diff --git a/docs/includes/administrator-access-manage-email-intake-connectors.md b/docs/includes/administrator-access-manage-email-intake-connectors.md new file mode 100644 index 0000000000..342054799a --- /dev/null +++ b/docs/includes/administrator-access-manage-email-intake-connectors.md @@ -0,0 +1,2 @@ +!!! warning "Required permissions for managing email intake connectors" + Only users with an admin-type profile that has the `managePlatform` permission can manage email intake connectors in TheHive. \ No newline at end of file diff --git a/docs/includes/email-intake-tab-go-to.md b/docs/includes/email-intake-tab-go-to.md new file mode 100644 index 0000000000..3d4db044ab --- /dev/null +++ b/docs/includes/email-intake-tab-go-to.md @@ -0,0 +1,3 @@ +Select the **Email intake** tab. + + ![Email intake tab](/thehive/images/administration-guides/email-intake-connectors.png) \ No newline at end of file diff --git a/docs/thehive/administration/custom-fields/about-custom-fields.md b/docs/thehive/administration/custom-fields/about-custom-fields.md index 01a51dd435..5950bf21d3 100644 --- a/docs/thehive/administration/custom-fields/about-custom-fields.md +++ b/docs/thehive/administration/custom-fields/about-custom-fields.md @@ -41,7 +41,7 @@ Custom fields can be either optional or mandatory. You must complete all mandato

Next steps

* [Create a Custom Field](create-a-custom-field.md) -* [Manage a Custom Field](manage-a-custom-field.md) +* [Manage Custom Fields](manage-a-custom-field.md) * [Delete a Custom Field](delete-a-custom-field.md) * [Add Custom Fields](../../user-guides/analyst-corner/cases/custom-fields/add-custom-fields.md) * [Remove Custom Fields](../../user-guides/analyst-corner/cases/custom-fields/remove-custom-fields.md) diff --git a/docs/thehive/administration/custom-fields/create-a-custom-field.md b/docs/thehive/administration/custom-fields/create-a-custom-field.md index 49d22bf9d7..9183d349f9 100644 --- a/docs/thehive/administration/custom-fields/create-a-custom-field.md +++ b/docs/thehive/administration/custom-fields/create-a-custom-field.md @@ -55,7 +55,7 @@ This topic provides step-by-step instructions for creating a [custom field](../c

Next steps

-* [Manage a Custom Field](manage-a-custom-field.md) +* [Manage Custom Fields](manage-a-custom-field.md) * [Delete a Custom Field](delete-a-custom-field.md) * [Add Custom Fields](../../user-guides/analyst-corner/cases/custom-fields/add-custom-fields.md) * [Remove Custom Fields](../../user-guides/analyst-corner/cases/custom-fields/remove-custom-fields.md) diff --git a/docs/thehive/administration/custom-fields/delete-a-custom-field.md b/docs/thehive/administration/custom-fields/delete-a-custom-field.md index ae169335ab..cc17ca7ddc 100644 --- a/docs/thehive/administration/custom-fields/delete-a-custom-field.md +++ b/docs/thehive/administration/custom-fields/delete-a-custom-field.md @@ -23,7 +23,7 @@ This topic provides step-by-step instructions for deleting a [custom field](../c

