#250 - Implement list comment methods for alerts and cases

TheHive-Project · Aug 2, 2022 · 06b036a · 06b036a
1 parent cc64ac2
commit 06b036a
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 0 deletions.
diff --git a/thehive4py/endpoints/alert.py b/thehive4py/endpoints/alert.py
@@ -13,6 +13,7 @@
     OutputAlert,
 )
 from thehive4py.types.case import OutputCase
+from thehive4py.types.comment import OutputComment
 from thehive4py.types.observable import InputObservable, OutputObservable
 
 
@@ -141,3 +142,22 @@ def find_observables(
             params={"name": "alert-observables"},
             json={"query": query},
         )
+
+    def find_comments(
+        self,
+        alert_id: str,
+        filters: Optional[FilterExpr] = None,
+        sortby: Optional[SortExpr] = None,
+        paginate: Optional[Paginate] = None,
+    ) -> List[OutputComment]:
+        query: QueryExpr = [
+            {"_name": "getAlert", "idOrName": alert_id},
+            {"_name": "comments"},
+            *self._build_subquery(filters=filters, sortby=sortby, paginate=paginate),
+        ]
+        return self._session.make_request(
+            "POST",
+            path="/api/v1/query",
+            params={"name": "alert-comments"},
+            json={"query": query},
+        )
diff --git a/thehive4py/endpoints/case.py b/thehive4py/endpoints/case.py
@@ -16,6 +16,7 @@
     InputUpdateCase,
     OutputCase,
 )
+from thehive4py.types.comment import OutputComment
 from thehive4py.types.observable import InputObservable, OutputObservable
 from thehive4py.types.share import InputShare, OutputShare
 from thehive4py.types.task import InputTask, OutputTask
@@ -256,6 +257,25 @@ def find_attachments(
             json={"query": query},
         )
 
+    def find_comments(
+        self,
+        case_id: CaseId,
+        filters: Optional[FilterExpr] = None,
+        sortby: Optional[SortExpr] = None,
+        paginate: Optional[Paginate] = None,
+    ) -> List[OutputComment]:
+        query: QueryExpr = [
+            {"_name": "getCase", "idOrName": case_id},
+            {"_name": "comments"},
+            *self._build_subquery(filters=filters, sortby=sortby, paginate=paginate),
+        ]
+        return self._session.make_request(
+            "POST",
+            path="/api/v1/query",
+            params={"name": "case-comments"},
+            json={"query": query},
+        )
+
     def close(
         self,
         case_id: CaseId,