Create case by parameters.

Basic Parameters

ParameterDescription
AssigneeUser to assign the case to.
DescriptionDescription of the case, supports markdown.
StatusThe status of the resource.
TitleA short, descriptive title for the resource.

Advanced Parameters

ParameterDescription
Custom FieldsCustom fields as an array of objects.For more information about the Custom Fields parameter, visit TheHive API documentation.
End Date-
FlagSet to true to visually flag the resource in the user interface for attention.
Observable Rule-
PAPPrioritized Asset Profile, the severity level that is used to indicate the importance of an asset.White: The asset is not critical.Green: The asset is important, but not critical.Amber: The asset is critical.Red: The asset is essential.
SeverityThe severity level of the resource.
Start Date-
SummaryA brief summary of the resource.
TLPTraffic Light Protocol, a set of designations used to ensure that sensitive information is shared with the appropriate audience.CLEAR: unlimited formerly.GREEN: community-wide.AMBER: limited distribution.AMBER+STRICT: restricts sharing to the organization only.RED: personal for named recipients only.
TagsAn array of keywords (tags) as strings to categorize the resource.
Task Rule-

Example Output

{
	"_createdAt": 1640000000000,
	"_createdBy": "string",
	"_id": "string",
	"_type": "string",
	"_updatedAt": 1640000000000,
	"_updatedBy": "string",
	"alertDate": 1640000000000,
	"alertImportedDate": 1640000000000,
	"alertInProgressDate": 1640000000000,
	"alertNewDate": 1640000000000,
	"assignee": "string",
	"closedDate": 1640000000000,
	"customFields": [
		{
			"_id": "string",
			"name": "string",
			"order": 0,
			"type": "string",
			"value": ""
		}
	],
	"description": "string",
	"endDate": 1640000000000,
	"extraData": {},
	"flag": false,
	"handlingDuration": 0,
	"impactStatus": "string",
	"inProgressDate": 1640000000000,
	"newDate": 1640000000000,
	"number": 0,
	"pap": 0,
	"papLabel": "string",
	"severity": 0,
	"severityLabel": "string",
	"stage": "The value of the stage depends on the status of the case. Can be one of 'New' 'InProgress' or 'Closed'",
	"startDate": 1640000000000,
	"status": "string",
	"summary": "string",
	"tags": [
		"string"
	],
	"timeToAcknowledge": 0,
	"timeToDetect": 0,
	"timeToQualify": 0,
	"timeToResolve": 0,
	"timeToTriage": 0,
	"title": "string",
	"tlp": 0,
	"tlpLabel": "string",
	"userPermissions": [
		"string"
	]
}

Workflow Library Example

Create Case with Thehive and Send Results Via Email

Preview this Workflow on desktop