Next steps

* [Create a Custom Field](create-a-custom-field.md) -* [Manage a Custom Field](manage-a-custom-field.md) +* [Manage Custom Fields](manage-a-custom-field.md) * [Add Custom Fields](../../user-guides/analyst-corner/cases/custom-fields/add-custom-fields.md) * [Remove Custom Fields](../../user-guides/analyst-corner/cases/custom-fields/remove-custom-fields.md) * [Enter Values in Custom Fields](../../user-guides/analyst-corner/cases/custom-fields/enter-values-in-custom-fields.md) diff --git a/docs/thehive/administration/email-intake-connector.md b/docs/thehive/administration/email-intake-connector.md deleted file mode 100644 index bba365966f..0000000000 --- a/docs/thehive/administration/email-intake-connector.md +++ /dev/null @@ -1,344 +0,0 @@ -# Email Intake Connector - -This documentation outlines the utilization of the Email Intake Connector for automatically generating alerts from a designated mailbox. - -The Email Intake Connector facilitates the connection of mailboxes used to receive cybersecurity alerts. It automatically transforms new emails into alerts within TheHive platform. Presently, the primary function supported is the creation of alerts regardless of the received email content. - - -![](/thehive/images/administration-guides/eic-1.png) - ---- - -## Configuration - -### Global Configuration - -The only parameter that requires adjustment is the `refresh interval`. By default, the connector polls mailboxes every *5* minutes. Adjust the frequency by increasing or decreasing the value. - -![](/thehive/images/administration-guides/eic-2.png) - -  - -### Adding a Mailbox - -Configuration options are available for Microsoft 365 (OAuth2) and Google Workspace (OAuth2). If you use another email provider service, configuration through IMAP is necessary. - -![](/thehive/images/administration-guides/eic-3.png) - -  - -=== "Microsoft MS365" - - ### Setting up Microsoft365 for TheHive - - This section provides detailed instructions to configure Microsoft 365 to allow TheHive access to a shared mailbox. Please follow these steps to ensure proper integration. - -   - - #### Prerequisites - - Administrator account on Microsoft 365. - - PowerShell installed and configured. - - A shared mailbox already created in Microsoft 365 (e.g., `test-shared-mailbox@strangebee.com`). - - ![](/thehive/images/administration-guides/ms-intake-1.png){ width="600" } - -   - - #### Step-by-Step Configuration - - 1. **Create a Mail-Enabled Security Group** - - - Create a security group that includes the shared mailbox. This group will be used to restrict access to the application for the shared mailbox only. - - Navigate to **Admin > Exchange Admin Center**, and create a **Mail-Enabled Security Group**. - - Add the shared mailbox as a member of the security group. - - ![](/thehive/images/administration-guides/ms-intake-2.png) - - 2. **Register a New Application in Microsoft Entra** - - - As an administrator, navigate to **Microsoft Entra admin center**. - - Go to **Admin > Identity > Applications > App registrations**. - - ![](/thehive/images/administration-guides/ms-intake-3.png) - - - - Gather the following information: - - **Tenant ID** - - **Client ID (App ID)** - - **Object ID** of the enterprise application - - ![](/thehive/images/administration-guides/ms-intake-4.png) - - 3. **Create a Secret for the Application** - - - In the registered application page, go to **Certificates & Secrets**. - - Create a new secret, which will be used as an OAuth2 input to authenticate the service. - - Save the secret value securely for later use. - - ![](/thehive/images/administration-guides/ms-intake-5.png) - - 4. **Assign API Permissions** - - - In the registered application page, go to **API Permissions**. - - Ensure the application has the following permissions: - - **Office 365 Exchange Online / IMAP.AccessAsApp** - - ![](/thehive/images/administration-guides/ms-intake-6.png) - - 5. **Configure PowerShell Access** - - - Define the necessary values for the configuration: - - ```powershell - $AppID = '{ClientID}' - $TenantID = '{TenantID}' - $ObjectID = '{ObjectID}' - $SecurityGroup = '{SecurityGroup}' # The mail-enabled security group - $MailBox = '{MailBox}' # The shared mailbox - ``` - - - Run the following PowerShell commands to configure access: - - - **Define App Permissions:** - - ```powershell - New-ServicePrincipal -AppId $AppID -ServiceId $ObjectID - ``` - - - **Grant Security Group Full Access to the Mailbox:** - - ```powershell - Add-MailboxPermission -Identity $MailBox -User $SecurityGroup -AccessRights FullAccess - ``` - - - **Restrict Access to Members of the Security Group Only:** - - ```powershell - New-ApplicationAccessPolicy -AppId $AppID -PolicyScopeGroupId $SecurityGroup -AccessRight RestrictAccess -Description "Restrict this app to members of distribution group {$SecurityGroup}" - ``` - - 6. **Test the Configuration** - - - Run the following command to test if the application access policy is properly configured: - - ```powershell - Test-ApplicationAccessPolicy -AppId $AppID -Identity $MailBox - ``` - - - The expected output should be similar to: - - ``` - AppId : 9367xxxx - Mailbox : test-shared-mailbox20231107190659 - AccessCheckResult : Granted - ``` - - - Running the command with a different mailbox should return `AccessCheckResult: Denied`. - - 7. **Configure Intake Connector Settings in TheHive** - - To integrate TheHive with Microsoft 365, you will need the following information: - - - **Mailbox address** - - **Tenant ID** - - **Client ID** - - **Secret Value** - - **Authority:** `https://login.microsoftonline.com` - - **Scope:** `https://outlook.office365.com/.default` - - ![](/thehive/images/administration-guides/ms-intake-7.png) - - --- - -=== "Google Workspace" - - ### Setting up Google Workspace for TheHive - - This section describes the necessary steps to configure Google Workspace to allow TheHive access to a mailbox. Please follow these steps to ensure proper integration. - -   - - #### Prerequisites - - Access to the Google Cloud Admin Console. - - Proper permissions to create projects and configure OAuth credentials. - -   - - #### Step-by-Step Configuration - - 1. **Access Google Cloud Admin Console** - Navigate to the Google Cloud Admin Console at [https://console.cloud.google.com/welcome](https://console.cloud.google.com/welcome). - - - 2. **Create a New Project** - - - Click on **API & Services**. - - ![](/thehive/images/administration-guides/intake-1.png) - - - Select **Create a Project**. - - ![](/thehive/images/administration-guides/intake-2.png) - - - Provide a meaningful name for the project and click **Create**. - - ![](/thehive/images/administration-guides/intake-3.png) - - 3. **Configure OAuth Consent Screen** - - - In the left-hand menu, select **OAuth consent screen**. - - ![](/thehive/images/administration-guides/intake-4.png) - - - Choose **User Type** as **Internal** and click **Create**. - - ![](/thehive/images/administration-guides/intake-5.png) - - - Assign a name to the app and specify a mailbox for support contact. - - ![](/thehive/images/administration-guides/intake-6.png) - - - Provide a developer contact email address, then click **Save and Continue**. - - ![](/thehive/images/administration-guides/intake-7.png) - - 4. **Add Gmail API Scope** - - - In **Step 2**, click on **Add or Remove Scopes**. - - ![](/thehive/images/administration-guides/intake-8.png) - - - In the search bar, type the following scope: `https://mail.google.com/`. - - ![](/thehive/images/administration-guides/intake-9.png) - - - Click **Add to Table** to add the