> Node: TheHive 5 Trigger (`thehive_project_trigger`) · Webhook trigger · v1 > Category: Development · Credentials: TheHive 5 (`theHiveProjectApi`) > Updated: 2026-08-16 # TheHive 5 Trigger > Triggers on TheHive 5 events such as alert creation, case updates, and observable changes ## Overview Receives webhook notifications from TheHive 5 (an open-source Security Incident Response Platform) when security-related actions occur. TheHive sends POST requests containing an action and objectType that combine to form event identifiers (e.g. alert_create, case_update). Supports 20 event types across alerts, cases, comments, observables, pages, tasks, and task logs. Includes field-level filtering using dot-notation paths with equal, notEqual, and includes operators. Can output the full request envelope (event, body, headers, query) or just the raw body data. TheHive manages webhook registration externally -- the user configures TheHive to POST to the generated webhook URL. Useful for automating incident response workflows, escalation pipelines, SOC notifications, and threat intelligence processing. **Category:** Development **Tool Name:** `thehive_project_trigger` **Version:** 1 **Appearance:** Icon: `lucide-Shield` | Color: `#f5a623` ## Node Type **Trigger** — webhook (receives incoming HTTP callbacks) ## Input / Output | Direction | Port(s) | |-----------|--------| | Input | None (trigger node) | | Output | `Output` | ## Credentials This tool requires **TheHive 5** credentials. See the [Credentials Guide](https://busybot.net/credentials/the-hive-project-api/) for setup instructions. ### Parameters | Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | Events | `multiOptions` | Yes | `[]` | Which TheHive 5 events to listen for. Select one or more event types, or use * for all events. | | | | | | Options: `*` (any event — wildcard), `alert_create`, `alert_delete`, `alert_update`, `case_create`, `case_delete`, `case_update`, `comment_create`, `comment_delete`, `comment_update`, `observable_create`, `observable_delete`, `observable_update`, `page_create`, `page_delete`, `page_update`, `task_create`, `task_update`, `log_create` (task log created), `log_delete` (task log deleted), `log_update` (task log updated) | | Filters | `fixedCollection` | No | `{}` | Filter any incoming events based on their fields. Filter entries are added under the `values` key; every entry must pass for the event to start the workflow. | | — Field | `string` | No | — | The field to filter on, supports dot notation (e.g. object.severity, object.tlp). | | — Operator | `options` | No | `equal` | The comparison operator to use. | | | | | | Options: `equal`, `notEqual`, `includes` | | — Value | `string` | No | — | The value to compare against. | | Options | `collection` | No | `{}` | Additional options for the trigger. | | — Output Only Data | `boolean` | No | `false` | Whether to output only the raw body data and omit headers, query parameters, and event metadata. | ## Output Data Each accepted notification produces one output item. The shape depends on **Output Only Data**. With **Output Only Data** off (the default), the item is the full request envelope: - `event` — the event identifier, `{objectType}_{action}` in lower case, e.g. `alert_create` - `body` — the complete request body as sent by TheHive 5 - `headers` — the request headers - `query` — the query-string parameters - `_trigger` — always `thehive_project_webhook` - `_timestamp` — ISO 8601 timestamp of when the notification was received - `_webhookEvent` — the same value as `event` With **Output Only Data** on, the raw body fields are placed directly on the item instead of under `body`, alongside `_trigger`, `_timestamp` and `_webhookEvent`. Notifications whose event identifier is outside your **Events** selection, or that fail any configured filter, are acknowledged but do not start the workflow. Requests missing `action` or `objectType` are ignored the same way. Reference the payload downstream by expression, e.g. `{{ $json.body.object.severity }}`. ## Usage Examples - Start a workflow when a new alert is created in TheHive 5 - Trigger incident response automation when a case is updated - Automate observable enrichment when a new observable is added to a case - Send notifications when a task is assigned or updated in TheHive 5 - Escalate high-severity alerts by filtering on the severity field ## Example Configuration Listen to all events: ```json { "type": "thehive_project_trigger", "parameters": { "events": ["*"] } } ``` Specific events only: ```json { "type": "thehive_project_trigger", "parameters": { "events": ["case_create", "case_update", "alert_create"] } } ``` Complete configuration with a severity filter: ```json { "type": "thehive_project_trigger", "parameters": { "events": ["alert_create", "case_create"], "filters": { "values": [ { "field": "object.severity", "operator": "equal", "value": "3" } ] }, "options": { "outputOnlyData": false } } } ``` Advanced filtering with multiple conditions: ```json { "type": "thehive_project_trigger", "parameters": { "events": ["case_update"], "filters": { "values": [ { "field": "object.status", "operator": "notEqual", "value": "Resolved" }, { "field": "object.tags", "operator": "includes", "value": "critical" } ] }, "options": { "outputOnlyData": true } } } ``` Observable analysis pipeline, emitting only the raw body: ```json { "type": "thehive_project_trigger", "parameters": { "events": ["observable_create"], "options": { "outputOnlyData": true } } } ``` ### Trigger Behavior - **Activation:** When the workflow is activated, a webhook endpoint is registered with the service. - **Deactivation:** The webhook is automatically unregistered when the workflow is deactivated. - **Payload:** The incoming webhook payload is parsed and output as workflow items. - **Verification:** Supports signature verification where applicable. ## Tips Entry point that fires when TheHive 5 sends a webhook for configured events. TheHive must be configured to POST notifications to the generated webhook URL. Select which event types to listen for (alerts, cases, observables, tasks, etc.). Optionally add field-level filters using dot-notation paths (e.g. object.severity) with equal, notEqual, or includes operators. Use Output Only Data to receive just the raw body without headers and query metadata. TheHive 5 does not support API-based webhook registration — the webhook must be configured manually in TheHive settings so that it points at this trigger's webhook URL. See TheHive's documentation on webhook notification configuration.