TheHive4py

https://thehive-project.github.io/TheHive4py/
Admin
TheHive4py is a Python API client library for TheHive, enabling secure incident response and case...
Tokens:91,394
Snippets:1,243
Trust Score:9.7
Update:4 months ago
Show doc for...
Tokens:
Raw
### Installation

Source: https://thehive-project.github.io/TheHive4py/latest

Installs the thehive4py library using pip.

```bash
pip install thehive4py

```

--------------------------------

### Quickstart

Source: https://thehive-project.github.io/TheHive4py/latest

Initializes the TheHiveApi client with a URL and API key.

```python
from thehive4py import TheHiveApi

hive = TheHiveApi(url="http://localhost:9000", apikey="h1v3b33")

```

--------------------------------

### Specify Organization During Initialization

Source: https://thehive-project.github.io/TheHive4py/latest/examples/client

Example of instantiating a TheHiveApi client with a specific organization.

```python
from thehive4py import TheHiveApi

client_with_organisation = TheHiveApi(
    url="http://localhost:9000",
    apikey="h1v3b33",
    organisation="admin",
)
```

--------------------------------

### SSL Verification with Custom Certificate

Source: https://thehive-project.github.io/TheHive4py/latest/examples/client

Example of configuring SSL verification with a custom certificate bundle.

```python
from thehive4py import TheHiveApi

hive = TheHiveApi(
    url="http://localhost:9000",
    apikey="h1v3b33",
    verify="/etc/ssl/certs/ca-certificates.crt",
)
```

--------------------------------

### Switch Organizations During Runtime

Source: https://thehive-project.github.io/TheHive4py/latest/examples/client

Example of switching the active organization during runtime using the session_organisation property.

```python
from thehive4py import TheHiveApi

hive = TheHiveApi(
    url="http://localhost:9000",
    apikey="h1v3b33",
)

hive.session_organisation = "other-org"
```

--------------------------------

### Add observables during alert creation

Source: https://thehive-project.github.io/TheHive4py/main/examples/alert

Example of creating an alert with both textual and file-based observables.

```python
import uuid

from thehive4py import TheHiveApi
from thehive4py.types.alert import InputAlert

hive = TheHiveApi(url="thehive.example", apikey="h1v3b33")

input_alert: InputAlert = {
    "type": "alert-with-observables",
    "source": "example",
    "sourceRef": uuid.uuid4().hex,
    "title": "alert with observables",
    "description": "alert with observables",
    "observables": [
        {"dataType": "ip", "data": "1.2.3.4"},
        {"dataType": "domain", "data": "example.com"},
    ],
}

hive.alert.create(alert=input_alert)

```

--------------------------------

### get

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Get a profile by id.

```python
def get(self, profile_id: str) -> OutputProfile:
    """Get a profile by id.

    Args:
        profile_id: The id of the profile.

    Returns:
        The profile specified by the id.
    """
    return self._session.make_request("GET", path=f"/api/v1/profile/{profile_id}")
```

--------------------------------

### StartsWith Filter Expression

Source: https://thehive-project.github.io/TheHive4py/latest/reference/query

Initializes a filter for 'starts with' comparison.

```python
def __init__(self, field: str, value: str):
    super().__init__(_startsWith={"_field": field, "_value": value})
```

--------------------------------

### API Key Authentication

Source: https://thehive-project.github.io/TheHive4py/latest/examples/client

Example of authenticating the TheHive API client using an API key.

```python
from thehive4py import TheHiveApi

hive = TheHiveApi(
    url="http://localhost:9000",
    apikey="h1v3b33",
)
```

--------------------------------

### Username and Password Authentication

Source: https://thehive-project.github.io/TheHive4py/latest/examples/client

Example of authenticating the TheHive API client using username and password.

```python
from thehive4py import TheHiveApi

hive = TheHiveApi(
    url="http://localhost:9000",
    username="analyst@thehive",
    password="h1v3b33",
)
```

--------------------------------

### Add comment to an alert

Source: https://thehive-project.github.io/TheHive4py/main/examples/alert

This example shows how to create an alert and then add a comment to it using the TheHive API.

```python
import uuid

from thehive4py import TheHiveApi

hive = TheHiveApi(url="http://localhost:9000", apikey="h1v3b33")

alert_to_comment = hive.alert.create(
    alert={
        "type": "comment-on-alert",
        "source": "tutorial",
        "sourceRef": uuid.uuid4().hex,
        "title": "alert with a comment",
        "description": "an alert to comment on",
    },
)

hive.comment.create_in_alert(
    alert_id=alert_to_comment["_id"],
    comment={"message": "what an average alert to comment on"},
)