scope. - - ![](/thehive/images/administration-guides/intake-10.png) - - - Ensure that the new scope is checked, then click **Update**. - - ![](/thehive/images/administration-guides/intake-11.png) - - - Scroll down to verify that the Gmail scope exists, and click **Save and Continue**. - - ![](/thehive/images/administration-guides/intake-12.png) - - 5. **Return to Dashboard** - - - On the summary page, click **Back to Dashboard** to complete the OAuth consent configuration. - - ![](/thehive/images/administration-guides/intake-13.png) - - 6. **Create OAuth Credentials** - - - In the left-hand menu, select **Credentials**. - - ![](/thehive/images/administration-guides/intake-14.png) - - - Click on **Create Credentials** and choose **OAuth Client ID**. - - ![](/thehive/images/administration-guides/intake-15.png) - - - Set the application type as **Web application**. - - ![](/thehive/images/administration-guides/intake-16.png) - - - Provide a name for the OAuth client ID. - - - Under **Authorized JavaScript origins**, add the appropriate URI. - - ![](/thehive/images/administration-guides/intake-17.png) - - - Under **Authorized redirect URIs**, add the necessary URIs and click **Create**. - - ![](/thehive/images/administration-guides/intake-18.png) - - 7. **Obtain Client ID and Secret** - - * A dialog will appear with the **Client ID** and **Client Secret**. - - * Copy these values or download the JSON file for future reference. - - ![](/thehive/images/administration-guides/intake-19.png) - - 8. **Configure Intake Connector Settings in TheHive** - - Set up the intake settings in TheHive by filling in the following values: - - * `Email` - * `clientId` - * `secret` - - ![](/thehive/images/administration-guides/eic-5.png) - - - -=== "IMAP Mailbox" - - For IMAP configuration, you'll need to input the following information: - - - Host: `host` - - Port: `port` (default: 993) - - Additionally, provide your mailbox credentials. We recommend enabling SSL Check Certificate Authority. - - ![](/thehive/images/administration-guides/eic-6.png) - - - -### Settings - -After testing your mailbox configuration, select the organization to connect, determining where alerts will be created. Define the mailbox folder to monitor (typically INBOX). Finally, specify the action to take on incoming emails: ``archive``, ``mark as read``, or ``no action``. - -![](/thehive/images/administration-guides/eic-7.png) - ---- - -## Generated Alerts and Observables - -Following configuration, alerts and observables are generated in the selected organization. - -### Alerts - -Each alert will contain the following details: - -!!! Info "Mapping of email data in the Alert" - - * **Title**: The email subject or "no subject" - * **Type**: *email-intake* - * **Source**: The configuration name is formatted as `Google Workspace @strangebee.com` => `googleworkspace-strangebee` - * **Source reference**: `{message-id}` or `{lastUidValidity}.{uidEmail}` if the message-id is inaccessible - * **Last sync date**: The date the email was received - * **Severity**: *low* - * **TLP**: *amber* - * **PAP**: *amber* - * **Follow**: *False* - * **Tags**: [*email-intake*, {source}, {Provider Name}, {Inbox Folder Name}] - * **Status**: *new* - * **Description**: The content of the email - * **Summary**: [Summary of Alert] - * **Custom Fields**: [Custom Fields] - * **Eternal link**: [Link to External Source] - - ---- - -### Observables - -The email itself is included as a `.eml` file, along with its sender and all attached files, which are added to the alert as observables, with the following parameters: - -!!! Info "Observables metadata added with the email data" - - - **Message**: The pre-formatted message - - **TLP**: {alert.tlp} - - **PAP**: {alert.pap} - - **IOC**: false - - **Sighted**: false - - **Sighted at**: [Timestamp] - - **Ignore similarity**: false - - **dataType**: *file* if it's an attachment; otherwise, *mail* for the `.eml` file - - **Tags**: {alert.tags} - - **attachment Id**: {attachment.id} - -  \ No newline at end of file diff --git a/docs/thehive/administration/email-intake-connector/about-email-intake-connectors.md b/docs/thehive/administration/email-intake-connector/about-email-intake-connectors.md new file mode 100644 index 0000000000..66b5e8edca --- /dev/null +++ b/docs/thehive/administration/email-intake-connector/about-email-intake-connectors.md @@ -0,0 +1,92 @@ +# About Email Intake Connectors + +This topic explains what email intake connectors are in TheHive. + +Email intake connectors are useful when your organization receives alerts via email and you want to automatically convert them into alerts within TheHive. + +## Usage + +Email intake connectors integrate mailboxes that receive cybersecurity alerts. + +It automatically processes incoming emails, extracts relevant information, and creates alerts within TheHive platform. The email itself, its sender, and any attached files are automatically added as observables within the respective alerts. + +!!! tip "Parsing emails" + The content of the email itself isn't automatically parsed when creating the alert. To enable automatic parsing and extraction of potential observables, you must [create a notification](../../user-guides/organization/configure-organization/manage-notifications/create-a-notification.md) triggered by [a FilteredEvent](../../user-guides/organization/configure-organization/manage-notifications/write-filtered-event-trigger.md) that [runs the *EmlParser* analyzer](../../user-guides/organization/configure-organization/manage-notifications/notifiers/analyzers.md). + + Below is an example of the FilteredEvent trigger you can use: + + ```json + { + "_and": [ + { + "_is": { + "action": "create" + } + }, + { + "_is": { + "objectType": "Observable" + } + }, + { + "_is": { + "object.alert.type": "email-intake" + } + } + ] + } + ``` + +## Data mapping + +### Alerts + +| Alert field API | Alert field UI | Alert value | +|---|---|---| +| `title` | Title | The subject of the email. If empty, displays *no subject*. | +| `type` | Type | *email-intake* | +| `source` | Source | The formatted name of the email intake connector. | +| `sourceRef` | Reference | `{message-id}`, or `{lastUidValidity}.{uidEmail}` if the `message-id` is inaccessible. | +| `date` | Occurred date | The date the email was received. | +| `severity` | Severity | *low* | +| `tlp` | TLP | *amber* | +| `pap` | PAP | *amber* | +| `follow` | Track new updates | *false* | +| `tags` | Tags | [*email-intake*, `{source}`, `{provider name}`, `{inbox folder name}`] | +| `status` | Status | *new* | +| `description` | Description | The content of the email. | + +!!! info "Modification restrictions" + You can only change the prefilled data for the `tags`, `source`, and `type` fields. Changes to other fields are not allowed. + +### Observables + +| Observable field API | Observable field UI | Observable value | +|---|---|---| +| `message` | Description | *Automatically created from email* followed by `{alert.id}` and either `{sender}` or `{file}`. | +| `tlp` | TLP | `{alert.tlp}` | +| `pap` | PAP | `{alert.pap}` | +| `ioc` | IOC | *false* | +| `sighted` | Sighted | *false* | +| `ignoreSimilarity` | Ignore similarity | *false* | +| `dataType` | Data type | *file* for the email or *mail* for the sender's email address. | +| `tags` | Tags | `{alert.tags}` | + +## Authorized email providers + +The following email providers are available in TheHive: + +* Google Workspace +* IMAP server +* Microsoft 365 +* Microsoft Graph API + +## Permissions + +{!includes/administrator-access-manage-email-intake-connectors.md!} + +

