Download an attachment from an observable

[mike1796]

Add a method to download an attachment from the observableendpoint class and be able to retrieve a file from an observable's id. The download can also be done with a zip and the parameter as_zip.

[Kamforka]

Thanks for the review, gonna review tomorrow!

[Kamforka]

Could you please rebase it to the latest develop branch to kick in the ci pipeline?

[mike1796]

Could you please rebase it to the latest develop branch to kick in the ci pipeline?

Just rebase to the latest develop branch and fix mistakes and double commit that was there just before

[Kamforka]

Could you please rebase it to the latest develop branch to kick in the ci pipeline?

Just rebase to the latest develop branch and fix mistakes and double commit that was there just before

The rebase seems to be good, can you please fix the ci check issues, then we can merge the change.

[mike1796]

Both lint issues have been fixed in the last commit.

[Kamforka]

Both lint issues have been fixed in the last commit.

Hey Mike,
I can still see some issues, please verify locally:

flake8 thehive4py/ tests/
black --diff thehive4py/ tests/

[Kamforka]

I still have an issue when I set as_zip=False I get back a 500 internal server error which seems like a bug.
Although the endpoint works fine with as_zip=True so I'd suggest to hardcode the params={"asZip": True} query and remove the as_zip argument from the method as a temporary quickfix.

Also please add the above observation as an explanation comment in the method's body.

[mike1796]

I still have an issue when I set as_zip=False I get back a 500 internal server error which seems like a bug. Although the endpoint works fine with as_zip=True so I'd suggest to hardcode the params={"asZip": True} query and remove the as_zip argument from the method as a temporary quickfix.

Also please add the above observation as an explanation comment in the method's body.

Can you give me your version number of theHive and some of your test ?
For me it works perfectly fine in theHive 5.0.18, I just retried it and don't get any 500 errors.
I also tried on a jpg file.

My test look like this :

thehive = TheHiveApi(thehive_url, api_key)
fetched_observable = thehive.observable.get(observable_id="~44499104")
thehive.observable.download_attachment("~44499104", fetched_observable.get("attachment").get("_id"), "test.jpg", True)

Or

thehive = TheHiveApi(thehive_url, api_key)
fetched_observable = thehive.observable.get(observable_id="~44499104")
thehive.observable.download_attachment("~44499104", fetched_observable.get("attachment").get("_id"), "test.jpg", False)

[Kamforka]

I still have an issue when I set as_zip=False I get back a 500 internal server error which seems like a bug. Although the endpoint works fine with as_zip=True so I'd suggest to hardcode the params={"asZip": True} query and remove the as_zip argument from the method as a temporary quickfix.
Also please add the above observation as an explanation comment in the method's body.

Can you give me your version number of theHive and some of your test ? For me it works perfectly fine in theHive 5.0.18, I just retried it and don't get any 500 errors. I also tried on a jpg file.

My test look like this :

thehive = TheHiveApi(thehive_url, api_key)
fetched_observable = thehive.observable.get(observable_id="~44499104")
thehive.observable.download_attachment("~44499104", fetched_observable.get("attachment").get("_id"), "test.jpg", True)

Or

thehive = TheHiveApi(thehive_url, api_key)
fetched_observable = thehive.observable.get(observable_id="~44499104")
thehive.observable.download_attachment("~44499104", fetched_observable.get("attachment").get("_id"), "test.jpg", False)

I tried it on 5.0.23, maybe it's a bug in the newer versions then. I raised an issue with the core dev team, let's wait for them while they verify and fix.