<!-- BusyBot node reference — https://busybot.net/tools/thehive-project/ -->

> Node: TheHive 5 (`thehive_project`) · Action (binary) · v1
> Category: Productivity · Credentials: TheHive 5 API (`theHiveProjectApi`)
> Updated: 2026-08-16

# TheHive 5

> Manage security incidents in TheHive 5 with binary attachment support

## Overview

TheHive 5 is an open-source Security Incident Response Platform. This tool provides full CRUD for alerts, cases, tasks, task logs, observables, comments, and pages. It supports binary data operations: downloading case attachments (Pattern A), uploading case/log attachments and file-type observables (Pattern B), and executing arbitrary TheHive Query DSL queries. Integrates with Cortex for automated analysis and response via analyzers and responders.

**Category:** Productivity  
**Tool Name:** `thehive_project`  
**Version:** 1

**Appearance:** Icon: `lucide-Shield` | Color: `#F8A51C`

## Node Type

**Action (Binary)** — handles file/binary data operations

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **TheHive 5 API** credentials.
See the [Credentials Guide](https://busybot.net/credentials/the-hive-project-api/) for setup instructions.

### Resources

| Resource | Value |
|----------|-------|
| Alert | `alert` |
| Case | `case` |
| Comment | `comment` |
| Observable | `observable` |
| Page | `page` |
| Query | `query` |
| Task | `task` |
| Task Log | `log` |

### Operations

**Alert** (`alert`)

| Operation | Value | Description |
|-----------|-------|-------------|
| Create | `create` | Create an alert. |
| Delete | `deleteAlert` | Delete an alert. |
| Execute Responder | `executeResponder` | Run a Cortex responder against an alert. |
| Get | `get` | Retrieve a single alert. |
| Merge Into Case | `merge` | Merge an alert into an existing case. |
| Promote to Case | `promote` | Turn an alert into a new case. |
| Search | `search` | Search alerts. |
| Update | `update` | Update an alert. |
| Update Status | `status` | Set an alert's status. |

**Case** (`case`)

| Operation | Value | Description |
|-----------|-------|-------------|
| Add Attachment | `addAttachment` | Upload one or more files to a case. |
| Create | `create` | Create a case. |
| Delete Attachment | `deleteAttachment` | Remove an attachment from a case. |
| Delete Case | `deleteCase` | Delete a case. |
| Execute Responder | `executeResponder` | Run a Cortex responder against a case. |
| Get | `get` | Retrieve a single case. |
| Get Attachment | `getAttachment` | Download a case attachment as binary data. |
| Get Timeline | `getTimeline` | Retrieve a case's timeline. |
| Search | `search` | Search cases. |
| Update | `update` | Update a case. |

**Comment** (`comment`)

| Operation | Value | Description |
|-----------|-------|-------------|
| Create | `add` | Add a comment to an alert or a case. |
| Delete | `deleteComment` | Delete a comment. |
| Search | `search` | Search comments. |
| Update | `update` | Change a comment's message. |

**Observable** (`observable`)

| Operation | Value | Description |
|-----------|-------|-------------|
| Create | `create` | Create an observable in a case or an alert. |
| Delete | `deleteObservable` | Delete an observable. |
| Execute Analyzer | `executeAnalyzer` | Run one or more Cortex analyzers against an observable. |
| Execute Responder | `executeResponder` | Run a Cortex responder against an observable. |
| Get | `get` | Retrieve a single observable. |
| Search | `search` | Search observables. |
| Update | `update` | Update an observable. |

**Page** (`page`)

| Operation | Value | Description |
|-----------|-------|-------------|
| Create | `create` | Create a page in a case or in the knowledge base. |
| Delete | `deletePage` | Delete a page. |
| Search | `search` | Search pages. |
| Update | `update` | Update a page. |

**Query** (`query`)

| Operation | Value | Description |
|-----------|-------|-------------|
| Execute Query | `executeQuery` | Run a TheHive Query DSL query. |

**Task** (`task`)

| Operation | Value | Description |
|-----------|-------|-------------|
| Create | `create` | Create a task under a case. |
| Delete | `deleteTask` | Delete a task. |
| Execute Responder | `executeResponder` | Run a Cortex responder against a task. |
| Get | `get` | Retrieve a single task. |
| Search | `search` | Search tasks. |
| Update | `update` | Update a task. |