Next steps

+ +* [Connect a Mailbox](connect-a-mailbox.md) +* [Delete a Mailbox](delete-a-mailbox-connection.md) +* [Manually Trigger Email Fetch in a Mailbox](fetch-emails.md) \ No newline at end of file diff --git a/docs/thehive/administration/email-intake-connector/connect-a-mailbox.md b/docs/thehive/administration/email-intake-connector/connect-a-mailbox.md new file mode 100644 index 0000000000..7177f4c4df --- /dev/null +++ b/docs/thehive/administration/email-intake-connector/connect-a-mailbox.md @@ -0,0 +1,478 @@ +# How to Connect a Mailbox + +This topic provides step-by-step instructions for connecting a [mailbox](about-email-intake-connectors.md) in TheHive. + +{!includes/administrator-access-manage-email-intake-connectors.md!} + +

Procedure

+ +1. {!includes/platform-management-view-go-to.md!} + +2. {!includes/connectors-tab-go-to.md!} + +3. {!includes/email-intake-tab-go-to.md!} + +4. Enter the time interval between refresh attempts. This setting applies to all connected mailboxes. + + !!! info "Manual refresh" + If needed, you can also [manually trigger an email fetch](fetch-emails.md) for a mailbox. + +5. Select :fontawesome-solid-plus:. + +6. Configure your email intake connector by following these steps. IMAP configuration is required if your email provider is neither Google nor Microsoft. + + === "Google Workspace" + + + + !!! warning "Prerequisites" + You must have administrator access to the Google Cloud Console, with the necessary permissions to create projects and configure OAuth 2.0 credentials. + + #### Step 1: Create a project in the Google Cloud Console + + 1. Go to the [Google Admin Console](https://console.cloud.google.com/welcome). + + 2. Select **APIs & Services**. + + ![Google Cloud Console APIs and services](/thehive/images/administration-guides/google-cloud-console-apis-services.png) + + 3. Select **Create project**. + + ![Google Cloud Console Create project](/thehive/images/administration-guides/google-cloud-platform-create-project.png) + + 4. Enter a name for the project, an organization, and a location. + + 5. Select **Create**. + + #### Step 2: Configure OAuth consent + + 1. Select **OAuth consent screen** from the left pane. + + ![OAuth consent screen](/thehive/images/administration-guides/google-cloud-platform-oauth-consent-screen.png) + + 2. Select **Get started** to configure Google Auth Platform. + + ![Google Auth Platform](/thehive/images/administration-guides/google-cloud-platform-get-started.png) + + 3. In the **App information** section, enter information about your application. + + 4. In the **Audience** section, select *Internal*. + + 5. In the **Contact information** section, enter the email address that will receive any updates related to the project. + + 6. Select **Create**. + + #### Step 3: Add a scope in the Google Auth Platform + + 1. Select **Data access** from the left pane. + + ![Google Auth Platform Data access](/thehive/images/administration-guides/google-auth-platform-data-access.png) + + 2. Select **Add or remove scopes**. + + ![Google Auth Platform Add remove scopes](/thehive/images/administration-guides/google-auth-platform-add-remove-scopes.png) + + 3. In the **Manually add scopes** section, enter *https://mail.google.com/*. + + 4. Select **Add to table**. + + 5. Make sure the new scope is selected, then select **Update**. + + 6. Make sure the scope is added to the **Your restricted scopes** section, then select *Save*. + + #### Step 4: Create OAuth credentials + + 1. Enter *credentials* in the search bar at the top of the screen. + + 2. Select **Credentials** from the APIs & Services results. + + 3. Select **Create credentials**, then **OAuth Client ID**. + + ![Google Cloud Platform Add credentials](/thehive/images/administration-guides/google-cloud-platform-credentials-oauthclientid.png) + + 4. Select *Web application* as the application type. + + 5. Enter an internal name for the OAuth 2.0 client. + + 6. Select **Add URI** in the **Authorized JavaScript origins** section. + + 8. Enter a URI following this format: https://.org. + + 9. Enter the same URI in the **Authorized redirect URIs** section. + + 10. Select **Create**. + + 11. Copy the Client ID and Client Secret values from the dialog for use in TheHive configuration. + + #### Step 5: Configure the email intake connector in TheHive + + 1. Return to your TheHive application. + + 2. In the **Provider** section, enter the following information: + + **- Name** + + A name for your connector. + + **- Provider** + + Select *Google Workspace* from the dropdown. + + 3. In the **Authentication** section, enter the following information: + + **- Email** + + The email address associated with your account. + + **- ClientId** + + Paste the Client ID value you obtained from Google. + + **- Secret** + + Paste the Client Secret value you obtained from Google. + + Then, select **Connect** to authorize TheHive to access your Google Workspace account for use with the application. + + === "Microsoft 365" + + !!! warning "Prerequisites" + You must have: + - Administrator access to Microsoft 365. + - PowerShell installed and properly configured. + - A shared mailbox already created in Microsoft 365. + + #### Step 1: Create a mail-enabled security group + + Create a security group that includes the shared mailbox. This group will be used to restrict access to the application, ensuring it is available only to the shared mailbox. + + 1. Go to your [Microsoft Exchange admin center](https://admin.exchange.microsoft.com/). + + 2. Follow the [Microsoft instructions to create a mail-enabled security group and add the shared mailbox as a member](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-mail-enabled-security-groups#use-the-eac-to-create-a-mail-enabled-security-group). + + #### Step 2: Register a new application + + 1. Follow [the Microsoft instructions to register an application](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=certificate%2Cexpose-a-web-api#register-an-application). + + 2. Copy the Application (client) ID and Directory (tenant) ID for use in TheHive configuration. + + #### Step 3: Add a secret + + 1. Select **Certificates & secrets** from the left pane. + + 2. Follow [the Microsoft instructions to add a client secret](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=client-secret%2Cexpose-a-web-api#add-credentials). + + 3. Copy the secret's value for use in TheHive configuration. + + !!! warning "One-time display" + This secret value is never displayed again after you leave this page. + + #### Step 4: Assign API permissions + + 1. Select **API permissions** from the left pane. + + 2. Follow [the Microsoft instructions and add the *IMAP.AccessAsApp* permission for Office 365 Exchange Online](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis#add-permissions-to-access-your-web-api). + + #### Step 5: Configure PowerShell access + + 1. Define the necessary values for the configuration: + + ```powershell + $AppID = '{ClientID}' + $TenantID = '{TenantID}' + $ObjectID = '{ObjectID}' + $SecurityGroup = '{SecurityGroup}' # The mail-enabled security group + $MailBox = '{MailBox}' # The shared mailbox + ``` + + 2. Run the following PowerShell commands to configure access. + + a. Define app permissions: + + ```powershell + New-ServicePrincipal -AppId $AppID -ServiceId $ObjectID + ``` + + b. Grant security group full access to the mailbox: + + ```powershell + Add-MailboxPermission -Identity $MailBox -User $SecurityGroup -AccessRights FullAccess + ``` + + c. Restrict access to members of the security group only: + + ```powershell + New-ApplicationAccessPolicy -AppId $AppID -PolicyScopeGroupId $SecurityGroup -AccessRight RestrictAccess -Description "Restrict this app to members of distribution group {$SecurityGroup}" + ``` + + 3. Test the configuration. + + a. Run the following command to test if the application access policy is properly configured: + + ```powershell + Test-ApplicationAccessPolicy -AppId $AppID -Identity $MailBox + ``` + + b. The expected output should be similar to: + + ``` + AppId : 9367xxxx + Mailbox : test-shared-mailbox20231107190659 + AccessCheckResult : Granted + ``` + + c. Running the command with a different mailbox should return `AccessCheckResult: Denied`. + + #### Step 6: Configure the email intake connector in TheHive + + 1. Return to your TheHive application. + + 2. In the **Provider** section, enter the following information: + + **- Name** + + A name for your connector. + + **- Provider** + + Select *Microsoft 365* from the dropdown. + + 3. In the **Authentication** section, enter the following information: + + **- Email** + + The email address associated with your account. + + **- TenantId** + + Paste the Tenant ID value you obtained from Microsoft. + + **- ClientId** + + Paste the Client ID value you obtained from Microsoft. + + **- Secret** + + Paste the Client Secret value you obtained from Microsoft. + + Then, select **Connect** to authorize TheHive to access your Microsoft 365 account for use with the application. + + === "Microsoft Graph API" + + + + Microsoft Graph API is the recommended standard API for all interactions with Microsoft services. + + !!! warning "Prerequisites" + You must have: + - Administrator access to Microsoft 365. + - PowerShell installed and properly configured. + - A shared mailbox already created in Microsoft 365. + + #### Step 1: Create a mail-enabled security group + + Create a security group that includes the shared mailbox. This group will be used to restrict access to the application, ensuring it is available only to the shared mailbox. + + 1. Go to your [Microsoft Exchange admin center](https://admin.exchange.microsoft.com/). + + 2. Follow the [Microsoft instructions to create a mail-enabled security group and add the shared mailbox as a member](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-mail-enabled-security-groups#use-the-eac-to-create-a-mail-enabled-security-group). + + #### Step 2: Register a new application + + 1. Follow [the Microsoft instructions to register an application](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=certificate%2Cexpose-a-web-api#register-an-application). + + 2. Copy the Application (client) ID and Directory (tenant) ID for use in TheHive configuration. + + #### Step 3: Add a secret + + 1. Select **Certificates & secrets** from the left pane. + + 2. Follow [the Microsoft instructions to add a client secret](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=client-secret%2Cexpose-a-web-api#add-credentials). + + 3. Copy the secret's value for use in TheHive configuration. + + !!! warning "One-time display" + This secret value is never displayed again after you leave this page. + + #### Step 4: Assign API permissions + + 1. Select **API permissions** from the left pane. + + 2. Follow [the Microsoft instructions to add the relevant permissions](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis#add-permissions-to-access-microsoft-graph). + + !!! tip "Recommanded permissions" + For Microsoft Graph to work correctly with TheHive, ensure that the following permissions are added: + + * [Mail.Read](https://learn.microsoft.com/en-us/graph/permissions-reference#mailread) + * [Mail.ReadBasic](https://learn.microsoft.com/en-us/graph/permissions-reference#mailreadbasic) + * [Mail.ReadBasic.All](https://learn.microsoft.com/en-us/graph/permissions-reference#mailreadbasicall) + * [Mail.ReadWrite](https://learn.microsoft.com/en-us/graph/permissions-reference#mailreadwrite) + * [MailboxFolder.Read.All](https://learn.microsoft.com/en-us/graph/permissions-reference#mailboxfolderreadall) + * [User.Read.All](https://learn.microsoft.com/en-us/graph/permissions-reference#userreadall) + * [User.ReadBasic.All](https://learn.microsoft.com/en-us/graph/permissions-reference#userreadbasicall) + * [User.ReadWrite.All](https://learn.microsoft.com/en-us/graph/permissions-reference#userreadwriteall) + * [UserAuthenticationMethod.Read.All](https://learn.microsoft.com/en-us/graph/permissions-reference#userauthenticationmethodreadall) + * [UserAuthenticationMethod.ReadWrite.All](https://learn.microsoft.com/en-us/graph/permissions-reference#userauthenticationmethodreadwriteall) + + #### Step 5: Configure PowerShell access + + 1. Define the necessary values for the configuration: + + ```powershell + $AppID = '{ClientID}' + $TenantID = '{TenantID}' + $ObjectID = '{ObjectID}' + $SecurityGroup = '{SecurityGroup}' # The mail-enabled security group + $MailBox = '{MailBox}' # The shared mailbox + ``` + + 2. Run the following PowerShell commands to configure access. + + a. Define app permissions: + + ```powershell + New-ServicePrincipal -AppId $AppID -ServiceId $ObjectID + ``` + + b. Grant security group full access to the mailbox: + + ```powershell + Add-MailboxPermission -Identity $MailBox -User $SecurityGroup -AccessRights FullAccess + ``` + + c. Restrict access to members of the security group only: + + ```powershell + New-ApplicationAccessPolicy -AppId $AppID -PolicyScopeGroupId $SecurityGroup -AccessRight RestrictAccess -Description "Restrict this app to members of distribution group {$SecurityGroup}" + ``` + + 3. Test the configuration. + + a. Run the following command to test if the application access policy is properly configured: + + ```powershell + Test-ApplicationAccessPolicy -AppId $AppID -Identity $MailBox + ``` + + b. The expected output should be similar to: + + ``` + AppId : 9367xxxx + Mailbox : test-shared-mailbox20231107190659 + AccessCheckResult : Granted + ``` + + c. Running the command with a different mailbox should return `AccessCheckResult: Denied`. + + #### Step 6: Configure the email intake connector in TheHive + + 1. Return to your TheHive application. + + 2. In the **Provider** section, enter the following information: + + **- Name** + + A name for your connector. + + **- Provider** + + Select *Microsoft 365 GraphAPI* from the dropdown. + + 3. In the **Authentication** section, enter the following information: + + **- Email** + + The email address associated with your account. + + **- TenantId** + + Paste the Tenant ID value you obtained from Microsoft. + + **- ClientId** + + Paste the Client ID value you obtained from Microsoft. + + **- Secret** + + Paste the Client Secret value you obtained from Microsoft. + + Then, select **Connect** to authorize TheHive to access your Microsoft 365 account for use with the application. + + === "IMAP server" + + + + 1. In the **Provider** section, enter the following information: + + **- Name** + + A name for your connector. + + **- Provider** + + Select *IMAP server* from the dropdown. + + **- Host** + + The host address of the IMAP server. + + **- Port** + + The port number of the IMAP server. + + 2. Add a certificate authority. + + For more information about configuring SSL, refer to the [Configure SSL](/thehive/administration/authentication/ssl/) topic. + + Use certificates only from trusted, predefined authorities for secure connections. Custom certificate authorities are not allowed. + + You can turn off the **Don't check certificate authority** toggle to bypass certificate validation, but this isn't recommended as it may compromise connection security. + + 3. Turn on the **Disable host name verification** toggle if you want to bypass the verification of the server's host name against the certificate. + + 4. In the **Authentication** section, enter the following information: + + **- Email** + + The email address associated with your account. + + **- Password** + + The password associated with your account. + +7. In the **Settings** section, enter the following information: + + **- Organization** + + The TheHive organization where the alerts are sent. + + **- Folder** + + The folder from which emails are fetched. + + **- Action in mailbox** + + The action to perform in the mailbox when receiving an email. + +8. In the **Alert properties** section, enter the following information: + + **- Type** + + The type of the alerts created through the email intake connector. + + **- Source** + + The source of the alerts created through the email intake connector. + + **- [Tags](../../user-guides/analyst-corner/cases/tags/about-tags.md)** + + The tags to apply to the alerts created through the email intake connector. + +9. Select **Test connection** to verify your connection. + +10. Select **Confirm**. + +

Next steps

+ +* [Delete a Mailbox Connection](delete-a-mailbox-connection.md) +* [Manually Trigger Email Fetch in a Mailbox](fetch-emails.md) \ No newline at end of file diff --git a/docs/thehive/administration/email-intake-connector/delete-a-mailbox-connection.md b/docs/thehive/administration/email-intake-connector/delete-a-mailbox-connection.md new file mode 100644 index 0000000000..f41429bbd4 --- /dev/null +++ b/docs/thehive/administration/email-intake-connector/delete-a-mailbox-connection.md @@ -0,0 +1,22 @@ +# How to Delete a Mailbox + +This topic provides step-by-step instructions for deleting a [mailbox connection](about-email-intake-connectors.md) in TheHive. + +{!includes/administrator-access-manage-email-intake-connectors.md!} + +

Procedure

+ +1. {!includes/platform-management-view-go-to.md!} + +2. {!includes/connectors-tab-go-to.md!} + +3. {!includes/email-intake-tab-go-to.md!} + +4. Select :fontawesome-solid-ellipsis: next to the connector you want to delete and select **Delete**. + +5. Select **OK**. + +

Next steps

+ +* [Connect a Mailbox](connect-a-mailbox.md) +* [Manually Trigger Email Fetch in a Mailbox](fetch-emails.md) \ No newline at end of file diff --git a/docs/thehive/administration/email-intake-connector/fetch-emails.md b/docs/thehive/administration/email-intake-connector/fetch-emails.md new file mode 100644 index 0000000000..23e1d44502 --- /dev/null +++ b/docs/thehive/administration/email-intake-connector/fetch-emails.md @@ -0,0 +1,22 @@ +# How to Manually Trigger Email Fetch in a Mailbox + +This topic provides step-by-step instructions for manually triggering email fetch in a [mailbox](about-email-intake-connectors.md) in TheHive. + +This is useful if you want to manually fetch emails more quickly than the configured refresh interval. + +{!includes/administrator-access-manage-email-intake-connectors.md!} + +

Procedure

+ +1. {!includes/platform-management-view-go-to.md!} + +2. {!includes/connectors-tab-go-to.md!} + +3. {!includes/email-intake-tab-go-to.md!} + +4. Select :fontawesome-solid-ellipsis: next to the connector and select **Fetch emails**. + +

Next steps

+ +* [Connect a Mailbox](connect-a-mailbox.md) +* [Delete a Mailbox](delete-a-mailbox-connection.md) \ No newline at end of file diff --git a/docs/thehive/images/administration-guides/email-intake-connectors.png b/docs/thehive/images/administration-guides/email-intake-connectors.png new file mode 100644 index 0000000000..e277739926 Binary files /dev/null and b/docs/thehive/images/administration-guides/email-intake-connectors.png differ diff --git a/docs/thehive/images/administration-guides/google-auth-platform-add-remove-scopes.png b/docs/thehive/images/administration-guides/google-auth-platform-add-remove-scopes.png new file mode 100644 index 0000000000..5c68cfc4ef Binary files /dev/null and b/docs/thehive/images/administration-guides/google-auth-platform-add-remove-scopes.png differ diff --git a/docs/thehive/images/administration-guides/google-auth-platform-data-access.png b/docs/thehive/images/administration-guides/google-auth-platform-data-access.png new file mode 100644 index 0000000000..f5987662ef Binary files /dev/null and b/docs/thehive/images/administration-guides/google-auth-platform-data-access.png differ diff --git a/docs/thehive/images/administration-guides/google-cloud-console-apis-services.png b/docs/thehive/images/administration-guides/google-cloud-console-apis-services.png new file mode 100644 index 0000000000..4e00a96997 Binary files /dev/null and b/docs/thehive/images/administration-guides/google-cloud-console-apis-services.png differ diff --git a/docs/thehive/images/administration-guides/google-cloud-platform-create-project.png b/docs/thehive/images/administration-guides/google-cloud-platform-create-project.png new file mode 100644 index 0000000000..4342f25446 Binary files /dev/null and b/docs/thehive/images/administration-guides/google-cloud-platform-create-project.png differ diff --git a/docs/thehive/images/administration-guides/google-cloud-platform-credentials-oauthclientid.png b/docs/thehive/images/administration-guides/google-cloud-platform-credentials-oauthclientid.png new file mode 100644 index 0000000000..1d820c1a98 Binary files /dev/null and b/docs/thehive/images/administration-guides/google-cloud-platform-credentials-oauthclientid.png differ diff --git a/docs/thehive/images/administration-guides/google-cloud-platform-get-started.png b/docs/thehive/images/administration-guides/google-cloud-platform-get-started.png new file mode 100644 index 0000000000..efda189df6 Binary files /dev/null and b/docs/thehive/images/administration-guides/google-cloud-platform-get-started.png differ diff --git a/docs/thehive/images/administration-guides/google-cloud-platform-new-project-name.png b/docs/thehive/images/administration-guides/google-cloud-platform-new-project-name.png new file mode 100644 index 0000000000..6081cede7f Binary files /dev/null and b/docs/thehive/images/administration-guides/google-cloud-platform-new-project-name.png differ diff --git a/docs/thehive/images/administration-guides/google-cloud-platform-oauth-consent-screen.png b/docs/thehive/images/administration-guides/google-cloud-platform-oauth-consent-screen.png new file mode 100644 index 0000000000..e2d3608261 Binary files /dev/null and b/docs/thehive/images/administration-guides/google-cloud-platform-oauth-consent-screen.png differ diff --git a/docs/thehive/user-guides/analyst-corner/alerts/about-alerts.md b/docs/thehive/user-guides/analyst-corner/alerts/about-alerts.md index 67ff27b9e5..e7167a7eec 100644 --- a/docs/thehive/user-guides/analyst-corner/alerts/about-alerts.md +++ b/docs/thehive/user-guides/analyst-corner/alerts/about-alerts.md @@ -21,7 +21,7 @@ An alert can be created from the following sources: * Threat intelligence platforms like [MISP](../../../administration/misp-integration/about-misp-integration.md) connected to TheHive -* [Email servers](../../../administration/email-intake-connector.md) from which TheHive retrieves data. +* [Email servers](../../../administration/email-intake-connector/about-email-intake-connectors.md) from which TheHive retrieves data. ## Key components diff --git a/docs/thehive/user-guides/analyst-corner/cases/about-cases.md b/docs/thehive/user-guides/analyst-corner/cases/about-cases.md index 9bf9705aef..8f3536597f 100644 --- a/docs/thehive/user-guides/analyst-corner/cases/about-cases.md +++ b/docs/thehive/user-guides/analyst-corner/cases/about-cases.md @@ -22,7 +22,7 @@ In TheHive, you can create a case from the following sources: * [Alert feeders](../../../user-guides/organization/configure-organization/manage-feeders/about-feeders.md): Cases created from data retrieved from external systems using an alert feeder. -* [Alerts](../cases/create-a-new-case.md#create-a-case-from-an-alert): Cases generated from alerts received via connected detection tools (SIEM, EDR, IDS, or firewalls), threat intelligence platforms (like MISP), or [email servers](../../../administration/email-intake-connector.md). +* [Alerts](../cases/create-a-new-case.md#create-a-case-from-an-alert): Cases generated from alerts received via connected detection tools (SIEM, EDR, IDS, or firewalls), threat intelligence platforms (like MISP), or [email servers](../../../administration/email-intake-connector/about-email-intake-connectors.md). * [Detection tools](../cases/create-a-new-case.md#create-a-case-from-a-detection-tool) (SIEM, EDR, IDS, or firewalls): Cases created automatically by trusted detection tools, when you prefer to manage alert triage within the tool or trust it to generate mostly true positives. diff --git a/docs/thehive/user-guides/analyst-corner/cases/tags/about-tags.md b/docs/thehive/user-guides/analyst-corner/cases/tags/about-tags.md index eb41f15a48..55ee8d656b 100644 --- a/docs/thehive/user-guides/analyst-corner/cases/tags/about-tags.md +++ b/docs/thehive/user-guides/analyst-corner/cases/tags/about-tags.md @@ -9,7 +9,7 @@ This topic helps you understand how tags work. In TheHive, tags are created in two ways: * [Taxonomy tags](../../../../administration/taxonomies/about-taxonomies.md): Created from an imported taxonomy -* [Custom tags](../../../organization/configure-organization/manage-custom-tags/about-custom-tags.md): Created manually by users as free text to cases, alerts, and observables, or automatically by connected external tools, [email servers](../../../../administration/email-intake-connector.md), or [alert feeders](../../../organization/configure-organization/manage-feeders/about-feeders.md) +* [Custom tags](../../../organization/configure-organization/manage-custom-tags/about-custom-tags.md): Created manually by users as free text to cases, alerts, and observables, or automatically by connected external tools, [email servers](../../../../administration/email-intake-connector/about-email-intake-connectors.md), or [alert feeders](../../../organization/configure-organization/manage-feeders/about-feeders.md) ## Scope diff --git a/docs/thehive/user-guides/analyst-corner/tasks/about-tasks.md b/docs/thehive/user-guides/analyst-corner/tasks/about-tasks.md index 583e67c2ce..b26ef4957c 100644 --- a/docs/thehive/user-guides/analyst-corner/tasks/about-tasks.md +++ b/docs/thehive/user-guides/analyst-corner/tasks/about-tasks.md @@ -55,7 +55,7 @@ In TheHive, you can make important tasks stand out using the following options: * [Create a Task](create-a-task.md) * [Share a Task](share-a-task.md) * [Change a Task Status](change-task-status.md) -* [Manage a Task](manage-a-task.md) +* [Manage Tasks](manage-a-task.md) * [Delete a Task](delete-a-task.md) * [Create a Task Log](../tasks/create-a-task-log.md) * [Run Responders](../tasks/preview-task-details/run-responders.md) \ No newline at end of file diff --git a/docs/thehive/user-guides/analyst-corner/tasks/change-task-status.md b/docs/thehive/user-guides/analyst-corner/tasks/change-task-status.md index bba12a4f03..7080bbd143 100644 --- a/docs/thehive/user-guides/analyst-corner/tasks/change-task-status.md +++ b/docs/thehive/user-guides/analyst-corner/tasks/change-task-status.md @@ -18,6 +18,6 @@ This topic provides step-by-step instructions for changing the [status](about-ta

Next steps

* [Share a Task](share-a-task.md) -* [Manage a Task](manage-a-task.md) +* [Manage Tasks](manage-a-task.md) * [Delete a Task](delete-a-task.md) * [Create a Task Log](create-a-task-log.md) \ No newline at end of file diff --git a/docs/thehive/user-guides/analyst-corner/tasks/create-a-task.md b/docs/thehive/user-guides/analyst-corner/tasks/create-a-task.md index 52c2ce5502..98aa588341 100644 --- a/docs/thehive/user-guides/analyst-corner/tasks/create-a-task.md +++ b/docs/thehive/user-guides/analyst-corner/tasks/create-a-task.md @@ -56,6 +56,6 @@ This topic provides step-by-step instructions for creating a [task](about-tasks. * [Share a Task](share-a-task.md) * [Change a Task Status](change-task-status.md) -* [Manage a Task](manage-a-task.md) +* [Manage Tasks](manage-a-task.md) * [Delete a Task](delete-a-task.md) * [Create a Task Log](create-a-task-log.md) diff --git a/docs/thehive/user-guides/analyst-corner/tasks/delete-a-task.md b/docs/thehive/user-guides/analyst-corner/tasks/delete-a-task.md index b6ac7925f2..e6db249e10 100644 --- a/docs/thehive/user-guides/analyst-corner/tasks/delete-a-task.md +++ b/docs/thehive/user-guides/analyst-corner/tasks/delete-a-task.md @@ -19,5 +19,5 @@ This topic provides step-by-step instructions for deleting a [task](about-tasks. * [Share a Task](share-a-task.md) * [Change a Task Status](change-task-status.md) * [Create a Task](create-a-task.md) -* [Manage a Task](manage-a-task.md) +* [Manage Tasks](manage-a-task.md) * [Create a Task Log](create-a-task-log.md) \ No newline at end of file diff --git a/docs/thehive/user-guides/analyst-corner/tasks/manage-a-task.md b/docs/thehive/user-guides/analyst-corner/tasks/manage-a-task.md index 905b8be7f0..b29efd5f2b 100644 --- a/docs/thehive/user-guides/analyst-corner/tasks/manage-a-task.md +++ b/docs/thehive/user-guides/analyst-corner/tasks/manage-a-task.md @@ -1,4 +1,4 @@ -# How to Manage a Task +# How to Manage Tasks This topic provides step-by-step instructions for managing a [task](about-tasks.md) in TheHive. diff --git a/docs/thehive/user-guides/analyst-corner/tasks/search-for-tasks/find-a-task.md b/docs/thehive/user-guides/analyst-corner/tasks/search-for-tasks/find-a-task.md index 15820c93db..b9bae06c17 100644 --- a/docs/thehive/user-guides/analyst-corner/tasks/search-for-tasks/find-a-task.md +++ b/docs/thehive/user-guides/analyst-corner/tasks/search-for-tasks/find-a-task.md @@ -72,7 +72,7 @@ If you’re unsure which method to use, refer to the [Overview of Search Methods * [Create a Task](../create-a-task.md) * [Share a Task](../share-a-task.md) * [Change a Task Status](../change-task-status.md) -* [Manage a Task](../manage-a-task.md) +* [Manage Tasks](../manage-a-task.md) * [Delete a Task](../delete-a-task.md) * [Create a Task Log](../create-a-task-log.md) * [Run Responders](../../tasks/preview-task-details/run-responders.md) diff --git a/docs/thehive/user-guides/analyst-corner/tasks/share-a-task.md b/docs/thehive/user-guides/analyst-corner/tasks/share-a-task.md index 66edc63d54..4d23347c01 100644 --- a/docs/thehive/user-guides/analyst-corner/tasks/share-a-task.md +++ b/docs/thehive/user-guides/analyst-corner/tasks/share-a-task.md @@ -32,6 +32,6 @@ To learn more about how sharing rules function and interact, see the [About Orga * [Share an Observable](../cases/share-an-observable.md) * [Share a Case](../cases/share-a-case.md) * [Change a Task Status](change-task-status.md) -* [Manage a Task](manage-a-task.md) +* [Manage Tasks](manage-a-task.md) * [Delete a Task](delete-a-task.md) * [Create a Task Log](create-a-task-log.md) \ No newline at end of file diff --git a/docs/thehive/user-guides/organization/configure-organization/manage-custom-tags/about-custom-tags.md b/docs/thehive/user-guides/organization/configure-organization/manage-custom-tags/about-custom-tags.md index 2a8ebd40bd..cff5f6769b 100644 --- a/docs/thehive/user-guides/organization/configure-organization/manage-custom-tags/about-custom-tags.md +++ b/docs/thehive/user-guides/organization/configure-organization/manage-custom-tags/about-custom-tags.md @@ -16,7 +16,7 @@ Custom tags can be created: * Manually by users when added to cases, alerts, or observables * Automatically by connected external tools -* Automatically by [email servers](../../../../administration/email-intake-connector.md) +* Automatically by [email servers](../../../../administration/email-intake-connector/about-email-intake-connectors.md) * Automatically by [alert feeders](../manage-feeders/about-feeders.md) ## Actions diff --git a/docs/thehive/user-guides/organization/configure-organization/manage-notifications/create-a-notification.md b/docs/thehive/user-guides/organization/configure-organization/manage-notifications/create-a-notification.md index 6c56680fb4..c912f0595e 100644 --- a/docs/thehive/user-guides/organization/configure-organization/manage-notifications/create-a-notification.md +++ b/docs/thehive/user-guides/organization/configure-organization/manage-notifications/create-a-notification.md @@ -28,7 +28,7 @@ This topic provides step-by-step instructions for creating a [notification](abou 5. Turn on the **Send notification to every user in the organization** toggle to be able to send an email to all users in the organization. !!! note "Available trigger" - If