[thehive] Add functionality for adding observables

x-pack/platform/plugins/shared/stack_connectors/common/thehive/schema.ts

@@ -57,6 +57,7 @@ export const ExecutorSubActionCreateAlertParamsSchema = schema.object({
   severity: schema.nullable(schema.number({ defaultValue: TheHiveSeverity.MEDIUM })),
   tlp: schema.nullable(schema.number({ defaultValue: TheHiveTLP.AMBER })),
   tags: schema.nullable(schema.arrayOf(schema.string())),
+  body: schema.nullable(schema.string()),
 });
 
 export const ExecutorParamsSchema = schema.oneOf([

x-pack/platform/plugins/shared/stack_connectors/public/connector_types/thehive/constants.ts

@@ -112,3 +112,70 @@ export const tlpOptions = [
     }),
   },
 ];
+
+export const templateOptions = [
+  {
+    value: 0,
+    text: i18n.translate(
+      'xpack.stackConnectors.components.thehive.eventSelectTemplate1OptionLabel',
+      {
+        defaultMessage: 'Template1',
+      }
+    ),
+  },
+  {
+    value: 1,
+    text: i18n.translate(
+      'xpack.stackConnectors.components.thehive.eventSelectTemplate2OptionLabel',
+      {
+        defaultMessage: 'Template2',
+      }
+    ),
+  },
+];
+
+export const bodyOptions = [
+  '{"observables":[{"dataType":"ip","data":"{{#context.alerts}}{{source.ip}}12{{/context.alerts}}","tags":["source.ip"]},{"dataType":"hostname","data":"{{#context.alerts}}{{host.hostname}}34{{/context.alerts}}","tags":["Fortigate-FW"]}],"procedures":[{{#context.rule.threat}}{"patternId":"{{technique.0.id}}","occurDate":"{{#context.alerts}}{{#signal.original_time}}{{#FormatDate}} {{{signal.original_time}}} ; ; x {{/FormatDate}}{{/signal.original_time}}{{^signal.original_time}}1640000000000{{/signal.original_time}}{{/context.alerts}}","tactic":"{{tactic.name}}"}{{#technique.0.subtechnique}},{"patternId":"{{id}}","occurDate":"{{#context.alerts}}{{#signal.original_time}}{{#FormatDate}} {{{signal.original_time}}} ; ; x {{/FormatDate}}{{/signal.original_time}}{{^signal.original_time}}1640000000000{{/signal.original_time}}{{/context.alerts}}","tactic":"{{tactic.name}}"}{{/technique.0.subtechnique}}{{^technique.0.subtechnique}}{{^@last}},{{/@last}}{{/technique.0.subtechnique}}{{/context.rule.threat}}]}',
+  JSON.stringify(
+    {
+      observables: [
+        {
+          dataType: 'hostname',
+          data: '{{#context.alerts}}{{host.hostname}}{{/context.alerts}}',
+          tags: ['Fortigate-FW'],
+        },
+      ],
+    },
+    null,
+    2
+  ),
+];
+
+export const testBodyOptions = [
+  JSON.stringify(
+    {
+      observables: [
+        {
+          dataType: 'ip',
+          data: '127.0.0.1',
+          tags: ['source.ip'],
+        },
+      ],
+    },
+    null,
+    2
+  ),
+  JSON.stringify(
+    {
+      observables: [
+        {
+          dataType: 'hostname',
+          data: '{{#context.alerts}}{{host.hostname}}{{/context.alerts}}',
+          tags: ['Fortigate-FW'],
+        },
+      ],
+    },
+    null,
+    2
+  ),
+];

x-pack/platform/plugins/shared/stack_connectors/public/connector_types/thehive/params.tsx

@@ -8,7 +8,7 @@
 import React, { useState, useEffect, useRef, useMemo } from 'react';
 import { ActionParamsProps, ActionConnectorMode } from '@kbn/triggers-actions-ui-plugin/public';
 import { EuiFormRow, EuiSelect } from '@elastic/eui';
-import { eventActionOptions } from './constants';
+import { bodyOptions, eventActionOptions, testBodyOptions } from './constants';
 import { SUB_ACTION } from '../../../common/thehive/constants';
 import { ExecutorParams } from '../../../common/thehive/types';
 import { TheHiveParamsAlertFields } from './params_alert';
@@ -83,6 +83,7 @@ const TheHiveParamsFields: React.FunctionComponent<ActionParamsProps<ExecutorPar
             severity: 2,
             tags: [],
             sourceRef: isTest ? undefined : '{{alert.uuid}}',
+            body: isTest ? testBodyOptions[0] : bodyOptions[0],
           }
         : {
             incident: {

x-pack/platform/plugins/shared/stack_connectors/public/connector_types/thehive/params_alert.tsx

