Trigger WebHook only for specific events

[laurentdelosieresmano]

Hello TheHive community,

In the webhook section, it is mentioned how to set up a webhook. By default, the webhook is triggered for any events "AnyEvent". I am wondering if we can narrow down this trigger (e.g. only when a new case is created or updated / task is created or updated)

curl -XPUT -u$thehive_user:$thehive_password -H 'Content-type: application/json' $thehive_url/api/config/organisation/notification -d '
{
  "value": [
    {
      "delegate": false,
      "trigger": { "name": "AnyEvent"},
      "notifier": { "name": "webhook", "endpoint": "local" }
    }
  ]
}'

Thank you.

[To-om]

You can try something like:

"value": [
    {
      "delegate": false,
      "trigger": {
        "name": "FilteredEvent", 
        "filter": {
          "_and": [
            { "_is": { "objectType": "case" } },
            { "_is": { "operation": "Creation" } }
          ]
        }
      },
      "notifier": { "name": "webhook", "endpoint": "local" }
    }
  ]

This is not yet documented and the format is subject to change.

[laurentdelosieresmano]

Thank you ;)

[laurentdelosieresmano]

Do you know if we can set this up in a configuration file ?

[To-om]

You cannot configure webhook for an organisation in the file application.conf. But you can set the default value for all organisations:

organisation {
  defaults {
    notification: [
      {
        "delegate": false,
        "trigger": {
          "name": "FilteredEvent", 
          "filter": {
            "_and": [
              { "_is": { "objectType": "case" } },
              { "_is": { "operation": "Creation" } }
            ]
          }
        },
        "notifier": { "name": "webhook", "endpoint": "local" }
      }
    ]
  }
}

[hariomch]

Hey, I want to trigger webhook only when a case is created. I ran the below command with org-admin user which isn't working.

curl -XPUT -u "USERNAME:PASS" -H 'Content-type: application/json' "HIVE_URL/api/config/organisation/notification" -d '
{
    "value": [
        {
        "delegate": false,
        "trigger": {
            "name": "FilteredEvent",
            "filter": {
            "_and": [
                { "_is": { "objectType": "case" } },
                { "_is": { "operation": "create" } }
            ]
            }
        },
        "notifier": { "name": "webhook", "endpoint": "local" }
        }
    ]
}'

I have already declared the webhook in application.conf file
Can you tell me if the format is changed or is there any other way to achieve this?

[To-om]

Can you enable logging (set org.thp.thehive.services.notification to DEBUG) ?

This can be done by updating /etc/thehive/logback.xml and restart or with the command curl -u "USERNAME:PASS" "HIVE_URL/api/v1/admin/log/set/org.thp.thehive.services.notification/DEBUG. Then have a look on logs.