diff --git a/DigitalShadows/api.py b/DigitalShadows/api.py
index f3c5bbf..4b6fa41 100644
--- a/DigitalShadows/api.py
+++ b/DigitalShadows/api.py
@@ -1,10 +1,9 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 
-from __future__ import (absolute_import, division,
-                        print_function, unicode_literals)
-import requests
 
+import requests
+import json
 
 class DigitalShadowsApi():
     """
@@ -21,8 +20,8 @@ def __init__(self, config):
         self.proxies = config['proxies']
         self.verify = config['verify']
         self.headers = {
-            'Content-Type': 'application/vnd.polaris-v22+json',
-            'Accept': 'application/vnd.polaris-v22+json'
+            'Content-Type': 'application/vnd.polaris-v28+json',
+            'Accept': 'application/vnd.polaris-v28+json'
         }
         self.session = requests.Session()
         self.auth = requests.auth.HTTPBasicAuth(username=self.key,
@@ -33,7 +32,7 @@ def getIncidents(self, id, fulltext='false'):
         headers = self.headers
         try:
             return self.session.get(req, headers=headers, auth=self.auth,
-                                    proxies=self.proxies, verify=False)
+                                    proxies=self.proxies, verify=self.verify)
         except requests.exceptions.RequestException as e:
             sys.exit("Error: {}".format(e))
 
@@ -45,3 +44,69 @@ def getIntelIncidents(self, id, fulltext='false'):
                                     proxies=self.proxies, verify=self.verify)
         except requests.exceptions.RequestException as e:
             sys.exit("Error: {}".format(e))
+
+    def find_incident(self, since, property='occurred', direction='DESCENDING', detailed='true', fulltext='false'):
+        req = self.url + '/api/incidents/find'
+        headers = self.headers
+        payload = {'since': since , 'sort.property': property, 'sort.direction':direction, 'detailed': detailed, 'fulltext':fulltext}
+        try:
+            return self.session.get(req, headers=headers, auth=self.auth, proxies=self.proxies, params=payload, verify=self.verify)
+        except requests.exceptions.RequestException as e:
+            sys.exit("Error: {}".format(e))
+
+    def find_intel_incident(self, since, property='verified', direction='ASCENDING'):
+        req = self.url + '/api/intel-incidents/find'
+        headers = self.headers
+
+        payload = json.dumps({
+              "filter": {
+                "severities": [],
+                "tags": [],
+                "tagOperator": "AND",
+                "dateRange": since,
+                "dateRangeField": "occurred",
+                "types": [],
+                "withFeedback": True,
+                "withoutFeedback": True
+              },
+              "sort": {
+                "property": property,
+                "direction": direction
+              },
+              "pagination": {
+                "size": 50,
+                "offset": 0
+              }
+            })
+
+
+        try:
+            return self.session.post(req, headers=headers, auth=self.auth, proxies=self.proxies, data=payload, verify=self.verify)
+        except requests.exceptions.RequestException as e:
+            sys.exit("Error: {}".format(e))
+
+    def get_intel_incident_iocs(self, id):
+        req = "{}/api/intel-incidents/{}/iocs".format(self.url, id)
+        headers = self.headers
+        payload = {
+            "filter": {},
+            "sort": {
+                "property": "value",
+                "direction": "ASCENDING"
+            }
+        }
+        try:
+            return self.session.post(req, headers=headers, auth=self.auth, proxies=self.proxies,
+                                     data=json.dumps(payload), verify=self.verify)
+        except requests.exceptions.RequestException as e:
+                sys.exit("Error: {}".format(e))
+
+
+    def get_intel_incident_thumbnail(self, id):
+        req = "{}/api/thumbnails/{}".format(self.url, id)
+        headers = self.headers
+        try:
+            return self.session.get(req, headers=headers, auth=self.auth, proxies=self.proxies,
+                                 verify=self.verify)
+        except requests.exceptions.RequestException as e:
+                sys.exit("Error: {}".format(e))
diff --git a/README.md b/README.md
index a88d0b7..c319f50 100644
--- a/README.md
+++ b/README.md
@@ -12,8 +12,7 @@ Copy `config.py.template` into `config.py` and fill all connection information n
 
 ## Usage
 
-Identify an interesting incident on DigitalShadows website you want to import un TheHive. Note the incident number and run the following command on the system it sits :
 
 ```
-$ ds2th.py -i <incidentNumber>
+$ ds2th.py -t  <time> --log=<FACILITY>
 ```
diff --git a/config.py.template b/config.py.template
index 6383d9c..a5f2e30 100644
--- a/config.py.template
+++ b/config.py.template
@@ -17,6 +17,7 @@ TheHive = {
   },
     'url':'',
     'username':'',
-    'password':''
+    'password':'',
+    'template':''
 
 }
diff --git a/ds2markdown.py b/ds2markdown.py
index 6aaaa1a..6e14991 100644
--- a/ds2markdown.py
+++ b/ds2markdown.py
@@ -1,16 +1,15 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 
-from __future__ import print_function
-from __future__ import unicode_literals
+
 import json
 
 class ds2markdown():
 
-    def __init__(self, content):
+    def __init__(self, content, thumbnail):
 
-        self.source =""
-        self.taskLog = "{0} {1} {2} {3} {4}".format(
+        self.source = ""
+        self.thdescription = "{0} {1} {2} {3} {4} {5} {6}".format(
             "**Scope:**: {0}\n\n**Type:** {1}\n\n**Occurred:** {2}\n\n**Verified:** {3}\n\n**Modified:** {4}\n\n**Publiched:** {5}\n\n**Identifier:** {6}\n\n**Tags:** {7}\n\n".format(
                     content.get('scope',"None"),
                     content.get('type',"None"),
@@ -20,29 +19,31 @@ def __init__(self, content):
                     content.get('published',"None"),
                     str(content.get('id',"None")),
                     self.tags(content)
-            ),"----\n\n#### Description ####  \n\n{}\n\n".format(content.get('description')),
+            ),"----\n\n#### Summary ####  \n\n{}\n\n".format(content.get('summary')),
+            "----\n\n#### Description ####  \n\n{}\n\n".format(content.get('description')),
             "{}\n\n".format(self.impactDescription(content)),
             "{}\n\n".format(self.mitigation(content)),
-            "{}\n\n".format(self.entitySummary(content))
+            "{}\n\n".format(self.entitySummary(content, thumbnail)),
+            "{}\n\n".format(self.lci(content))
 
         )
 
 
 
-    def entitySummary(self, content):
+    def entitySummary(self, content, thumbnail):
         source = ""
         if 'entitySummary' in content:
             c = content.get('entitySummary',"None")
-            source += self.Summary(c)
+            source += self.information(c, thumbnail)
 
             if 'summaryText' in c:
                 summaryText = c.get('summaryText',"None")
-                source += "#### Source data #### \n\n" + \
+                source += "\n\n----\n\n#### Source data #### \n\n" + \
                         "```\n{}\n```\n\n".format(summaryText)
 
         if 'IpAddressEntitySummary' in content:
             c = content.get('IpAddressEntity',"None")
-            source = self.Summary(c)
+            source = self.information(c, thumbnail)
 
             if 'IpAddressDetails' in c:
                 details = c.get('IpAddressDetails',"None")
@@ -81,7 +82,7 @@ def entitySummary(self, content):
 
         if 'MessageEntitySummary' in content:
             c = content['MessageEntitySummary']
-            source += self.Summary(c)
+            source += self.information(c, thumbnail)
 
             if 'conversationFragment' in c:
                 conv = c.get('conversationFragment')
@@ -103,19 +104,22 @@ def entitySummary(self, content):
         return source
 
 
-    def Summary(self, content):
+    def information(self, content, thumbnail):
         source = ""
         source += "----\n\n" + \
                 "#### Source Information #### \n\n" + \
-                "**Source:** {0}\n\n**Domain:** {1}\n\n**Date:** {2}\n\n**Type:** {3}\n\n".format(
+                "**Source:** {0}\n\n**Domain:** {1}\n\n**Date:** {2}\n\n**Type:** {3}\n\n**Thumbnail**: ![thumbnail][thumb]\n\n[thumb]: {4}\n\n".format(
                         content.get('source',"None"),
                         content.get('domain',"None"),
                         content.get('sourceDate',"None"),
-                        content.get('type',"None")
+                        content.get('type',"None"),
+                        thumbnail.get('thumbnail', "None")
+
                 )
 
         if 'dataBreach' in content:
             dataBreach = content.get('dataBreach')
+
             source += "\n\n#### Databreach target ####  \n\n" + \
                         "**Title:** {0}\n\n**Target domain:** {1}\n\n**Published:** {2}\n\n**Occured:** {3}\n\n**Modified:** {4}\n\n**Id:** {5}\n\n".format(
                                 dataBreach.get('title',"None"),
@@ -136,7 +140,7 @@ def Summary(self, content):
     def impactDescription(self, content):
         impact = ""
         if "impactDescription" in content:
-            impact = "\n\n#### Impact Description #### \n\n{}" .format(
+            impact = "----\n\n#### Impact Description #### \n\n{}" .format(
                     content.get('impactDescription', "None")
             )
 