@@ -10,10 +10,17 @@ import {
   TextFieldWithMessageVariables,
   TextAreaWithMessageVariables,
   ActionParamsProps,
+  JsonEditorWithMessageVariables,
 } from '@kbn/triggers-actions-ui-plugin/public';
 import { EuiFormRow, EuiSelect, EuiComboBox } from '@elastic/eui';
 import { ExecutorParams, ExecutorSubActionCreateAlertParams } from '../../../common/thehive/types';
-import { severityOptions, tlpOptions } from './constants';
+import {
+  severityOptions,
+  tlpOptions,
+  templateOptions,
+  bodyOptions,
+  testBodyOptions,
+} from './constants';
 import * as translations from './translations';
 
 export const TheHiveParamsAlertFields: React.FC<ActionParamsProps<ExecutorParams>> = ({
@@ -30,6 +37,7 @@ export const TheHiveParamsAlertFields: React.FC<ActionParamsProps<ExecutorParams
         tlp: 2,
         severity: 2,
         tags: [],
+        body: testBodyOptions[0],
       } as unknown as ExecutorSubActionCreateAlertParams),
     [actionParams.subActionParams]
   );
@@ -39,6 +47,7 @@ export const TheHiveParamsAlertFields: React.FC<ActionParamsProps<ExecutorParams
   const [selectedOptions, setSelected] = useState<Array<{ label: string }>>(
     alert.tags?.map((tag) => ({ label: tag })) ?? []
   );
+  const [template, setTemplate] = useState(templateOptions[0].value);
 
   const onCreateOption = (searchValue: string) => {
     setSelected([...selectedOptions, { label: searchValue }]);
@@ -54,6 +63,8 @@ export const TheHiveParamsAlertFields: React.FC<ActionParamsProps<ExecutorParams
     );
   };
 
+  // eslint-disable-next-line no-console
+  console.log({ alert });
   return (
     <>
       <TextFieldWithMessageVariables
@@ -187,6 +198,51 @@ export const TheHiveParamsAlertFields: React.FC<ActionParamsProps<ExecutorParams
           noSuggestions
         />
       </EuiFormRow>
+      <EuiFormRow fullWidth label="Observable Template">
+        <EuiSelect
+          fullWidth
+          data-test-subj="templateSelectInput"
+          value={template}
+          options={templateOptions}
+          onChange={(e) => {
+            editAction(
+              'subActionParams',
+              { ...alert, body: testBodyOptions[parseInt(e.target.value, 10)] },
+              index
+            );
+            setTemplate(parseInt(e.target.value, 10));
+          }}
+        />
+        {/* below text area is just to show that alert object is changed and component is re-rendered */}
+      </EuiFormRow>
+      <TextAreaWithMessageVariables
+        index={index}
+        label="Other Body"
+        editAction={(key, value) => {
+          editAction('subActionParams', { ...alert, [key]: value }, index);
+        }}
+        messageVariables={messageVariables}
+        paramsProperty={'body'}
+        inputTargetValue={JSON.stringify(alert.body, null, 2)}
+        errors={errors['createAlertParam.body'] as string[]}
+      />
+      <JsonEditorWithMessageVariables
+        messageVariables={messageVariables}
+        paramsProperty={'body'}
+        inputTargetValue={alert.body}
+        label={translations.BODY_LABEL}
+        ariaLabel={translations.BODY_DESCRIPTION}
+        errors={errors.body as string[]}
+        onDocumentsChange={(json: string) =>
+          editAction('subActionParams', { ...alert, body: json }, index)
+        }
+        dataTestSubj="thehive-bodyJsonEditor"
+        onBlur={() => {
+          if (!alert.body) {
+            editAction('subActionParams', { ...alert, body: '' }, index);
+          }
+        }}
+      />
     </>
   );
 };

x-pack/platform/plugins/shared/stack_connectors/public/connector_types/thehive/translations.ts

@@ -102,6 +102,20 @@ export const SOURCE_REF_LABEL = i18n.translate(
   }
 );
 
+export const BODY_LABEL = i18n.translate(
+  'xpack.stackConnectors.components.thehive.sourceRefFieldLabel',
+  {
+    defaultMessage: 'Body',
+  }
+);
+
+export const BODY_DESCRIPTION = i18n.translate(
+  'xpack.stackConnectors.components.thehive.sourceRefFieldLabel',
+  {
+    defaultMessage: 'Code Editor',
+  }
+);
+
 export const TITLE_REQUIRED = i18n.translate(
   'xpack.stackConnectors.components.thehive.requiredTitleText',
   {