TheHive 5 trigger

Overview

Receives webhook notifications from TheHive 5 (an open-source Security Incident Response Platform) when security-related actions occur. TheHive sends POST requests containing an action and objectType that combine to form event identifiers (e.g. alert_create, case_update). Supports 20 event types across alerts, cases, comments, observables, pages, tasks, and task logs. Includes field-level filtering using dot-notation paths with equal, notEqual, and includes operators. Can output the full request envelope (event, body, headers, query) or just the raw body data. TheHive manages webhook registration externally — the user configures TheHive to POST to the generated webhook URL. Useful for automating incident response workflows, escalation pipelines, SOC notifications, and threat intelligence processing.

Node Type

Trigger — webhook (receives incoming HTTP callbacks)

Input / Output

Direction	Port(s)
Input	None (trigger node)
Output	Output

Credentials

This tool requires TheHive 5 credentials. See the Credentials Guide for setup instructions.

Parameters

Parameter	Type	Required	Default	Description
Events	multiOptions	Yes	[]	Which TheHive 5 events to listen for. Select one or more event types, or use * for all events.
				Options: * (any event — wildcard), alert_create, alert_delete, alert_update, case_create, case_delete, case_update, comment_create, comment_delete, comment_update, observable_create, observable_delete, observable_update, page_create, page_delete, page_update, task_create, task_update, log_create (task log created), log_delete (task log deleted), log_update (task log updated)
Filters	fixedCollection	No	{}	Filter any incoming events based on their fields. Filter entries are added under the values key; every entry must pass for the event to start the workflow.
— Field	string	No	—	The field to filter on, supports dot notation (e.g. object.severity, object.tlp).
— Operator	options	No	equal	The comparison operator to use.
				Options: equal, notEqual, includes
— Value	string	No	—	The value to compare against.
Options	collection	No	{}	Additional options for the trigger.
— Output Only Data	boolean	No	false	Whether to output only the raw body data and omit headers, query parameters, and event metadata.

Output Data

Each accepted notification produces one output item. The shape depends on Output Only Data.

With Output Only Data off (the default), the item is the full request envelope:

• event — the event identifier, {objectType}_{action} in lower case, e.g. alert_create
• body — the complete request body as sent by TheHive 5
• headers — the request headers
• query — the query-string parameters
• _trigger — always thehive_project_webhook
• _timestamp — ISO 8601 timestamp of when the notification was received
• _webhookEvent — the same value as event

With Output Only Data on, the raw body fields are placed directly on the item instead of under body, alongside _trigger, _timestamp and _webhookEvent.

Notifications whose event identifier is outside your Events selection, or that fail any configured filter, are acknowledged but do not start the workflow. Requests missing action or objectType are ignored the same way.

Reference the payload downstream by expression, e.g. {{ $json.body.object.severity }}.

Example Configuration

Listen to all events:

{
  "type": "thehive_project_trigger",
  "parameters": {
    "events": ["*"]
  }
}

Specific events only:

{
  "type": "thehive_project_trigger",
  "parameters": {
    "events": ["case_create", "case_update", "alert_create"]
  }
}

Complete configuration with a severity filter:

{
  "type": "thehive_project_trigger",
  "parameters": {
    "events": ["alert_create", "case_create"],
    "filters": {
      "values": [
        {
          "field": "object.severity",
          "operator": "equal",
          "value": "3"
        }
      ]
    },
    "options": {
      "outputOnlyData": false
    }
  }
}

Advanced filtering with multiple conditions:

{
  "type": "thehive_project_trigger",
  "parameters": {
    "events": ["case_update"],
    "filters": {
      "values": [
        {
          "field": "object.status",
          "operator": "notEqual",
          "value": "Resolved"
        },
        {
          "field": "object.tags",
          "operator": "includes",
          "value": "critical"
        }
      ]
    },
    "options": {
      "outputOnlyData": true
    }
  }
}

Observable analysis pipeline, emitting only the raw body:

{
  "type": "thehive_project_trigger",
  "parameters": {
    "events": ["observable_create"],
    "options": {
      "outputOnlyData": true
    }
  }
}

Trigger Behavior

• Activation: When the workflow is activated, a webhook endpoint is registered with the service.
• Deactivation: The webhook is automatically unregistered when the workflow is deactivated.
• Payload: The incoming webhook payload is parsed and output as workflow items.
• Verification: Supports signature verification where applicable.

Tips

This tool triggers workflows when TheHive 5 events occur via webhooks. It is the right tool when you need to automate responses to security incidents or threat intelligence by listening for specific actions within TheHive 5. It produces the full request envelope or just the raw body data from the incoming webhook.

TheHive 5 does not support API-based webhook registration — the webhook must be configured manually in TheHive settings so that it points at this trigger’s webhook URL. See TheHive’s documentation on webhook notification configuration.