```

--------------------------------

### Add comment to a case

Source: https://thehive-project.github.io/TheHive4py/main/examples/case

An example of creating a case and then adding a simple comment to it using the `comment.create_in_case` method.

```python
from thehive4py import TheHiveApi

hive = TheHiveApi(url="http://localhost:9000", apikey="h1v3b33")

case = hive.case.create(
    case={
        "title": "case with a comment",
        "description": "a case to comment on",
    },
)

hive.comment.create_in_case(
    case_id=case["_id"],
    comment={"message": "what an average case to comment on"},
)
```

--------------------------------

### Custom Retry Mechanism

Source: https://thehive-project.github.io/TheHive4py/latest/examples/client

Example of configuring a custom retry mechanism with specific parameters for TheHiveApi client.

```python
from urllib3 import Retry

from thehive4py import TheHiveApi

simple_retries = Retry(
    total=5,
    backoff_factor=0.5,
    allowed_methods=["GET"],
    status_forcelist=[500],
)

hive = TheHiveApi(
    url="http://localhost:9000",
    apikey="h1v3b33",
    max_retries=simple_retries,
)
```

--------------------------------

### get

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Get a procedure by id.

```python
def get(self, procedure_id: str) -> OutputProcedure:
    """Get a procedure by id.

    Args:
        procedure_id: The id of the procedure.

    Returns:
        The procedure specified by the id.
    """
    # TODO: temp implementation until a dedicated get endpoint
    procedures = self._session.make_request(
        "POST",
        path="/api/v1/query",
        json={"query": [{"_name": "getProcedure", "idOrName": procedure_id}]}
    )
    try:
        return procedures[0]
    except IndexError:
        raise TheHiveError("404 - Procedure not found")
```

--------------------------------

### Create a Simple Alert

Source: https://thehive-project.github.io/TheHive4py/main/examples/alert

Demonstrates how to create the most simplistic alert possible using the alert.create method, specifying only the required fields.

```python
from thehive4py import TheHiveApi

hive = TheHiveApi(url="http://localhost:9000", apikey="h1v3b33")

simple_alert = hive.alert.create(
    alert={
        "type": "simple",
        "source": "tutorial",
        "sourceRef": "should-be-unique",
        "title": "a simple alert",
        "description": "a bit too simple",
    }
)

```

--------------------------------

### Get Current User

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Get the current session's user.

```python
def get_current(self) -> OutputUser:
    """Get the current session's user.

    Returns:
        The current session user.
    """
    return self._session.make_request("GET", path="/api/v1/user/current")

```

--------------------------------

### get

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Get a case by id. This function retrieves a specific case using its ID.

```python
def get(self, case_id: CaseId) -> OutputCase:
    """Get a case by id.

    Args:
        case_id: The id of the case.

    Returns:
        The case specified by the id.
    """
    return self._session.make_request("GET", path=f"/api/v1/case/{case_id}")
```

--------------------------------

### get

Source: https://thehive-project.github.io/TheHive4py/latest/reference/endpoints

Get a task log by its ID. This function takes a task log ID as input and returns the corresponding task log object.

```python
def get(self, task_log_id: str) -> OutputTaskLog:
    """Get a task log by id.

    Args:
        task_log_id: The id of the task log.

    Returns:
        The task log specified by the id.
    """
    # TODO: temp implementation until a dedicated get endpoint [if ever ;)]
    logs = self._session.make_request(
        "POST",
        path="/api/v1/query",
        json={"query": [{"_name": "getLog", "idOrName": task_log_id}]}
    )

    try:
        return logs[0]
    except IndexError:
        raise TheHiveError("404 - Task Log Not Found")
```

--------------------------------

### Add pages during case creation

Source: https://thehive-project.github.io/TheHive4py/main/examples/case

Demonstrates creating a case with initial pages for notes and summary.

```python
from thehive4py import TheHiveApi
from thehive4py.types.page import InputCasePage

hive = TheHiveApi(url="thehive.example", apikey="h1v3b33")


case_pages: list[InputCasePage] = [
    {
        "title": "Notes",
        "category": "default",
        "content": "Some notes to take during case triage.",
    },
    {
        "title": "Summary",
        "category": "default",
        "content": "Some summary to wrap up the case triage.",
    },
]

case_with_tasks = hive.case.create(
    case={
        "title": "case with tasks",
        "description": "a case enriched with tasks",
        "pages": case_pages,
    }
)
```

