Passing arbitrary data from TheHive to analyzer

[janwychowaniak]

Request Type

Feature Request

Hello.
What I seek to accomplish is to find a way to pass arbitrary JSON-formatted information via TheHive API, so that it will later end up in a job report from a custom Cortex analyzer I wrote.
I have stumbled upon some description of a possibility to allow arbitrary parameters for a Cortex job (TheHive-Project/Cortex#86), but that's with using the Cortex API, I guess.
Kind regards.

[b00lpy]

I don't really know what's you final usage of this feature, but probably it's easiest if you write a responder which simply extracts the CASE attribute _id, and starting from this you can pull out via API every information you want that's related with the case from whom you executed the responder.

Hope this helps in the meantime :)

[janwychowaniak]

Ok, thank you very much for the suggestion. I will do some research towards this way. BR.