Skip to content

Instantly share code, notes, and snippets.

@ag-michael
Created May 20, 2019 15:30
Show Gist options
  • Save ag-michael/532f94df98a761b95c167b0652ccc88c to your computer and use it in GitHub Desktop.
Save ag-michael/532f94df98a761b95c167b0652ccc88c to your computer and use it in GitHub Desktop.
TheHive alert aging
#!/bin/env python2
import requests
import json
import time
import logging
logging.basicConfig(format='ThehiveAPI: %(asctime)-15s %(message)s')
LOG = logging.getLogger('thehiveapi-alert-aging')
LOG.setLevel(logging.DEBUG)
alert_age=86400
sleep_for=3600
while True:
try:
creds={}
with open("/etc/thehive/thehiveapi.json") as f:
creds=json.loads(f.read())
LOG.info("Fetching thehive alerts")
alerts=json.loads(requests.get(creds['server']+"/api/alert?range=0-100",headers={"Authorization":"Bearer "+creds['apikey']}).text )
ts=time.time()
if alerts:
LOG.info("Found "+str(len(alerts))+" Alerts")
for alert in alerts:
if 'createdAt' in alert:
if int(alert['createdAt'])/1000 < (ts- alert_age):
response=requests.delete(creds['server']+"/api/alert/"+alert['id'],headers={"Authorization":"Bearer "+creds['apikey']})
if response.status_code == 204:
LOG.info("Removed alert because it's too old:"+alert['title'])
else:
LOG.error("Error removing aged alert:"+alert['title'])
LOG.error(response.text)
LOG.info("Alert ageout went well, sleeping for "+str(sleep_for)+" Seconds")
alerts=None
time.sleep(sleep_for)
except Exception as e:
LOG.exception(e)
break
time.sleep(4)
continue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment