Skip to main content

Automations

Automations are scripts that can be triggered in different parts of the catalyst.

Type​

There are global automations, artifact automations and task automations.

Global automations are only available for admin users and can be started from the job view.

Artifact automations are shown in the artifact popups in the tickets. They can be used trigger enrichments or other automations for the artifact.

Task automations are part of playbooks. They automate single steps of the playbook.

Automations can be written in a way to be used in all available places, e.g. a VirusTotal automation can be used within a playbook, as an artifact enrichment and for direct requests globally (although the last option might not be that useful).

Docker Image​

The docker image defines the docker image that is used as an environment for the script.

Script​

The script file is copied to the docker container when the automation is triggered. It can be written in any language executable in the given docker image. The message (s. below) is passed as an input. The output from printed to stderr is saved as log lines, while the stdout should be a single json document that is taken as a result.

Message​

The message is passed as a json string to the script as a the first and only command line argument. The content of the message depends on the type of the automation.

A global message contains the user input in the payload. The context element is empty. The secrets contains credentials to access the catalyst.

{
  "payload": {
    "thehiveurl": "https://thehive.example.org",
    "thehivekey": "yqV1tmLy+w4shJ",
    "skip_files": true,
    "keep_ids": true
  },
  "context": {},
  "secrets": {
    "catalyst_apikey": "d0169af94c70981eb5452a42fae536b6caa9be3a",
    "catalyst_apiurl": "http://catalyst:8000/api"
  }
}

Schema​

The schema is only used in global automations. It is used to create input forms based on JSON schemas. For advanced options like styling or more complex input see VJSF.