Allow the possibility to use rule and match filed in thehive alert description

CHANGELOG.md

@@ -9,6 +9,7 @@
 ## Other changes
 - Upgrade stomp 8.0.0 to 8.0.1 - [#832](https://github.com/jertel/elastalert2/pull/832) - @jertel
 - Add support for Kibana 8.2 for Kibana Discover, Upgrade Pytest 7.1.1 to 7.1.2, Upgrade pylint 2.13.5 to 2.13.8, Upgrade Jinja2 3.1.1 to 3.1.2 - [#840](https://github.com/jertel/elastalert2/pull/840) - @nsano-rururu
+- Add the possibility to use rule and match fileds in the description of TheHive alert
 
 # 2.5.0
 

docs/source/ruletypes.rst

@@ -3232,6 +3232,8 @@ the observable value is also the same, including the behaviour for aggregated al
 
 ``hive_verify``: Whether or not to enable SSL certificate validation. Defaults to False.
 
+``description_args``: can be used to call rule and match fileds in the description of the alert in TheHive
+
 Example usage::
 
     alert: hivealerter
@@ -3253,7 +3255,8 @@ Example usage::
       severity: 2
       status: 'New'
       source: 'elastalert'
-      description: 'Sample description'
+      description_args: [ name, description]
+      description: '{0} : {1}'
       tags: ['tag1', 'tag2']
       title: 'Title'
       tlp: 3

elastalert/alerters/thehive.py

@@ -72,6 +72,23 @@ def load_tags(self, tag_names: list, match: dict):
 
         return tag_values
 
+    def load_description(self, description_raw, match: dict):
+        missing = self.rule.get('description_missing_value', '<MISSING VALUE>')
+        if 'description_args' in self.rule.get('hive_alert_config'):
+            description_args = self.rule['hive_alert_config'].get('description_args')
+            description_values=[]
+            for arg in description_args:
+                description_values.append(self.lookup_field(match, arg, arg))
+            for i, text_value in enumerate(description_values):
+                if text_value is None:
+                    description_value = self.rule.get(description_args[i])
+                    if description_value:
+                        description_values[i] = description_value
+            description_values = [missing if val is None else val for val in description_values]
+            description_raw = description_raw.format(*description_values)
+            return description_raw
+        else:
+            return description_raw
     def alert(self, matches):
         # Build TheHive alert object, starting with some defaults, updating with any
         # user-specified config
@@ -85,7 +102,7 @@ def alert(self, matches):
             'title': self.create_title(matches),
         }
         alert_config.update(self.rule.get('hive_alert_config', {}))
-
+        alert_config['description']=self.load_description(alert_config['description'], matches[0])
         # Iterate through each match found, populating the alert tags and observables as required
         tags = set()
         artifacts = []