--------------------------------

### Get Comment by ID

Source: https://thehive-project.github.io/TheHive4py/latest/reference/endpoints

Retrieves a specific comment using its unique identifier. This method is a temporary implementation until a dedicated get endpoint is available.

```python
def get(self, comment_id: str) -> OutputComment:
    """Get a comment by id.

    Args:
        comment_id: The id of the comment.

    Returns:
        The comment specified by the id.
    """
    # TODO: temp implementation until a dedicated get endpoint
    comments = self._session.make_request(
        "POST",
        path="/api/v1/query",
        json={"query": [{"_name": "getComment", "idOrName": comment_id}]}
    )
    try:
        return comments[0]
    except IndexError:
        raise TheHiveError("404 - Comment not found")
```

--------------------------------

### Add file based observables

Source: https://thehive-project.github.io/TheHive4py/main/examples/case

Shows how to create a file-based observable by creating a temporary file and adding it to a case.

```python
import os.path
import tempfile

from thehive4py import TheHiveApi

hive = TheHiveApi(url="http://localhost:9000", apikey="h1v3b33")

case_to_enrich = hive.case.create(
    case={
        "title": "case to enrich",
        "description": "a case to enrich with a file observable",
    }
)

with tempfile.TemporaryDirectory() as tmpdir:
    observable_filepath = os.path.join(tmpdir, "my-observable.txt")
    with open(observable_filepath, "w") as observable_file:
        observable_file.write("some observable content")

    hive.case.create_observable(
        case_id=case_to_enrich["_id"],
        observable={"dataType": "file", "message": "a file based observable"},
        observable_path=observable_filepath,
    )


```

--------------------------------

### Get Observable Type by ID

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Retrieves a specific observable type using its unique identifier. It sends a GET request to the /api/v1/observable/type/{observable_type_id} endpoint.

```python
def get(self, observable_type_id: str) -> OutputObservableType:
    """Get an observable type by id.

    Args:
        observable_type_id: The id of the observable type.

    Returns:
        The observable type specified by the id.
    """
    return self._session.make_request(
        "GET", path=f"/api/v1/observable/type/{observable_type_id}"
    )
```

--------------------------------

### Get Organisation

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Retrieve an organisation by its ID.

```python
def get(self, org_id: str) -> OutputOrganisation:
    """Get an organisation.

    Args:
        org_id: The id of the organisation.

    Returns:
        The organisation specified by the id.
    """
    return self._session.make_request("GET", path=f"/api/v1/organisation/{org_id}")
```

--------------------------------

### Get Timeline

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Retrieves the timeline of a specific case.

```python
def get_timeline(self, case_id: CaseId) -> OutputTimeline:
    """Get the timeline of a case.

    Args:
        case_id: The id of the case with the timeline.

    Returns:
        The case timeline.
    """
    return self._session.make_request("GET", f"/api/v1/case/{case_id}/timeline")
```

--------------------------------

### Minimalistic Case Creation

Source: https://thehive-project.github.io/TheHive4py/main/examples/case

Demonstrates how to create the most minimalistic case possible using the case.create method.

```python
from thehive4py import TheHiveApi

hive = TheHiveApi(url="http://localhost:9000", apikey="h1v3b33")

minimalistic_case = hive.case.create(
    case={
        "title": "a minimalistic case",
        "description": "a bit too minimal",
    }
)

```

--------------------------------

### create

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Create a profile.

```python
def create(self, profile: InputProfile) -> OutputProfile:
    """Create a profile.

    Args:
        profile: The body of the profile.

    Returns:
        The created profile.
    """
    return self._session.make_request("POST", path="/api/v1/profile", json=profile)
```

--------------------------------

### Get Task Log

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Retrieves a task log by its ID.

```python
def get(self, task_log_id: str) -> OutputTaskLog:
    """Get a task log by id.

    Args:
        task_log_id: The id of the task log.

    Returns:
        The task log specified by the id.
    """
    # TODO: temp implementation until a dedicated get endpoint [if ever ;)]
    logs = self._session.make_request(
        "POST",
        path="/api/v1/query",
        json={"query": [{"_name": "getLog", "idOrName": task_log_id}]},
    )

    try:
        return logs[0]
    except IndexError:
        raise TheHiveError("404 - Task Log Not Found")
```