@@ -145,17 +149,17 @@ def impactDescription(self, content):
     def mitigation(self, content):
         mitigation = ""
         if "mitigation" in content:
-            mitigation = "\n\n#### Mitigation #### \n\n{}".format(content.get('mitigation', "None"))
+            mitigation = "----\n\n#### Mitigation #### \n\n{}".format(content.get('mitigation', "None"))
         return mitigation
 
 
     def lci(self, content):
-        if content["linkedContentIncidents"] not in []:
-            linkedContentIncidents = ""
+        linkedContentIncidents = "----\n\n#### Linked incidents #### \n\n"
+        if content.get("linkedContentIncidents"):
             for lci in content["linkedContentIncidents"]:
                 linkedContentIncidents += "- {} \n\n".format(lci)
         else:
-            linkedContentIncidents = "None"
+            linkedContentIncidents += "None"
         return linkedContentIncidents
 
 
diff --git a/ds2th.py b/ds2th.py
index e03b47d..158b3a4 100755
--- a/ds2th.py
+++ b/ds2th.py
@@ -1,24 +1,46 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 
-from __future__ import print_function
-from __future__ import unicode_literals
-
+import os
 import sys
 import getopt
-import json
 import getpass
-import re
+import datetime
+from io import BytesIO
+import base64
+import logging
+
 
 from DigitalShadows.api import DigitalShadowsApi
 from thehive4py.api import TheHiveApi
-from thehive4py.models import Case,CaseTask,CaseTaskLog
+from thehive4py.models import Alert, AlertArtifact
 
 from config import DigitalShadows, TheHive
 from ds2markdown import ds2markdown
 
 
-def thSeverity(sev):
+def add_tags(tags, content):
+
+    """
+        add tag to tags
+
+        :param tags is list
+        :param content is list
+    """
+    t = tags
+    for newtag in content:
+        t.append("DS:{}".format(newtag))
+    return t
+
+def th_alert_tags(incident):
+    tags = []
+    add_tags(tags, ["id={}".format(incident.get('id')), "type={}".format(incident.get('type'))])
+    for t in incident.get('tags'):
+        add_tags(tags, ["{}={}".format(t.get('type'),t.get('name'))])
+
+    return tags
+
+def th_severity(sev):
 
     """
         convert DigitalShadows severity in TH severity
@@ -35,97 +57,172 @@ def thSeverity(sev):
     }
     return severities[sev]
 
+def th_dataType(type):
+    """
+    convert DigitalShadows IOC type to TH dataType
+    :param type: str
+    :return: str
+    """
+    types = {
+        'IP':'ip',
+        'HOST': 'domain',
+        'URL':'url',
+        'SHA256':'hash',
+        'SHA1':'hash',
+        'MD5':'hash',
+        'FILENAME':'filename',
+        'FILEPATH':'filename',
+        'EMAIL': 'mail'
+    }
 
+    if type in types:
+        return types[type]
+    else:
+        return "other"
 
-def convertDs2ThCase(content):
-
+def add_alert_artefact(artefacts, dataType, data, tags, tlp):
     """
-        convert Digital Shadows incident in a TheHive Case
 
-        :content dict object
+    :param artefacts: array
+    :param dataType: string
+    :param data: string
+    :param tags: array
+    :param tlp: int
+    :return: array
     """
 
-    tasks = []
-    tags = ['src:DigitalShadows']
-    for tag in content['tags']:
-        tags.append('DS:'+tag['type']+'='+tag['name'])
+    return artefacts.append(AlertArtifact(tags=tags,
+                             dataType=dataType,
+                             data=data,
+                             message="From DigitalShadows",
+                             tlp=tlp)
+                            )
 
 
-    if ('summary' in content) and (len(content['summary']) > 1):
-        description = content.get('summary')
-    else:
-        description = content.get('description', {"-"})
-    case = Case(
-            title="[DigitalShadows] #{} ".format(content['id']) + content['title'],
-            tlp=2,
-            severity=thSeverity(content['severity']),
-            flag=False,
-            tags=tags,
-            description = description)
-    return case
+def build_observables(observables):
+    artefacts = []
+    if observables.get('total', 0) > 0:
+
+        for ioc in observables.get('content'):
+            a = AlertArtifact(
+                data=ioc.get('value'),
+                dataType=th_dataType(ioc.get('type')),
+                message="Observable from DigitalShadows. Source: {}".format(ioc.get('source')),
+                tlp=2,
+                tags=["src:DigitalShadows"]
+            )
+            artefacts.append(a)
 
