Skip to content

Write a FilteredEvent Trigger#

manageConfig

Write a FilteredEvent trigger in TheHive to send notifications based on custom event filters.

For a list of available operators, see FilteredEvent Trigger Operators.

Procedure

  1. Go to the Organization view from the sidebar menu.

    Organization view

  2. Select the Notifications tab.

    Notifications tab

  3. Select .

  4. Select the FilteredEvent trigger.

    Selecting FilteredEvent opens a field where you can define a custom filter. These filters apply to all actions recorded in the organization's audit logs. When an action matches the filter criteria, a notification is triggered.

  5. Write your filter.

    Operators

    For a complete list of available operators, see FilteredEvent Trigger Operators.

    To access a specific field within a JSON object, use dot (.) notation to navigate through nested properties.

    For example object.severity retrieves the severityfield from the following JSON structure:

    {
"object": {
    "severity": 3
}
}

    Tag and custom field changes

    5.5.9 Starting with TheHive 5.5.9, audit logs now record updates to tags and custom fields.

  6. Select the relevant notifiers to configure them:

Examples#

Operators

For a complete list of available operators, see FilteredEvent Trigger Operators.

Case severity updated to High or Critical#

{
    "_and": [
        {
            "_is": {
                "action": "update"
            }
        },
        {
            "_is": {
                "objectType": "Case"
            }
        },
        {
            "_gte": {
                "details.severity": 3
            }
        }
    ]
}

Alert closed without an assignee#

{
    "_and": [
        {
            "_is": {
                "objectType": "Alert"
            }
        },
        {
            "_is": {
                "details.stage": "Closed"
            }
        },
        {
            "_not": {
                "_has": "object.assignee"
            }
        },
        {
            "_not": {
                "_has": "details.assignee"
            }
        }
    ]
}

Observable updated with a report from analyzer Crt_sh_Transparency_Logs_1_0#

{
    "_and": [
        {
            "_is": {
                "action": "update"
            }
        },
        {
            "_is": {
                "objectType": "Observable"
            }
        },
        {
            "_has": "details.reports.Crt_sh_Transparency_Logs_1_0"
        }
    ]
}

Responder action finished#

{
    "_and": [
        {
            "_is": {
                "action": "update"
            }
        },
        {
            "_is": {
                "objectType": "Action"
            }
        },
        {
            "_or": [
                {
                    "_is": {
                        "details.status": "Success"
                    }
                },
                {
                    "_is": {
                        "details.status": "Failure"
                    }
                }
            ]
        }
    ]
}

Case status updated to TruePositive or FalsePositive, with the custom field business-unit set to Sales or Marketing#

{
    "_and": [
        {
            "_is": {
                "action": "update"
            }
        },
        {
            "_is": {
                "objectType": "Case"
            }
        },
        {
            "_or": [
                {
                    "_is": {
                        "details.status": "TruePositive"
                    }
                },
                {
                    "_is": {
                        "details.status": "FalsePositive"
                    }
                }
            ]
        },
        {
            "_or": [
                {
                    "_is": {
                        "object.customFieldValues.business-unit": "Sales"
                    }
                },
                {
                    "_is": {
                        "object.customFieldValues.business-unit": "Marketing"
                    }
                }
            ]
        }
    ]
}

Custom field business-unit updated to Engineering#

5.5.9

{
    "_arrayMatch": {
        "_field": "details.customFieldChanges",
        "_filter": {
            "_and": [
                {
                    "_eq": {
                        "operation": "valuesAdded"
                    }
                },
                {
                    "_eq": {
                        "name": "business-unit"
                    }
                },
                {
                    "_eq": {
                        "values": "Engineering"
                    }
                }
            ]
        }
    }
}

Analyzer EmlParser_2_1 completed successfully#

{
    "_and": [
        {
            "_is": {
                "objectType": "Job"
            }
        },
        {
            "_is": {
                "object.analyzerName": "EmlParser_2_1"
            }
        },
        {
            "_is": {
                "object.status": "Success"
            }
        }
    ]
}

Next steps