

[nsano-rururu]

@b4lh4ck
I've never used theHive, so I can't provide a solution, but I think if we don't organize information on what needs to be done, no one will be able to fix it, so I'd like to ask a question.

1. Has theHive 5.6.0 been released yet? Or will it be released soon?
2. Do you know what changes need to be made to the source code for theHive currently compatible with elastalert2? Is there a URL for information on breaking changes in theHive 5.6.0?
3. I don't use TheHive4py with elastalert2, but should I use it?

[nsano-rururu]

The latest version of theHive appears to be 5.5.7. 5.6.0 is planned for release.
https://docs.strangebee.com/thehive/release-notes/release-notes-5.5/

[nsano-rururu]

@b4lh4ck

https://github.com/jertel/elastalert2/blob/master/elastalert/alerters/thehive.py#L154

current

 req = f'{hive_host}:{hive_port}/api/alert'

Added hive_api_version setting. The default value is v0. If v0 is used, it will be the previous api/alert. If v1 is set, it will be changed to api/v1/alert for TheHive 5.6.0 or later.

after

yaml

Setting image. Only a part of it is shown.

hive_connection:
  hive_host: "http://thehive.example.com"
  hive_port: 9000
  hive_apikey: "xxxxxxxx"
  hive_api_version: "v1" 

self.hive_api_version =connection_details.get('hive_api_version', 'v0')
if self.hive_api_version == 'v0':
    # API v0 routes
    req = f'{hive_host}:{hive_port}/api/alert'
else:
    # API v1 routes
    req = f'{hive_host}:{hive_port}/api/v1/alert'