thehive field mapping

[astrodxb]

Hello everyone
i'm struggling to map elastic alerts field to thehive
i'm using elastalert2 tried diffrent format of config but nothing work
i'm always getting what i wrote on the config just like elastalert doesn't take them as a variable
any help appreciated.

in this example i tried 3 diffrent format

hive_alert_config:
    follow: true
    severity: 2
    status: "New"
    source: "Elastic Alert"
    tags: ["tags"]
    description: rule.name
    description_args: [rule.name]
    title: "{{rule.name}}"
    type: "Elastic Alert"
    type_args: []

[jertel]

Your example does not follow the documentation. For example, you are trying to reference a rule.name variable in Jinja syntax in the title: parameter, but the title and description and other TheHive parameters do not support Jinja. They support ordered parameter references, as shown in the included example. Only the alert_text and alert_subject support Jinja, neither of which you have specified in your rule above.

Please read the section in the docs that is specific to TheHive, and change your config to match the example shown in those docs.

[astrodxb]

hello @jertel thanks for your reply,
since the creation of this topic i have been trying other format but doesn't seems to work
do you have an already working example?
even with the example on the docs i got empty fields
here is the last config i'm trying i got matches but alert not sent

hive_alert_config:
  sourceRef: "siem"
  type: "{{'{{rule[''name'']}}'}}"
  source: "Elasticsearch"
  severity: "{{'{{rule[''severity'']}}'}}"
  description: "{{'{{rule[''description'']}}'}}"
  title: "{{'{{alert[''_source''][''title'']}}'}}"
  artifact:
    - dataType: "{{'{{alert[''_index'']}}'}}"
      data: "{{'{{alert[''_id'']}}'}}"

[jertel]

Please use correct formatting on this discussion forum per our project guidelines in #11. Use

```
line1
line2
```
for multi-line code snippets and `xyz` for single line.

If you want further assistance, provide a rule that follows the format used in the documentation example, and the debug ElastAlert2 logs. Also, search the discussion forums for TheHive to find discussions that already give examples, like #465.