TheHive 5 Trigger

Triggers on TheHive 5 events such as alert creation, case updates, and observable changes

Overview

Receives webhook notifications from TheHive 5 (an open-source Security Incident Response Platform) when security-related actions occur. TheHive sends POST requests containing an action and objectType that combine to form event identifiers (e.g. alert_create, case_update). Supports 20 event types across alerts, cases, comments, observables, pages, tasks, and task logs. Includes field-level filtering using dot-notation paths with equal, notEqual, and includes operators. Can output the full request envelope (event, body, headers, query) or just the raw body data. TheHive manages webhook registration externally — the user configures TheHive to POST to the generated webhook URL. Useful for automating incident response workflows, escalation pipelines, SOC notifications, and threat intelligence processing.

Category: Development
Tool Name: thehive_project_trigger
Version: 1

Appearance: Icon: lucide-Shield | Color: #f5a623

Node Type

Trigger — webhook (receives incoming HTTP callbacks)

Input / Output

Direction	Port(s)
Input	None (trigger node)
Output	Output

Credentials

This tool requires TheHive 5 credentials. See the Credentials Guide for setup instructions.

Parameters

Parameter	Type	Required	Default	Description
Events	multiOptions	Yes	[]	Which TheHive 5 events to listen for. Select one or more event types, or use * for all events.
				Options: * (any event — wildcard), alert_create, alert_delete, alert_update, case_create, case_delete, case_update, comment_create, comment_delete, comment_update, observable_create, observable_delete, observable_update, page_create, page_delete, page_update, task_create, task_update, log_create (task log created), log_delete (task log deleted), log_update (task log updated)
Filters	fixedCollection	No	{}	Filter any incoming events based on their fields. Filter entries are added under the values key; every entry must pass for the event to start the workflow.
— Field	string	No	—	The field to filter on, supports dot notation (e.g. object.severity, object.tlp).
— Operator	options	No	equal	The comparison operator to use.
				Options: equal, notEqual, includes
— Value	string	No	—	The value to compare against.
Options	collection	No	{}	Additional options for the trigger.
— Output Only Data	boolean	No	false	Whether to output only the raw body data and omit headers, query parameters, and event metadata.

Output Data

Each accepted notification produces one output item. The shape depends on Output Only Data.

With Output Only Data off (the default), the item is the full request envelope:

• event — the event identifier, {objectType}_{action} in lower case, e.g. alert_create
• body — the complete request body as sent by TheHive 5
• headers — the request headers
• query — the query-string parameters
• _trigger — always thehive_project_webhook
• _timestamp — ISO 8601 timestamp of when the notification was received
• _webhookEvent — the same value as event

With Output Only Data on, the raw body fields are placed directly on the item instead of under body, alongside _trigger, _timestamp and _webhookEvent.

Notifications whose event identifier is outside your Events selection, or that fail any configured filter, are acknowledged but do not start the workflow. Requests missing action or objectType are ignored the same way.

Reference the payload downstream by expression, e.g. {{ $json.body.object.severity }}.

Usage Examples

• Start a workflow when a new alert is created in TheHive 5
• Trigger incident response automation when a case is updated
• Automate observable enrichment when a new observable is added to a case
• Send notifications when a task is assigned or updated in TheHive 5
• Escalate high-severity alerts by filtering on the severity field

Example Configuration

Listen to all events:

{
  "type": "thehive_project_trigger",
  "parameters": {
    "events": ["*"]
  }
}

Specific events only:

{
  "type": "thehive_project_trigger",
  "parameters": {
    "events": ["case_create", "case_update", "alert_create"]
  }
}

Complete configuration with a severity filter:

{
  "type": "thehive_project_trigger",
  "parameters": {
    "events": ["alert_create", "case_create"],
    "filters": {
      "values": [
        {
          "field": "object.severity",
          "operator": "equal",
          "value": "3"
        }
      ]
    },
    "options": {
      "outputOnlyData": false
    }
  }
}

Advanced filtering with multiple conditions:

{
  "type": "thehive_project_trigger",
  "parameters": {
    "events": ["case_update"],
    "filters": {
      "values": [
        {
          "field": "object.status",
          "operator": "notEqual",
          "value": "Resolved"
        },
        {
          "field": "object.tags",
          "operator": "includes",
          "value": "critical"
        }
      ]
    },
    "options": {
      "outputOnlyData": true
    }
  }
}

Observable analysis pipeline, emitting only the raw body:

{
  "type": "thehive_project_trigger",
  "parameters": {
    "events": ["observable_create"],
    "options": {
      "outputOnlyData": true
    }
  }
}

Trigger Behavior

• Activation: When the workflow is activated, a webhook endpoint is registered with the service.
• Deactivation: The webhook is automatically unregistered when the workflow is deactivated.
• Payload: The incoming webhook payload is parsed and output as workflow items.
• Verification: Supports signature verification where applicable.

Tips

Entry point that fires when TheHive 5 sends a webhook for configured events. TheHive must be configured to POST notifications to the generated webhook URL. Select which event types to listen for (alerts, cases, observables, tasks, etc.). Optionally add field-level filters using dot-notation paths (e.g. object.severity) with equal, notEqual, or includes operators. Use Output Only Data to receive just the raw body without headers and query metadata.

TheHive 5 does not support API-based webhook registration — the webhook must be configured manually in TheHive settings so that it points at this trigger’s webhook URL. See TheHive’s documentation on webhook notification configuration.