+    return artefacts
 
-def caseAddTask(thapi, caseId, content):
 
+
+def build_alert(incident, observables, thumbnail):
     """
-        Add task in existing case with its log
-        Return the task "Imported from DigitalShadows" in the TheHive
+    Convert DigitalShadows alert into a TheHive Alert
 
-        : caseId       Id of the case created by the import program
-        : content      DigitalShadows response.content (JSON)
+    :param incident: dict
+    :param observables: dict
+    :param thumbnail: str
+    :return: Alert object
     """
-    task = CaseTask(
-                title = "Incident imported from DigitalShadows",
-                description = "Incident from DigitalShadows"
-                )
 
-    m = ds2markdown(content).taskLog
-    log = CaseTaskLog(message = m)
-    thresponse = thapi.create_case_task(caseId, task)
-    r = thresponse.json()
-    thresponse = thapi.create_task_log(r['id'], log)
+    return Alert(title="{}".format(incident.get('title')),
+                 tlp=2,
+                 severity=th_severity(incident.get('severity')),
+                 description=ds2markdown(incident, thumbnail).thdescription,
+                 type=incident.get('type'),
+                 tags=th_alert_tags(incident),
+                 caseTemplate=TheHive['template'],
+                 source="DigitalShadows",
+                 sourceRef=str(incident.get('id')),
+                 artifacts=build_observables(observables)
+                 )
+
+def get_incidents(dsapi, thapi, since):
+    s = (datetime.datetime.now() - datetime.timedelta(minutes=int(since))).isoformat() + 'Z'
+    response = DigitalShadowsApi.find_incident(dsapi, s).json()
+
+
+    for i in response.get('content'):
+        logging.debug('Incident number: {}'.format(i.get('id')))
+        alert = build_alert(i, {}, {"thumbnail":""})
+        thapi.create_alert(alert)
 
-def import2th(thapi, response):
 
+def get_intel_incidents(dsapi, thapi, since):
     """
-        Convert DigitalShadows response and import it in TheHive
-        Call convertDs2ThCase
-        Call CaseAddTask
-        Return the case fully created in TheHive
 
-        :response  dict Response from DigitalShadows
+    :param dsapi: request to DigitalShadows
+    :param thapi: reauest to TheHive
+    :param since: int, number of minutes, period of time
+    :return:
     """
+    s = "{}/{}".format((datetime.datetime.now() - datetime.timedelta(minutes=int(since))).isoformat(),
+                       datetime.datetime.now().isoformat())
+    response = DigitalShadowsApi.find_intel_incident(dsapi, s).json()
+
+    for i in response.get('content'):
+        logging.debug('Intel-incident number: {}'.format(i.get('id')))
+        iocs = DigitalShadowsApi.get_intel_incident_iocs(dsapi, i.get('id')).json()
+
+        if i.get('entitySummary') and i.get('entitySummary').get('screenshotThumbnailId'):
+            # i.get('entitySummary')
+            # i.get('entitySummary').get('screenshotThumbnailId')
+            thumbnail = get_thumbnails(dsapi, i.get('entitySummary').get('screenshotThumbnailId'))
+        else:
+            thumbnail = {'thumbnail':''}
+        alert = build_alert(i, iocs, thumbnail)
 
-    case = convertDs2ThCase(response)
-    thresponse = thapi.create_case(case)
-    r = thresponse.json()
-    caseAddTask(thapi, r['id'], response)
+        thapi.create_alert(alert)
 
+def get_thumbnails(dsapi, thumbnail_id):
+    """
+    Get Intel Incident screenshot thumbnail
+    :param dsapi:
+    :param thumbnail_id:
+    :return: dict {base64:}
+    """
+    response = DigitalShadowsApi.get_intel_incident_thumbnail(dsapi,thumbnail_id)
+    if response.status_code == 200:
+        with BytesIO(response.content) as bytes:
+            encoded = base64.b64encode(bytes.read())
+            b64_thumbnail = encoded.decode()
+
+        return {"thumbnail":"data:{};base64,{}".format(response.headers['Content-Type'], b64_thumbnail)}
+    else:
+        return {thumbnail: ""}
 
 def run(argv):
 
