create_case
Create a new security incident case in TheHive. Define title, description, severity, tags, TLP, and PAP to initiate incident response.
Instructions
Create a new empty security incident Case in TheHive.
Args: title (str): Title of the case. description (str): Detailed markdown-supported description of the case. severity (int): Severity level: 1 (Low), 2 (Medium), 3 (High), 4 (Critical). Default is 2. tags (List[str], optional): List of tags to categorize the case. tlp (int): Traffic Light Protocol level: 0 (White), 1 (Green), 2 (Amber), 3 (Amber+Strict), 4 (Red). Default is 2. pap (int): Permissible Action Protocol level: 0 (White), 1 (Green), 2 (Amber), 3 (Red). Default is 2. flag (bool): Mark the case as flagged/starred. Default is False.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pap | No | ||
| tlp | No | ||
| flag | No | ||
| tags | No | ||
| title | Yes | ||
| severity | No | ||
| description | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |