TheHive alert aging

thehive-alert-aging.py

#!/bin/env python2
import requests
import json 
import time
import logging 

logging.basicConfig(format='ThehiveAPI: %(asctime)-15s  %(message)s')
LOG = logging.getLogger('thehiveapi-alert-aging')
LOG.setLevel(logging.DEBUG)
alert_age=86400
sleep_for=3600

while True:
	try:
		creds={}
		with open("/etc/thehive/thehiveapi.json") as f:
			creds=json.loads(f.read())
		LOG.info("Fetching thehive alerts")
		alerts=json.loads(requests.get(creds['server']+"/api/alert?range=0-100",headers={"Authorization":"Bearer "+creds['apikey']}).text )
		ts=time.time()
		if alerts:
			LOG.info("Found "+str(len(alerts))+" Alerts")
			for alert in alerts:
				if 'createdAt' in alert:
					if int(alert['createdAt'])/1000 < (ts- alert_age):
						response=requests.delete(creds['server']+"/api/alert/"+alert['id'],headers={"Authorization":"Bearer "+creds['apikey']})
						if response.status_code == 204:
							LOG.info("Removed alert because it's too old:"+alert['title'])
						else:
							LOG.error("Error removing aged alert:"+alert['title'])
							LOG.error(response.text)
		LOG.info("Alert ageout went well, sleeping for "+str(sleep_for)+" Seconds")
		alerts=None
		time.sleep(sleep_for)
	except Exception as e:
		LOG.exception(e)
		break
		time.sleep(4)
		continue