Use Query APIs in list pages

[nadouani]

Request Type

Feature Request

Problem Description

TheHive search API has been made backward compatible with TheHive 3, and this has a certain cost on performance and data handling.

TheHive 4 has an optimised API that deals with the graph structured data with a more natural search strategy.

The UI is still using the backward compatible API and this issue aims to rely on the new APIs to display:

• Case list
• Case details page
  • Get case using API v1
  • Check case close dialog
  • Check case open dialog
  • Check case responders list
  • Check export dialog
  • Check case sharing sections
  • Use Query API to fetch case attachments
• Case tasks list
  • Use Query API v1 to list tasks
  • Update the UI to rely on fields from API v1
  • Use task.assignee
• Case task details
  • Get task using API v1
  • Check secondary api calls
  • Check task action calls
  • Get task logs using API v1
• Case observable list
  • Use API and Objects v1
  • Revamp bulk update feature
  • Revamp the bulk run analyzer feature
• Task lists
  • Use Query API v1 to list tasks
  • Update the UI to rely on fields from API v1
• Alert list
• Alert Preview dialog
• Use API v1 to list responder actions in all sections

This also requires the following changes:

• Update the describe API tu return the data model v1
• Check filter forms in list pages

[nadouani]

@To-om could you please update the describe as following:

• _createdBy and _updateBy should be of type user instead of string (used to autocomplete user names)
• fix alert.customFields
• fix case.customFields
• fix case.assignee to be a user
• add enumeration to tlp, pap, severity, status and any enumerated field

[nadouani]

@To-om here is a list of changes for cases list

• Add case resolution related field to the list API: resolutionStatus, impact, summary
• Add missing nstats related fields
• Add assignee to Tasks

[nadouani]

@nadouani here is a list of changes for alert dialog

• Update the alerts list to use API v1
• Use Query API v1 to get Alert
• Use Query API v1 to get Alert observables
• Use Query API v1 to get similar cases
• Update quick filters in alert list

[nadouani]

@To-om here is a list of changes for alert section

• add case attribute to Alert in alert list V1 (to know if it's imported or not)