**Task Log** (`log`)

| Operation | Value | Description |
|-----------|-------|-------------|
| Add Attachment | `addAttachment` | Upload one or more files to an existing log entry. |
| Create | `create` | Create a log entry under a task, optionally with attachments. |
| Delete | `deleteLog` | Delete a log entry. |
| Delete Attachment | `deleteAttachment` | Remove an attachment from a log entry. |
| Execute Responder | `executeResponder` | Run a Cortex responder against a log entry. |
| Get | `get` | Retrieve a single log entry. |
| Search | `search` | Search log entries. |

### Parameters

String, number and JSON fields are resolved per input item, so they accept `{{ $json.field }}` expressions.

#### Alert: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert Fields (JSON) | `json` | Yes | `{}` | JSON object with alert fields: title, description, type, source, sourceRef, severity (1-4), tlp (0-3), pap (0-3), tags (comma-separated), date, summary, status, follow, flag, externalLink, caseTemplate, lastSyncDate. |
| Observables (JSON Array) | `json` | No | `[]` | JSON array of observables to attach to the alert. Each: { dataType, data, message, tags }. For file-type, set dataType="file" and provide binaryProperty name in "binaryProperty" field. |

#### Alert: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | ID of the alert (e.g. ~123456). |

#### Alert: Execute Responder

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | ID of the alert (e.g. ~123456). |
| Responder ID | `string` | Yes | — | ID of the Cortex responder to execute. |

#### Alert: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | ID of the alert (e.g. ~123456). |

#### Alert: Merge Into Case

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | ID of the alert (e.g. ~123456). |
| Case ID (Merge Target) | `string` | Yes | — | ID of the case to merge the alert into. |

#### Alert: Promote to Case

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | ID of the alert (e.g. ~123456). |
| Case Template | `string` | No | — | Optional case template name to use when promoting alert to case. |

#### Alert: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters (JSON Array) | `json` | No | `[]` | JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values). |
| Sort (JSON Array) | `json` | No | `[]` | JSON array of sort objects: [{ field, direction }]. Direction: "asc" or "desc". |
| Return Count | `boolean` | No | `false` | Whether to return only the count of matching results. |
| Extra Data | `string` | No | — | Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats). |

#### Alert: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | ID of the alert (e.g. ~123456). |
| Update Fields (JSON) (`updateFields`) | `json` | No | `{}` | JSON object with fields to update. Supports addTags, removeTags for incremental tag management. |

#### Alert: Update Status

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | ID of the alert (e.g. ~123456). |
| Status | `options` | No | `New` | New status for the alert. |
| | | | | Options: `New`, `Updated`, `Ignored`, `Imported` |

#### Case: Add Attachment

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case (e.g. ~123456). |
| Binary Property | `string` | No | `data` | Name of the binary property to read from (upload) or write to (download) on the item. Names are case-sensitive — see the upstream node's Binary Data panel for the exact names to use. |
| Attachment Binary Properties (Comma-Separated) (`attachmentFields`) | `string` | No | `data` | Comma-separated list of binary property names on the input item to upload as attachments. |
| Rename Files | `boolean` | No | `false` | Whether to rename the file if one with the same name already exists. |

#### Case: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case Fields (JSON) | `json` | Yes | `{}` | JSON object with case fields: title, description, severity (1-4), startDate, tags, tlp (0-3), pap (0-3), endDate, flag, summary, status, assignee, caseTemplate, tasks, sharingParameters, impactStatus, taskRule, observableRule. |

#### Case: Delete Attachment

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case (e.g. ~123456). |
| Attachment ID (`attachmentId`) | `string` | Yes | — | ID of the attachment to download or delete. |

#### Case: Delete Case

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case (e.g. ~123456). |

#### Case: Execute Responder

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case (e.g. ~123456). |
| Responder ID | `string` | Yes | — | ID of the Cortex responder to execute. |