--------------------------------

### Add file based observables

Source: https://thehive-project.github.io/TheHive4py/main/examples/alert

Shows how to create a file-based observable with an attachment for an alert.

```python
import os.path
import tempfile
import uuid

from thehive4py import TheHiveApi
from thehive4py.types.alert import InputAlert

hive = TheHiveApi(url="http://localhost:9000", apikey="h1v3b33")

with tempfile.TemporaryDirectory() as tmpdir:
    observable_filepath = os.path.join(tmpdir, "my-observable.txt")
    with open(observable_filepath, "w") as observable_file:
        observable_file.write("some observable content")

    attachment_key = uuid.uuid4().hex
    attachment_map = {attachment_key: observable_filepath}
    input_alert: InputAlert = {
        "type": "alert-with-file-observable",
        "source": "example",
        "sourceRef": uuid.uuid4().hex,
        "title": "alert with file observables",
        "description": "alert with file observables",
        "observables": [
            {"dataType": "file", "attachment": attachment_key},
        ],
    }

    hive.alert.create(alert=input_alert, attachment_map=attachment_map)


```

--------------------------------

### Get Link Types

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Retrieves all available link types.

```python
def get_link_types(self) -> List[str]:
    """Get all link types.

    Returns:
        The list of all link types.

    """
    return self._session.make_request("GET", "/api/v1/case/link/types")
```

--------------------------------

### Promote an alert to a case

Source: https://thehive-project.github.io/TheHive4py/main/examples/alert

Illustrates how to create a new case from an existing alert using the promote_to_case method.

```python
import uuid

from thehive4py import TheHiveApi

hive = TheHiveApi(url="http://localhost:9000", apikey="h1v3b33")

alert_to_promote = hive.alert.create(
    alert={
        "type": "promote",
        "source": "tutorial",
        "sourceRef": uuid.uuid4().hex,
        "title": "promote to case",
        "description": "an alert to promote to case",
    }
)

case_from_alert = hive.alert.promote_to_case(alert_id=alert_to_promote["_id"])

```

--------------------------------

### get(task_id)

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Get a task by id. Parameters: Name | Type | Description | Default  ---|---|---|---  `task_id` |  `str` |  The id of the task. |  _required_  Returns: Type | Description  ---|---  `OutputTask` |  The task specified by the id.  

```python
def get(self, task_id: str) -> OutputTask:
    """Get a task by id.

    Args:
        task_id: The id of the task.

    Returns:
        The task specified by the id.
    """
    return self._session.make_request("GET", path=f"/api/v1/task/{task_id}")
```

--------------------------------

### Add observables to an existing alert

Source: https://thehive-project.github.io/TheHive4py/main/examples/alert

Demonstrates creating observables for an alert that has already been created. It shows how to add single, bulk, and mixed-type observables.

```python
import uuid

from thehive4py import TheHiveApi
from thehive4py.types.observable import InputObservable

hive = TheHiveApi(url="thehive.example", apikey="h1v3b33")

alert_to_enrich = hive.alert.create(
    alert={
        "type": "alert-without-observables",
        "source": "example",
        "sourceRef": uuid.uuid4().hex,
        "title": "alert without observables",
        "description": "alert without observables",
    }
)

simple_observable: InputObservable = {
    "dataType": "domain",
    "data": "example.com",
}
hive.alert.create_observable(
    alert_id=alert_to_enrich["_id"],
    observable=simple_observable,
)


bulk_observable: InputObservable = {
    "dataType": "domain",
    "data": ["1.example.com", "2.example.com"],
}
hive.alert.create_observable(
    alert_id=alert_to_enrich["_id"],
    observable=bulk_observable,
)


mixed_observables: list[InputObservable] = [
    {"dataType": "ip", "data": "1.2.3.4"},
    {"dataType": "domain", "data": "example.com"},
]
for observable in mixed_observables:
    hive.alert.create_observable(
        alert_id=alert_to_enrich["_id"],
        observable=observable,
    )

```

--------------------------------

### Get an observable by id

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Retrieves an observable using its unique identifier.

```python
def get(self, observable_id: str) -> OutputObservable:
    """Get an observable by id.

    Args:
        observable_id: The id of the observable.

    Returns:
        The observable specified by the id.
    """
    return self._session.make_request(
        "GET", path=f"/api/v1/observable/{observable_id}"
    )
```

