Numeric values for TheHive observables

[pandvan]

It seems not possible to set a numeric value for a TheHive observable.
I’m trying to do the following:

hive_observable_data_mapping:
 - ip: client.ip
 - ip: server.ip
 - other: destination.geo.country_iso_code
 - other: client.user.name
 - other: destination.as.organization.name
 - autonomous-system: destination.as.number
 - url: url.original

where destination.as.number is a numeric value as per ECS schema definition (https://www.elastic.co/guide/en/ecs/1.7/ecs-as.html). The issue arises with any numeric matched field.

What is the correct way to deal with them?

[ferozsalam]

Hey @pandvan do you have more information on where an error is thrown, and what the error is?

[pandvan]

The error is an HTTP 400 in the response of TheHivee API call.
I'll try to reproduce it again and give you more details as soon as possible.

[pandvan]

@ferozsalam do you think it's the proper way force a string casting as did with tags in #206?

[ferozsalam]

Hey @pandvan without having tested it myself, that looks reasonable to me - are you able to test this and put in a PR if it works as expected?

[jertel]

Might be similar to this issue, fixed in 2.1.1: #201

[pandvan]

Yes @jertel, exactly. Thanks for point it out.
In addition to force string in tags, I think it's necessary to do the same also for observables.