Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User Mapping TheHive #2723

Open
V1D1AN opened this issue Sep 27, 2024 · 3 comments
Open

User Mapping TheHive #2723

V1D1AN opened this issue Sep 27, 2024 · 3 comments
Labels
bug use for describing something not working as expected needs more info Intel needed about the use case

Comments

@V1D1AN
Copy link

V1D1AN commented Sep 27, 2024

Description

Hi,

I have a bug with TheHive connector. I try to mapping differents users between TheHive and OpenCTI, and it's don't work..

Environment

  1. OpenCTI version: 6.3.3
  2. OpenCTI client: frontend
  3. TheHive version : 4.1.24-1

Reproducible Steps

I use the docker compose.yml
I put the line : - THEHIVE_USER_MAPPING=[email protected]:88ec0c6a-13ce-5e39-b486-354fe4a7084f

I use the OpenCTI user ID present in the URL

image

Expected Output

In the case into OpenCTI, i want to see my user of OpenCTI in assignees

Actual Output

image

@V1D1AN V1D1AN added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team labels Sep 27, 2024
@romain-filigran
Copy link
Member

Hello @V1D1AN : Can you confirm that your case in Thive is well assigned (case owner) to the user that you specified in your config file ([email protected])

@romain-filigran romain-filigran added needs more info Intel needed about the use case and removed needs triage use to identify issue needing triage from Filigran Product team labels Sep 29, 2024
@V1D1AN
Copy link
Author

V1D1AN commented Sep 29, 2024

Hi @romain-filigran ,
Yes I confirm you that all my users in thehive had a case.
I have change the real user with [email protected] in my example

@emo-sec
Copy link

emo-sec commented Oct 2, 2024

Hello,
I am having the same issue using either the id or api_token in the format "thehiveemail:id,thehiveemail2:id2"

With information gotten from the below query in the playground:

query Users {
  users {
    edges {
      node {
        user_email
        id
        api_token
      }
    }
  }
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected needs more info Intel needed about the use case
Projects
None yet
Development

No branches or pull requests

3 participants