--------------------------------

### TheHiveApi Client Initialization

Source: https://thehive-project.github.io/TheHive4py/latest/reference/client

Initializes the TheHiveApi client with various authentication and configuration options.

```python
def __init__(
    self,
    url: str,
    apikey: Optional[str] = None,
    username: Optional[str] = None,
    password: Optional[str] = None,
    organisation: Optional[str] = None,
    verify: VerifyValue = True,
    max_retries: RetryValue = DEFAULT_RETRY,
):
    """Create a client of TheHive API.

    Parameters:
        url: TheHive's url.
        apikey: TheHive's apikey. It's required if `username` and `password`
            is not provided.
        username: TheHive's username. It's required if `apikey` is not provided.
            Must be specified together with `password`.
        password: TheHive's password. It's required if `apikey` is not provided.
            Must be specified together with `username`.
        organisation: TheHive organisation to use in the session.
        verify: Either a boolean, in which case it controls whether we verify
            the server's TLS certificate, or a string, in which case it must be a
            path to a CA bundle to use.
        max_retries: Either `None`, in which case we do not retry failed requests,
            or a `Retry` object.

    """
    self.session = TheHiveSession(
        url=url,
        apikey=apikey,
        username=username,
        password=password,
        verify=verify,
        max_retries=max_retries,
    )
    self.session_organisation = organisation

    # case management endpoints
    self.alert = AlertEndpoint(self.session)
    self.case = CaseEndpoint(self.session)
    self.case_template = CaseTemplateEndpoint(self.session)
    self.comment = CommentEndpoint(self.session)
    self.observable = ObservableEndpoint(self.session)
    self.page_template = PageTemplateEndpoint(self.session)
    self.procedure = ProcedureEndpoint(self.session)
    self.task = TaskEndpoint(self.session)
    self.task_log = TaskLogEndpoint(self.session)
    self.timeline = TimelineEndpoint(self.session)

    # user management endpoints
    self.user = UserEndpoint(self.session)
    self.organisation = OrganisationEndpoint(self.session)
    self.profile = ProfileEndpoint(self.session)

    # entity endpoints
    self.custom_field = CustomFieldEndpoint(self.session)
    self.observable_type = ObservableTypeEndpoint(self.session)

    # connector endpoints
    self.cortex = CortexEndpoint(self.session)
    self.misp = MISPEndpoint(self.session)

    # standard endpoints
    self.query = QueryEndpoint(self.session)

```

--------------------------------

### Get Linked Cases

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Retrieves other cases that are linked to a specific case.

```python
def get_linked_cases(self, case_id: CaseId) -> List[OutputCaseLink]:
    """Get other cases linked to a case.

    Args:
        case_id: The id of the case to get linked cases for.

    Returns:
        The list of linked cases.
    """
    return self._session.make_request("GET", path=f"/api/v1/case/{case_id}/links")
```

--------------------------------

### create

Source: https://thehive-project.github.io/TheHive4py/latest/reference/endpoints

Create a task log, optionally with attachments.

```python
def create(
    self,
    task_id: str,
    task_log: InputTaskLog,
) -> OutputTaskLog:
    """Create a task log.

    Args:
        task_id: The id of the task to create the log in.
        task_log: The body of the task log.

    Returns:
        The created task_log.
    """
    if "attachments" in task_log:
        files: List[tuple] = [
            ("attachments", self._fileinfo_from_filepath(attachment_path))
            for attachment_path in task_log["attachments"]
        ]
        files.append(("_json", jsonlib.dumps(task_log)))
        kwargs: dict = {"files": files}
    else:
        kwargs = {"json": task_log}
    return self._session.make_request(
        "POST", path=f"/api/v1/task/{task_id}/log", **kwargs
    )
```

--------------------------------

### Add observables to an existing case

Source: https://thehive-project.github.io/TheHive4py/main/examples/case

Demonstrates creating a case and then adding simple, bulk, and mixed observables to it using the `create_observable` method.

```python
from thehive4py import TheHiveApi
from thehive4py.types.observable import InputObservable

hive = TheHiveApi(url="thehive.example", apikey="h1v3b33")


case_to_enrich = hive.case.create(
    case={
        "title": "case to enrich",
        "description": "a case to enrich with simple observables",
    }
)


simple_observable: InputObservable = {
    "dataType": "domain",
    "data": "example.com",
}

hive.case.create_observable(
    case_id=case_to_enrich["_id"],
    observable=simple_observable,
)


bulk_observable: InputObservable = {
    "dataType": "domain",
    "data": ["1.example.com", "2.example.com"],
}

hive.case.create_observable(
    case_id=case_to_enrich["_id"],
    observable=bulk_observable,
)

mixed_observables: list[InputObservable] = [
    {"dataType": "ip", "data": "1.2.3.4"},
    {"dataType": "domain", "data": "example.com"},
]


for observable in mixed_observables:
    hive.case.create_observable(
        case_id=case_to_enrich["_id"],
        observable=observable,
    )