#### Case: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case (e.g. ~123456). |

#### Case: Get Attachment

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case (e.g. ~123456). |
| Attachment ID (`attachmentId`) | `string` | Yes | — | ID of the attachment to download or delete. |
| Binary Property | `string` | No | `data` | Name of the binary property to read from (upload) or write to (download) on the item. Names are case-sensitive — see the upstream node's Binary Data panel for the exact names to use. |
| File Name | `string` | No | — | Rename the file when downloading. Leave empty to use the original name. |

#### Case: Get Timeline

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case (e.g. ~123456). |

#### Case: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters (JSON Array) | `json` | No | `[]` | JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values). |
| Sort (JSON Array) | `json` | No | `[]` | JSON array of sort objects: [{ field, direction }]. Direction: "asc" or "desc". |
| Return Count | `boolean` | No | `false` | Whether to return only the count of matching results. |
| Extra Data | `string` | No | — | Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats). |

#### Case: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID | `string` | Yes | — | ID of the case (e.g. ~123456). |
| Update Fields (JSON) (`updateFields`) | `json` | No | `{}` | JSON object with fields to update on the case. |

#### Comment: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Add To | `options` | No | `case` | Whether to add the comment to an alert or a case. |
| | | | | Options: `alert`, `case` |
| Parent ID (`parentId`) | `string` | Yes | — | ID of the alert or case to add the comment to. |
| Message | `string` | Yes | — | The comment message text. |

#### Comment: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Comment ID | `string` | Yes | — | ID of the comment. |

#### Comment: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters (JSON Array) | `json` | No | `[]` | JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values). |
| Sort (JSON Array) | `json` | No | `[]` | JSON array of sort objects: [{ field, direction }]. Direction: "asc" or "desc". |
| Return Count | `boolean` | No | `false` | Whether to return only the count of matching results. |
| Extra Data | `string` | No | — | Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats). |

#### Comment: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Comment ID | `string` | Yes | — | ID of the comment. |
| Message | `string` | Yes | — | The comment message text. |

#### Observable: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Create In (`createIn`) | `options` | No | `case` | Whether to create the observable in a case or an alert. |
| | | | | Options: `case`, `alert` |
| Parent ID (`parentId`) | `string` | Yes | — | ID of the parent case or alert. |
| Data Type (`dataType`) | `string` | Yes | `file` | Observable data type: file, ip, domain, url, hash, filename, mail, registry, etc. Use "file" for binary upload. |
| Data | `string` | No | — | Observable value (e.g., IP address, domain, hash). Not used when dataType is "file". |
| Observable Fields (JSON) | `json` | No | `{}` | JSON object with additional observable fields: message, tags, tlp (0-3), pap (0-3), ioc, sighted, sightedAt, ignoreSimilarity, isZip, zipPassword. |
| Attachment Binary Properties (Comma-Separated) (`attachmentFields`) | `string` | No | `data` | Comma-separated list of binary property names on the input item to upload as file-type observable attachments. |

#### Observable: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Observable ID | `string` | Yes | — | ID of the observable. |

#### Observable: Execute Analyzer

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Observable ID | `string` | Yes | — | ID of the observable. |
| Analyzer IDs (Comma-Separated) | `string` | Yes | — | Comma-separated list of analyzer IDs in format "analyzerId::cortexId". |
| Data Type (`dataType`) | `string` | No | — | Observable data type (required for analyzer execution). |

#### Observable: Execute Responder

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Observable ID | `string` | Yes | — | ID of the observable. |
| Responder ID | `string` | Yes | — | ID of the Cortex responder to execute. |

#### Observable: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Observable ID | `string` | Yes | — | ID of the observable. |

#### Observable: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters (JSON Array) | `json` | No | `[]` | JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values). |
| Sort (JSON Array) | `json` | No | `[]` | JSON array of sort objects: [{ field, direction }]. Direction: "asc" or "desc". |
| Return Count | `boolean` | No | `false` | Whether to return only the count of matching results. |
| Extra Data | `string` | No | — | Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats). |

#### Observable: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Observable ID | `string` | Yes | — | ID of the observable. |
| Update Fields (JSON) (`updateFields`) | `json` | No | `{}` | JSON object with fields to update on the observable. |

