How to Revoke a Function#

5.1 Platinum

This topic provides step-by-step instructions for revoking a function in TheHive.

Required permissions

Only users with the manageFunction/create permission can create a function in TheHive.
Only users with the manageFunction/invoke permission can invoke a function in TheHive.
Only users with the manageAction permission can run a function in TheHive.

Procedure

Go to the Organization view from the sidebar menu.
Select the Functions tab.
Select the function you want to revoke, or select and then Edit.
Select the How to call the function section.
Copy the cURL or Python command example to use in your HTTP call.

curl -X POST -H 'Authorization: Bearer $API_KEY' https://<thehive_url>/api/v1/function/<function_name> -H 'Content-Type: application/json' --data '
{
    "eventId": "d9ec98b1-410f-40eb-8634-cfe189749da6",
    "date": "2021-06-05T12:45:36.698Z",
    "title": "An intrusion was detected",
    "details": "An intrusion was detected on the server 10.10.43.2",
    "data": [
        {"kind": "ip", "value": "10.10.43.2", "name": "server-ip" },
        {"kind": "name", "value": "root", "name": "login" },
        {"kind": "ip", "value": "92.43.123.1", "name": "origin" }
    ]
}
'

TheHive processes your input (the body of the HTTP call) using the function definition and executes the function accordingly. It then responds to the HTTP call with the data returned by the function.

Next steps

Create a Function