```

--------------------------------

### Get Case Template by ID

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Retrieves a case template using its ID.

```python
def get(self, case_template_id: str) -> OutputCaseTemplate:
    """Get a case template by id.

    Args:
        case_template_id: The id of the case template.

    Returns:
        The case template specified by the id.
    """
    return self._session.make_request(
        "GET", path=f"/api/v1/caseTemplate/{case_template_id}"
    )
```

--------------------------------

### Get Page Template by ID

Source: https://thehive-project.github.io/TheHive4py/latest/reference/endpoints

Retrieves a specific page template by its ID.

```python
def get(self, page_template_id: str) -> OutputPageTemplate:
    """Get a page template by id.

    Args:
        page_template_id: The id of the page template.

    Returns:
        The page template specified by the id.
    """
    # TODO: temp implementation until a dedicated get endpoint [if ever ;)]
    page_templates = self._session.make_request(
        "POST",
        path="/api/v1/query",
        json={
            "query": [{"_name": "getPageTemplate", "idOrName": page_template_id}]
        },
    )

    if not page_templates:
        raise TheHiveError("404 - Page Template Not Found")

    return page_templates[0]
```

--------------------------------

### Create User

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Create a user.

```python
def create(self, user: InputUser) -> OutputUser:
    """Create a user.

    Args:
        user: The body of the user.

    Returns:
        The created user.
    """
    return self._session.make_request("POST", path="/api/v1/user", json=user)

```

--------------------------------

### Get Alert by ID

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Retrieves a specific alert using its unique identifier.

```python
def get(self, alert_id: str) -> OutputAlert:
    """Get an alert by id.

    Args:
        alert_id: The id of the alert.

    Returns:
        The alert specified by the id.
    """

    return self._session.make_request("GET", path=f"/api/v1/alert/{alert_id}")
```

--------------------------------

### Get a single alert

Source: https://thehive-project.github.io/TheHive4py/main/examples/alert

Demonstrates how to retrieve a single alert using its ID after creating it.

```python
import uuid

from thehive4py import TheHiveApi

hive = TheHiveApi(url="http://localhost:9000", apikey="h1v3b33")

alert_to_get = hive.alert.create(
    alert={
        "type": "get-single",
        "source": "tutorial",
        "sourceRef": uuid.uuid4().hex,
        "title": "alert to get",
        "description": "a single alert to fetch",
    }
)



fetched_alert = hive.alert.get(alert_id=alert_to_get["_id"])

```

--------------------------------

### Add tasks during case creation

Source: https://thehive-project.github.io/TheHive4py/main/examples/case

Demonstrates creating a case with predefined tasks using the `tasks` parameter during case creation.

```python
from thehive4py import TheHiveApi
from thehive4py.types.task import InputTask

hive = TheHiveApi(url="thehive.example", apikey="h1v3b33")


case_tasks: list[InputTask] = [
    {"title": "Triage", "description": "Conduct the initial investigation"},
    {"title": "Respond", "description": "Execute the required actions"},
]

case_with_tasks = hive.case.create(
    case={
        "title": "case with tasks",
        "description": "a case enriched with tasks",
        "tasks": case_tasks,
    }
)


```

--------------------------------

### create(case_id, task)

Source: https://thehive-project.github.io/TheHive4py/main/reference/endpoints

Create a task. Parameters: Name | Type | Description | Default  ---|---|---|---  `case_id` |  `str` |  The id of the case to create the task for. |  _required_  `task` |  `InputTask` |  The body of the task. |  _required_  Returns: Type | Description  ---|---  `OutputTask` |  The created task.  

```python
def create(self, case_id: str, task: InputTask) -> OutputTask:
    """Create a task.

    Args:
        case_id: The id of the case to create the task for.
        task: The body of the task.

    Returns:
        The created task.
    """
    return self._session.make_request(
        "POST", path=f"/api/v1/case/{case_id}/task", json=task
    )
```
Tokens:
Raw