Does TheHive plugin supports URL syntax?

Sergey · July 9, 2024, 7:31pm

I am trying to setup a connection from Insight Connect Orchestrator to TheHive and cannot find a setting to specify TheHive API full URL. Our Hive instance is hosted in the cloud and API is not located at the root of host/domain.

Instead of https://thehive.company.com:9000 I would like to specify API URL as following

https://thehive.company.com:9000/companyinstanceid/thehive/

Host parameter doesnt accept URL or relative API location.

{
  "api_key": "9de5069c5afe602b2ea0a04b66beb2c0",
  "credentials": {},
  "host": "thehive.company.com",
  "port": 9000,
  "protocol": "http",
  "proxy": {},
  "verify": true
}

Sergey · July 19, 2024, 12:27pm

the answer is URL-relative syntax not supported, as can be seen here as well:

github.com

rapid7/insightconnect-plugins/blob/master/plugins/thehive/komand_thehive/connection/connection.py#L30


      
          protocol = params.get(Input.PROTOCOL)
          host = params.get(Input.HOST)
          port = params.get(Input.PORT)
          
          self.api_key = params.get(Input.API_KEY, {}).get("secretKey")
          self.password = params.get(Input.CREDENTIALS, {}).get("password")
          self.username = params.get(Input.CREDENTIALS, {}).get("username")
          self.verify = params.get(Input.VERIFY, True)
          self.proxy = params.get(Input.PROXY, {})
          
          url = f"{protocol}://{host}:{port}"
          self.logger.info(f"URL: {url}")
          
          if self.proxy:
              self.logger.info(f"Proxy specified: {self.proxy}")
          
          self.logger.info("Connect: Connecting...")
          self.logger.info(f"SSL Verify: {str(self.verify)}")
          
          self.client = HiveAPI(
              url=url,

Sergey · September 2, 2024, 12:50pm

Input for port number is not validated that it is actually a digit, so if you specify as port number the follwowing 443/subsite/relative_url/thehive
The python code f"{protocol}://{host}:{port}" will append to whatever was in port to create correct URL. With this trick TheHive plugin works, but obviously Rapid7 need to fix it.