     """
-        Download Digital SHadows incident and create a new Case in TheHive
+        Download DigitalShadows incident and create a new Case in TheHive
 
         :argv incident number
     """
 
 
     # get options
-    incidentId = ''
     try:
-        opts, args = getopt.getopt(argv, 'hi:',["incident="])
+        opts, args = getopt.getopt(argv, 'lht:',["log=","time="])
     except getopt.GetoptError:
-        print(__file__ + " -i <incidentId>")
+        print(__file__ + " -t <time>")
         sys.exit(2)
+
+    for opt, arg in opts:
+        if opt in ('-l', '--log'):
+            logging.basicConfig(filename='{}/ds2th.log'.format(os.path.dirname(os.path.realpath(__file__))),
+                                level=arg, format='%(asctime)s %(levelname)s %(message)s')
+            logging.debug('logging enabled')
+
     for opt,arg in opts:
         if opt == '-h':
-            print(__file__ + " -i <incidentNumber>")
+            print(__file__ + " -t <time in minutes>")
             sys.exit()
-        elif opt in ('-i','--incident'):
-            incidentId = arg
-
+        elif opt in ('-t','--time'):
+            time = arg
 
+    logging.info('ds2th.py started')
     # get username and password for TheHive
     if not TheHive['username'] and not TheHive['password']:
         TheHive['username'] = input("TheHive Username [%s]: " % getpass.getuser())
@@ -135,41 +232,11 @@ def run(argv):
                         TheHive['password'], TheHive['proxies'])
 
 
-    # Create DigitalShadows session and get incident
+    # Create DigitalShadows session and get incidents
 
     dsapi = DigitalShadowsApi(DigitalShadows)
-    # response = dsapi.getIntelIncidents(incidentId, fulltext='true')
-    #
-    # if(response.status_code == 200):
-    #     import2th(thapi, response.json())
-    # elif(response.status_code == 404):
-    #     response = dsapi.getIncidents(incidentId, fulltext='true')
-    #     if (response.status_code == 200):
-    #         import2th(thapi, response.json())
-    #     else:
-    #         print('ko: {}/{}'.format(response.status_code, response.text))
-    #         sys.exit(0)
-    # else:
-    #     print('ko: {}/{}'.format(response.status_code, response.text))
-    #     sys.exit(0)
-
-
-    r = re.compile('S.*')
-    if r.match(incidentId):
-        i = incidentId[1:]
-        response = dsapi.getIntelIncidents(i, fulltext='true')
-        if (response.status_code == 200):
-            import2th(thapi, response.json())
-        else:
-            print('ko: {}/{}'.format(response.status_code, response.text))
-            sys.exit(0)
-    else:
-        response = dsapi.getIncidents(incidentId)
-        if(response.status_code == 200):
-            import2th(thapi, response.json())
-        else:
-            print('ko: {}/{}'.format(response.status_code, response.text))
-            sys.exit(0)
+    get_incidents(dsapi,thapi,time)
+    get_intel_incidents(dsapi, thapi, time)
 
 
 