#### Page: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Create In (`pageLocation`) | `options` | No | `case` | Whether to create the page inside a case or in the knowledge base. |
| | | | | Options: `case`, `knowledgeBase` |
| Case ID (For Page) | `string` | No | — | ID of the case to create the page under. Required when creating in a case. _(shown when Create In (`pageLocation`) is `case`)_ |
| Title | `string` | Yes | — | Page title. |
| Category | `string` | Yes | — | Page category. |
| Content | `string` | Yes | — | Page content (supports markdown). |

#### Page: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Page ID | `string` | Yes | — | ID of the page. |

#### Page: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters (JSON Array) | `json` | No | `[]` | JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values). |
| Sort (JSON Array) | `json` | No | `[]` | JSON array of sort objects: [{ field, direction }]. Direction: "asc" or "desc". |
| Return Count | `boolean` | No | `false` | Whether to return only the count of matching results. |
| Extra Data | `string` | No | — | Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats). |

#### Page: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Page ID | `string` | Yes | — | ID of the page. |
| Update Fields (JSON) (`updateFields`) | `json` | No | `{}` | JSON object with fields to update: title, category, content. |

#### Query: Execute Query

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Query (JSON) | `json` | Yes | `[{"_name": "listOrganisation"}]` | TheHive Query DSL as a JSON array. See TheHive API docs for query syntax. |

#### Task: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID (For Task) | `string` | Yes | — | ID of the case to create the task under. |
| Task Fields (JSON) | `json` | Yes | `{}` | JSON object with task fields: title (required), description, group, flag, status, startDate, dueDate, endDate, assignee, mandatory, order. |

#### Task: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Task ID | `string` | Yes | — | ID of the task. |

#### Task: Execute Responder

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Task ID | `string` | Yes | — | ID of the task. |
| Responder ID | `string` | Yes | — | ID of the Cortex responder to execute. |

#### Task: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Task ID | `string` | Yes | — | ID of the task. |

#### Task: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters (JSON Array) | `json` | No | `[]` | JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values). |
| Sort (JSON Array) | `json` | No | `[]` | JSON array of sort objects: [{ field, direction }]. Direction: "asc" or "desc". |
| Return Count | `boolean` | No | `false` | Whether to return only the count of matching results. |
| Extra Data | `string` | No | — | Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats). |

#### Task: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Task ID | `string` | Yes | — | ID of the task. |
| Update Fields (JSON) (`updateFields`) | `json` | No | `{}` | JSON object with fields to update on the task. |

#### Task Log: Add Attachment

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Log ID | `string` | Yes | — | ID of the task log entry. |
| Binary Property | `string` | No | `data` | Name of the binary property to read from (upload) or write to (download) on the item. Names are case-sensitive — see the upstream node's Binary Data panel for the exact names to use. |
| Attachment Binary Properties (Comma-Separated) (`attachmentFields`) | `string` | No | `data` | Comma-separated list of binary property names on the input item to upload as attachments. |

#### Task Log: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Task ID (For Log) | `string` | Yes | — | ID of the task to create the log entry under. |
| Log Fields (JSON) | `json` | Yes | `{}` | JSON object with log fields: message (required), startDate. |
| Attachment Binary Properties (Comma-Separated) (`attachmentFields`) | `string` | No | — | Comma-separated list of binary property names to upload as attachments when creating a log entry. Leave empty for no attachments. |

#### Task Log: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Log ID | `string` | Yes | — | ID of the task log entry. |

#### Task Log: Delete Attachment

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Log ID | `string` | Yes | — | ID of the task log entry. |
| Attachment ID (`attachmentId`) | `string` | Yes | — | ID of the log attachment to delete. |

#### Task Log: Execute Responder

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Log ID | `string` | Yes | — | ID of the task log entry. |
| Responder ID | `string` | Yes | — | ID of the Cortex responder to execute. |

#### Task Log: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Log ID | `string` | Yes | — | ID of the task log entry. |

#### Task Log: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters (JSON Array) | `json` | No | `[]` | JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values). |
| Sort (JSON Array) | `json` | No | `[]` | JSON array of sort objects: [{ field, direction }]. Direction: "asc" or "desc". |
| Return Count | `boolean` | No | `false` | Whether to return only the count of matching results. |
| Extra Data | `string` | No | — | Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats). |

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Max Concurrency | `number` | No | `10` | Maximum number of items to process concurrently. |

## Output Data

Most operations produce one output item per input item, but the shape of that item is **not uniform across operations** — this node has three distinct behaviours, so check the table below before writing downstream expressions.