enabled, the *AnyEvent* trigger will no longer be available, and only the *EmailerToUser* notifier will be selectable. + If enabled, the *AnyEvent* trigger is no longer available, and only the *EmailerToUser* notifier is selectable. --- diff --git a/docs/thehive/user-guides/organization/configure-organization/manage-notifications/about-filtered-event-trigger-operators.md b/docs/thehive/user-guides/organization/configure-organization/manage-notifications/filtered-event-trigger-operators.md similarity index 100% rename from docs/thehive/user-guides/organization/configure-organization/manage-notifications/about-filtered-event-trigger-operators.md rename to docs/thehive/user-guides/organization/configure-organization/manage-notifications/filtered-event-trigger-operators.md diff --git a/docs/thehive/user-guides/organization/configure-organization/manage-notifications/write-filtered-event-trigger.md b/docs/thehive/user-guides/organization/configure-organization/manage-notifications/write-filtered-event-trigger.md index c9363f818b..23f253708e 100644 --- a/docs/thehive/user-guides/organization/configure-organization/manage-notifications/write-filtered-event-trigger.md +++ b/docs/thehive/user-guides/organization/configure-organization/manage-notifications/write-filtered-event-trigger.md @@ -30,7 +30,7 @@ This topic provides step-by-step instructions for writing a *FilteredEvent* [tri 5. Write your filter. !!! tip "Operators" - To learn more about using operators, see the [About FilteredEvent Trigger Operators](about-filtered-event-trigger-operators.md) topic. + To learn more about using operators, see the [About FilteredEvent Trigger Operators](filtered-event-trigger-operators.md) topic. To access a specific field within a JSON object, use dot (`.`) notation to navigate through nested properties. diff --git a/mkdocs.yml b/mkdocs.yml index 013c6d4000..6bb77f0991 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -237,6 +237,7 @@ plugins: 'thehive/user-guides/organization/configure-organization/manage-templates/case-templates/edit-a-case-template.md': 'thehive/user-guides/organization/configure-organization/manage-templates/case-templates/create-a-case-template.md' 'thehive/user-guides/organization/configure-organization/manage-templates/case-templates/export-a-case-template.md': 'thehive/user-guides/organization/configure-organization/manage-templates/case-templates/export-import-a-case-template.md' 'thehive/user-guides/organization/configure-organization/manage-templates/case-templates/import-a-case-template.md': 'thehive/user-guides/organization/configure-organization/manage-templates/case-templates/export-import-a-case-template.md' + 'thehive/administration/email-intake-connector.md': 'thehive/administration/email-intake-connector/about-email-intake-connectors.md' extra: generator: false @@ -357,7 +358,11 @@ nav: - 'About MISP Integration': thehive/administration/misp-integration/about-misp-integration.md - 'Connect a MISP Server': thehive/administration/misp-integration/connect-a-misp-server.md - 'Delete a MISP Server Connection': thehive/administration/misp-integration/delete-a-misp-server.md - - 'Email Intake Connector': thehive/administration/email-intake-connector.md + - 'Email Intake Connectors': + - 'About Email Intake Connectors': thehive/administration/email-intake-connector/about-email-intake-connectors.md + - 'Connect a Mailbox': thehive/administration/email-intake-connector/connect-a-mailbox.md + - 'Manually Fetch Emails': thehive/administration/email-intake-connector/fetch-emails.md + - 'Delete a Mailbox Connection': thehive/administration/email-intake-connector/delete-a-mailbox-connection.md - 'Authentication Settings': - 'Configure Authentication': thehive/administration/authentication/configure-authentication.md - 'Configure Providers': @@ -457,7 +462,7 @@ nav: - 'Function': thehive/user-guides/organization/configure-organization/manage-notifications/notifiers/function.md - 'Filtered Event Setup': - 'Write a FilteredEvent Trigger': thehive/user-guides/organization/configure-organization/manage-notifications/write-filtered-event-trigger.md - - 'Operators': thehive/user-guides/organization/configure-organization/manage-notifications/about-filtered-event-trigger-operators.md + - 'Operators': thehive/user-guides/organization/configure-organization/manage-notifications/filtered-event-trigger-operators.md - 'Endpoints': - 'About Endpoints': thehive/user-guides/organization/configure-organization/manage-endpoints/about-endpoints.md - 'Add a Local HttpRequest Endpoint': thehive/user-guides/organization/configure-organization/manage-endpoints/add-http-request-endpoint.md @@ -562,7 +567,7 @@ nav: - 'About Tasks': thehive/user-guides/analyst-corner/tasks/about-tasks.md - 'Create a Task': thehive/user-guides/analyst-corner/tasks/create-a-task.md - 'Change a Task Status': thehive/user-guides/analyst-corner/tasks/change-task-status.md - - 'Manage a Task': thehive/user-guides/analyst-corner/tasks/manage-a-task.md + - 'Manage Tasks': thehive/user-guides/analyst-corner/tasks/manage-a-task.md - 'Delete a Task': thehive/user-guides/analyst-corner/tasks/delete-a-task.md - 'Search for Tasks': - 'Find a Task': thehive/user-guides/analyst-corner/tasks/search-for-tasks/find-a-task.md