#11 WIP add docs for case responders operations

TheHive-Project · Sep 21, 2021 · b497829 · b497829
1 parent 3454786
commit b497829
Show file tree

Hide file tree

Showing 2 changed files with 179 additions and 0 deletions.
diff --git a/docs/thehive/api/case/responder-jobs.md b/docs/thehive/api/case/responder-jobs.md
@@ -0,0 +1,102 @@
+# List responder actions
+
+List actions run on a *Case*.
+
+## Query
+
+```plain
+GET /api/connector/cortex/action/case/{id}
+```
+
+With:
+
+- `id`: *Case* identifier
+
+##  Response 
+
+### Status codes
+
+- `200`: if query is run successfully
+- `401`: Authentication error
+
+### Response Body Example
+
+!!! Example ""
+
+    === "200" 
+
+        ```json
+          [
+            {
+              "responderId": "25dcbbb69d50dd5a5ae4bd55f4ca5903",
+              "responderName": "reponderName_1_0",
+              "responderDefinition": "reponderName_1_0",
+              "cortexId": "local-cortex",
+              "cortexJobId": "408-unsB3SwW9-eEPXXW",
+              "objectType": "Case",
+              "objectId": "~25313328",
+              "status": "Success",
+              "startDate": 1630917246993,
+              "endDate": 1630917254406,
+              "operations": "[]",
+              "report": "{\"summary\":{\"taxonomies\":[]},\"full\":null,\"success\":true,\"artifacts\":[],\"operations\":[],\\\"message\\\":\\\"Ok\\\",\\\"parameters\\\":{\\\"organisation\\\":\\\"StrangeBee\\\",\\\"user\\\":\\\"[email protected]\\\"},\\\"config\\\":{\\\"proxy_https\\\":null,\\\"cacerts\\\":null,\\\"check_tlp\\\":false,\\\"max_tlp\\\":2,\\\"check_pap\\\":false,\\\"max_pap\\\":2,\\\"jobTimeout\\\":30,\\\"proxy_http\\\":null}}\"}"
+            }
+          ]
+        ```
+
+    === "401" 
+
+        ```json
+        {
+          "type": "AuthenticationError",
+          "message": "Authentication failure"
+        }
+        ```
+
+## List available Responders
+
+### Request
+
+To get the list of Responders available for a *Case*, based on its TLP and PAP, you can call the following API:
+
+```plain
+GET /api/connector/cortex/responder/case/{id}
+```
+
+With:
+
+- `id`: *Case* identifier
+
+### Response
+
+!!! Example ""
+
+    === "200" 
+
+        ```json
+        [
+            {
+                "id": "e33d63082066c739c07d2bbc199bfe7e",
+                "name": "MALSPAM_Reply_to_user_1_0",
+                "version": "1.0",
+                "description": "Reply to user with an email. Applies on tasks",
+                "dataTypeList": [
+                    "thehive:case",
+                    "thehive:case_task",
+                    "thehive:case_task_log"
+                ],
+                "cortexIds": [
+                    "Demo"
+                ]
+            }
+        ]
+        ```
+
+    === "401" 
+
+        ```json
+        {
+          "type": "AuthenticationError",
+          "message": "Authentication failure"
+        }
+        ```
diff --git a/docs/thehive/api/case/run-responder.md b/docs/thehive/api/case/run-responder.md
@@ -0,0 +1,77 @@
+# Run responder
+
+Run a responder on a *Case* (requires `manageAction` permission).
+
+## Query
+
+```plain
+POST /api/connector/cortex/action
+```
+
+##  Request Body Example
+
+!!! Example ""
+
+    ```json
+    {
+      "responderId": "25dcbbb69d50dd5a5ae4bd55f4ca5903",
+      "cortexId": "local-cortex",
+      "objectType": "case",
+      "objectId": "{id}"
+    }
+    ```
+
+With:
+
+- `id`: *Case* identifier
+
+The required fields are `responderId`, `objectType` and `objectId`.
+
+##  Response 
+
+### Status codes
+
+- `201`: if responder is started successfully
+- `401`: Authentication error
+- `403`: Authorization error
+- `404`: Case is not found
+
+### Response Body Example
+
+!!! Example ""
+
+    === "201" 
+
+        ```json
+          {
+            "responderId": "25dcbbb69d50dd5a5ae4bd55f4ca5903",
+            "responderName": "reponderName_1_0",
+            "responderDefinition": "reponderName_1_0",
+            "cortexId": "local-cortex",
+            "cortexJobId": "408-unsB3SwW9-eEPXXW",
+            "objectType": "Case",
+            "objectId": "~25313328",
+            "status": "Waiting",
+            "startDate": 1630917246993,
+            "operations": "[]",
+            "report": "{}"
+          }
+        ```
+
+    === "401" 
+
+        ```json
+        {
+          "type": "AuthenticationError",
+          "message": "Authentication failure"
+        }
+        ```
+
+    === "404" 
+
+        ```json
+        {
+          "type": "AuthenticationError",
+          "message": "Task not found"
+        }
+        ```