- **Merged** — the response is spread over the incoming item JSON, so your own fields survive alongside it.
- **Replaced** — the response object becomes the item JSON, and the incoming fields are gone.
- **Marked** — nothing useful comes back from TheHive, so the node adds a small marker (`deleted`, `success`) to the incoming item JSON.

Binary data on the input item is forwarded on every branch. `Case: Get Attachment` is the only operation that produces new binary: the downloaded file is added under the name in Binary Property (default `data`), next to any binary already on the item. Uploads read their files from Attachment Binary Properties, and file-type observables sent with `Alert: Create` read theirs from the `binaryProperty` name inside each observable entry.

**Which operations fan out.** Every `search` operation — `Alert: Search`, `Case: Search`, `Comment: Search`, `Observable: Search`, `Page: Search`, `Task: Search` and `Task Log: Search` — emits **one output item per matching record**, with the record replacing the item JSON. `Query: Execute Query` fans out the same way whenever the query returns an array. Special cases: a search that matches nothing emits a single item carrying the input JSON plus `results: []`; an empty query result emits one item with `queryResult: []`; and with Return Count on, a search emits a single item carrying `count` instead of records.

| Operation | Shape | What lands on the output item |
|-----------|-------|-------------------------------|
| `Alert: Create`, `Case: Create`, `Observable: Create`, `Task: Create`, `Task Log: Create` | Merged | The created record, spread over the incoming item JSON |
| `Alert: Get`, `Alert: Update`, `Alert: Update Status`, `Alert: Merge Into Case`, `Alert: Promote to Case` | Replaced | The alert (or resulting case) returned by TheHive |
| `Case: Get`, `Case: Update`, `Case: Get Timeline` | Replaced | The case record, or the timeline for `getTimeline` |
| `Comment: Create`, `Comment: Update` | Replaced | The comment record |
| `Observable: Get`, `Observable: Update` | Replaced | The observable record |
| `Page: Create`, `Page: Update` | Replaced | The page record |
| `Task: Get`, `Task: Update`, `Task Log: Get` | Replaced | The task or log record |
| `Alert: Delete` | Marked | `deleted: true` and `alertId` |
| `Case: Delete Case` | Marked | `deleted: true` and `caseId` |
| `Case: Delete Attachment`, `Task Log: Delete Attachment` | Marked | `deleted: true` and `attachmentId` |
| `Comment: Delete` | Marked | `deleted: true` and `commentId` |
| `Observable: Delete` | Marked | `deleted: true` and `observableId` |
| `Page: Delete` | Marked | `deleted: true` and `pageId` |
| `Task: Delete` | Marked | `deleted: true` and `taskId` |
| `Task Log: Delete` | Marked | `deleted: true` and `logId` |
| `Task Log: Add Attachment` | Marked | `success: true` |
| `Case: Add Attachment` | Replaced | The upload response; when TheHive returns a list, the uploaded files land on `attachments` |
| `Case: Get Attachment` | Replaced | `_id`, `caseId`, `fileName` and `mimeType`, plus the downloaded file in binary |
| `Alert / Case / Observable / Task / Task Log: Execute Responder` | Replaced | The finished Cortex action, polled until it is no longer waiting or in progress; a list of actions lands on `results` |
| `Observable: Execute Analyzer` | Replaced | The last analyzer job's result, polled to completion |
| Any `search` | Replaced, fanned out | One record per output item |
| `Query: Execute Query` | Replaced, fanned out for arrays | One query result per output item; a single object replaces the item JSON |

When TheHive answers with something that is not an object, the node falls back to a marker on the incoming item JSON instead: `updated: true` for the update operations, `merged: true` for `Alert: Merge Into Case`, `promoted: true` for `Alert: Promote to Case`, the chosen status value for `Alert: Update Status`, `success: true` for `Comment: Create` and `Case: Add Attachment`, and the raw body on `result`, `timeline` or `queryResult`.

