Add a file as an observable

thehivefileobservable.py

def thehive_alert(alert):
    global CONFIG
    authheader={'Content-Type': 'application/json', 'Authorization': 'Bearer '+CONFIG['thehiveapikey']}
    print(requests.post("http://127.0.0.1:9000/api/alert",headers=authheader,data=json.dumps(alert),verify=False))

myfile=''
try:
    with open(fname,"rb") as f:
        myfile=fname+";text/plain;"+base64.b64encode(f.read())
except Exception:
    pass

alert={
    "title": "Your casetitle",
    "description":"```\n"+"alert information""\n```",
    "type": "SpearPhishing",
    "source": "Your script",
    "sourceRef": "Some email subject",
    "severity":3,
    "tlp":3,
    "artifacts":[{"dataType":"mail","data":"[email protected]","message":"email sender"},
                {"dataType":"file","data":myfile,"message":"FireEye alert email body"}
    
    ],
    "caseTemplate":"Secops default playbook"
}
thehive_alert(alert)