Variable Usage Examples#

TheHive variables use Mustache syntax, extended with Handlebars helpers.

Below are examples of variable usage when configuring notifications in TheHive.

Examples#

EmailertoAddr notifier#

Subject

Case #{{object.number}} severity reached {{object.severity}}

From

thehive@strangebee.com

To

{{user.email}}

Template

Hello,

The following case severity reached {{object.severity}}.

Case details:
Number: {{object.number}}
Title: {{object.title}}
Owner: {{object.assignee}}
Description: {{object.description}}

You can review the case by clicking the following URL:
{{url}}

Regards,

TheHive Notification System

Helpers#

Helpers using Handlebars

Data transformation helpers#

Helper	Description	Usage	Output
`tlpLabel`	Format the `tlp` field of the object	`{{tlpLabel object.tlp}}`	`Amber`
`papLabel`	Format the `pap` field of the object	`{{papLabel object.pap}}`	`Amber`
`severityLabel`	Format the `severity` field of the object	`{{severityLabel object.severity}}`	`Critical`
`dateFormat`	Format a date field of the object using Java date time patterns	`{{dateFormat audit._createdAt "EEEEE dd MMMMM yyyy" "fr"}}`	`jeudi 01 septembre 2022`

Standard string helpers can be found in the official Handlebars documentation.

Conditional helpers#

Examples:

Displays Medium if case.severity equals 2, otherwise displays Other:

{{#if (eq case.severity 2)}}
    Medium
{{else}}
    Other 
{{/if}}

Displays the threat actor value only if case.customFieldValues.threat-actor is defined:

{{#if case.customFieldValues.threat-actor}}
    Threat Actor: {{case.customFieldValues.threat-actor}}
{{/if}}

Find additional supported operators in the official Handlebars documentation.