Reference the result downstream by expression, e.g. `{{ $json.deleted }}` after a delete, `{{ $json.fileName }}` after `Case: Get Attachment`, or `{{ $json.count }}` after a search with Return Count on.

## Usage Examples

- Create a new security case in TheHive
- Search alerts by severity
- Upload a file as a case attachment
- Download a case attachment
- Create an observable with a file upload
- Execute a Cortex analyzer on an observable
- Run a TheHive Query DSL query

## Example Configuration

Create an alert with observables:

```json
{
  "type": "thehive_project",
  "parameters": {
    "resource": "alert",
    "operation": "create",
    "alertFields": {
      "title": "Suspicious Activity Detected",
      "description": "Malicious IP detected in network traffic",
      "type": "network-intrusion",
      "source": "SIEM",
      "sourceRef": "ALERT-2024-001",
      "severity": 3,
      "tlp": 2,
      "pap": 1,
      "tags": "malware,network,suspicious",
      "status": "New"
    },
    "observables": [
      {
        "dataType": "ip",
        "data": "192.168.1.100",
        "message": "Suspicious source IP",
        "tags": ["suspicious", "network"]
      },
      {
        "dataType": "domain",
        "data": "malicious-domain.com",
        "message": "C2 domain"
      }
    ]
  }
}
```

Search cases with filters:

```json
{
  "type": "thehive_project",
  "parameters": {
    "resource": "case",
    "operation": "search",
    "returnAll": false,
    "limit": 50,
    "filters": [
      {
        "field": "severity",
        "operator": "_gte",
        "value": 3
      },
      {
        "field": "status",
        "operator": "_in",
        "values": ["Open", "InProgress"]
      }
    ],
    "sortFields": [
      {
        "field": "createdAt",
        "direction": "desc"
      }
    ],
    "extraData": "taskStats,observableStats"
  }
}
```

Create a task in a case:

```json
{
  "type": "thehive_project",
  "parameters": {
    "resource": "task",
    "operation": "create",
    "caseId": "~123456",
    "taskFields": {
      "title": "Analyze network logs",
      "description": "Review network logs for the timeframe of the incident",
      "group": "Investigation",
      "status": "Waiting",
      "assignee": "analyst@company.com",
      "mandatory": true
    }
  }
}
```

Create an observable in a case with a file attachment:

```json
{
  "type": "thehive_project",
  "parameters": {
    "resource": "observable",
    "operation": "create",
    "createIn": "case",
    "parentId": "~123456",
    "dataType": "file",
    "observableFields": {
      "message": "Malware sample",
      "tags": ["malware", "sample"],
      "ioc": true,
      "tlp": 3
    },
    "attachmentFields": "malware_sample"
  }
}
```

Execute a responder on an alert:

```json
{
  "type": "thehive_project",
  "parameters": {
    "resource": "alert",
    "operation": "executeResponder",
    "alertId": "~789012",
    "responderId": "EmailNotification_1_0"
  }
}
```

Add a comment to a case:

```json
{
  "type": "thehive_project",
  "parameters": {
    "resource": "comment",
    "operation": "add",
    "addTo": "case",
    "parentId": "~123456",
    "message": "Investigation completed. No evidence of data exfiltration found."
  }
}
```

Update a case:

```json
{
  "type": "thehive_project",
  "parameters": {
    "resource": "case",
    "operation": "update",
    "caseId": "~123456",
    "updateFields": {
      "status": "Resolved",
      "summary": "False positive - benign network activity",
      "endDate": "2024-01-15T10:30:00Z",
      "addTags": "false-positive,resolved"
    }
  }
}
```

Download a case attachment:

```json
{
  "type": "thehive_project",
  "parameters": {
    "resource": "case",
    "operation": "getAttachment",
    "caseId": "~123456",
    "attachmentId": "~attachment789",
    "binaryPropertyName": "downloaded_file",
    "fileName": "evidence.zip"
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Manage security incidents in TheHive 5 — alerts, cases, observables, tasks, logs, comments, pages, with binary attachment support.