@@ -177,5 +244,5 @@ def run(argv):
     if len(sys.argv[1:]) > 0:
         run(sys.argv[1:])
     else:
-        print(__file__ + " -i <incidentId>")
+        print(__file__ + " -t <duration>")
         sys.exit(2)
diff --git a/requirements.txt b/requirements.txt
index e69de29..f229360 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -0,0 +1 @@
+requests
diff --git a/test.py b/test.py
new file mode 100755
index 0000000..21b5b75
--- /dev/null
+++ b/test.py
@@ -0,0 +1,173 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+from __future__ import print_function
+from __future__ import unicode_literals
+
+import sys
+import getopt
+import json
+import getpass
+import re
+import datetime
+
+from DigitalShadows.api import DigitalShadowsApi
+# from thehive4py.api import TheHiveApi
+# from thehive4py.models import Case,CaseTask,CaseTaskLog
+
+from config import DigitalShadows, TheHive
+from ds2markdown import ds2markdown
+
+#
+# def thSeverity(sev):
+#
+#     """
+#         convert DigitalShadows severity in TH severity
+#
+#         :sev string
+#     """
+#
+#     severities = {
+#         'NONE':1,
+#         'VERY_LOW':1,
+#         'LOW':1,
+#         'MEDIUM':2,
+#         'HIGH':3
+#     }
+#     return severities[sev]
+#
+#
+#
+# def convertDs2ThCase(content):
+#
+#     """
+#         convert Digital Shadows incident in a TheHive Case
+#
+#         :content dict object
+#     """
+#
+#     tasks = []
+#     tags = ['src:DigitalShadows']
+#     for tag in content['tags']:
+#         tags.append('DS:'+tag['type']+'='+tag['name'])
+#
+#
+#     if ('summary' in content) and (len(content['summary']) > 1):
+#         description = content.get('summary')
+#     else:
+#         description = content.get('description', {"-"})
+#     case = Case(
+#             title="[DigitalShadows] #{} ".format(content['id']) + content['title'],
+#             tlp=2,
+#             severity=thSeverity(content['severity']),
+#             flag=False,
+#             tags=tags,
+#             description = description)
+#     return case
+#
+#
+# def caseAddTask(thapi, caseId, content):
+#
+#     """
+#         Add task in existing case with its log
+#         Return the task "Imported from DigitalShadows" in the TheHive
+#
+#         : caseId       Id of the case created by the import program
+#         : content      DigitalShadows response.content (JSON)
+#     """
+#     task = CaseTask(
+#                 title = "Incident imported from DigitalShadows",
+#                 description = "Incident from DigitalShadows"
+#                 )
+#
+#     m = ds2markdown(content).taskLog
+#     log = CaseTaskLog(message = m)
+#     thresponse = thapi.create_case_task(caseId, task)
+#     r = thresponse.json()
+#     thresponse = thapi.create_task_log(r['id'], log)
+#
+# def import2th(thapi, response):
+#
+#     """
+#         Convert DigitalShadows response and import it in TheHive
+#         Call convertDs2ThCase
+#         Call CaseAddTask
+#         Return the case fully created in TheHive
+#
+#         :response  dict Response from DigitalShadows
+#     """
+#
+#     case = convertDs2ThCase(response)
+#     thresponse = thapi.create_case(case)
+#     r = thresponse.json()
+#     caseAddTask(thapi, r['id'], response)
+#
+
+def run():
+
+    """
+        Download Digital SHadows incident and create a new Case in TheHive
+
+        :argv incident number
+    """
+
+
+    # get options
+    # incidentId = ''
+    # try:
+    #     opts, args = getopt.getopt(argv, 'hi:',["incident="])
+    # except getopt.GetoptError:
+    #     print(__file__ + " -i <incidentId>")
+    #     sys.exit(2)
+    # for opt,arg in opts:
+    #     if opt == '-h':
+    #         print(__file__ + " -i <incidentNumber>")
+    #         sys.exit()
+    #     elif opt in ('-i','--incident'):
+    #         incidentId = arg
+
+
+    # get username and password for TheHive
+    # if not TheHive['username'] and not TheHive['password']:
+    #     TheHive['username'] = input("TheHive Username [%s]: " % getpass.getuser())
+    #     TheHive['password'] = getpass.getpass("TheHive Password: ")
+    #
+    # thapi = TheHiveApi(TheHive['url'],TheHive['username'],
+    #                     TheHive['password'], TheHive['proxies'])
+    #
+
+    # Create DigitalShadows session and get incident
+
+    dsapi = DigitalShadowsApi(DigitalShadows)
+
+
+    # since1 = (datetime.datetime.now() - datetime.timedelta(minutes=60)).isoformat() + 'Z'
+    # DigitalShadowsApi.find_incident(dsapi, since1)
+    # since2 = "{}/{}".format((datetime.datetime.now() - datetime.timedelta(minutes=600)).isoformat(),
+    #                         datetime.datetime.now().isoformat())
+    # DigitalShadowsApi.find_intel_incident(dsapi, since2)
+    DigitalShadowsApi.get_intel_incident_iocs(dsapi, 1844578)
+
+    #
+    # r = re.compile('S.*')
+    # if r.match(incidentId):
+    #     i = incidentId[1:]
+    #     response = dsapi.getIntelIncidents(i, fulltext='true')
+    #     if (response.status_code == 200):
+    #         import2th(thapi, response.json())
+    #         create_th_alert(thapi, response.json())
+    #     else:
+    #         print('ko: {}/{}'.format(response.status_code, response.text))
+    #         sys.exit(0)
+    # else:
+    #     response = dsapi.getIncidents(incidentId)
+    #     if(response.status_code == 200):
+    #         import2th(thapi, response.json())
+    #     else:
+    #         print('ko: {}/{}'.format(response.status_code, response.text))
+    #         sys.exit(0)
+
+
+
+if __name__ == '__main__':
+    run()
\ No newline at end of file