TheHive 5

Manage security incidents in TheHive 5 with binary attachment support

Overview

TheHive 5 is an open-source Security Incident Response Platform. This tool provides full CRUD for alerts, cases, tasks, task logs, observables, comments, and pages. It supports binary data operations: downloading case attachments (Pattern A), uploading case/log attachments and file-type observables (Pattern B), and executing arbitrary TheHive Query DSL queries. Integrates with Cortex for automated analysis and response via analyzers and responders.

Category: Productivity
Tool Name: thehive_project
Version: 1

Appearance: Icon: lucide-Shield | Color: #F8A51C

Node Type

Action (Binary) — handles file/binary data operations

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires TheHive 5 API credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Alert	alert
Case	case
Comment	comment
Observable	observable
Page	page
Query	query
Task	task
Task Log	log

Operations

Alert (alert)

Operation	Value	Description
Create	create	Create an alert.
Delete	deleteAlert	Delete an alert.
Execute Responder	executeResponder	Run a Cortex responder against an alert.
Get	get	Retrieve a single alert.
Merge Into Case	merge	Merge an alert into an existing case.
Promote to Case	promote	Turn an alert into a new case.
Search	search	Search alerts.
Update	update	Update an alert.
Update Status	status	Set an alert’s status.

Case (case)

Operation	Value	Description
Add Attachment	addAttachment	Upload one or more files to a case.
Create	create	Create a case.
Delete Attachment	deleteAttachment	Remove an attachment from a case.
Delete Case	deleteCase	Delete a case.
Execute Responder	executeResponder	Run a Cortex responder against a case.
Get	get	Retrieve a single case.
Get Attachment	getAttachment	Download a case attachment as binary data.
Get Timeline	getTimeline	Retrieve a case’s timeline.
Search	search	Search cases.
Update	update	Update a case.

Comment (comment)

Operation	Value	Description
Create	add	Add a comment to an alert or a case.
Delete	deleteComment	Delete a comment.
Search	search	Search comments.
Update	update	Change a comment’s message.

Observable (observable)

Operation	Value	Description
Create	create	Create an observable in a case or an alert.
Delete	deleteObservable	Delete an observable.
Execute Analyzer	executeAnalyzer	Run one or more Cortex analyzers against an observable.
Execute Responder	executeResponder	Run a Cortex responder against an observable.
Get	get	Retrieve a single observable.
Search	search	Search observables.
Update	update	Update an observable.

Page (page)

Operation	Value	Description
Create	create	Create a page in a case or in the knowledge base.
Delete	deletePage	Delete a page.
Search	search	Search pages.
Update	update	Update a page.

Query (query)

Operation	Value	Description
Execute Query	executeQuery	Run a TheHive Query DSL query.

Task (task)

Operation	Value	Description
Create	create	Create a task under a case.
Delete	deleteTask	Delete a task.
Execute Responder	executeResponder	Run a Cortex responder against a task.
Get	get	Retrieve a single task.
Search	search	Search tasks.
Update	update	Update a task.

Task Log (log)

Operation	Value	Description
Add Attachment	addAttachment	Upload one or more files to an existing log entry.
Create	create	Create a log entry under a task, optionally with attachments.
Delete	deleteLog	Delete a log entry.
Delete Attachment	deleteAttachment	Remove an attachment from a log entry.
Execute Responder	executeResponder	Run a Cortex responder against a log entry.
Get	get	Retrieve a single log entry.
Search	search	Search log entries.

Parameters

String, number and JSON fields are resolved per input item, so they accept {{ $json.field }} expressions.

Alert: Create

Parameter	Type	Required	Default	Description
Alert Fields (JSON)	json	Yes	{}	JSON object with alert fields: title, description, type, source, sourceRef, severity (1-4), tlp (0-3), pap (0-3), tags (comma-separated), date, summary, status, follow, flag, externalLink, caseTemplate, lastSyncDate.
Observables (JSON Array)	json	No	[]	JSON array of observables to attach to the alert. Each: { dataType, data, message, tags }. For file-type, set dataType=“file” and provide binaryProperty name in “binaryProperty” field.

Alert: Delete

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert (e.g. ~123456).

Alert: Execute Responder

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert (e.g. ~123456).
Responder ID	string	Yes	—	ID of the Cortex responder to execute.

Alert: Get

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert (e.g. ~123456).

Alert: Merge Into Case

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert (e.g. ~123456).
Case ID (Merge Target)	string	Yes	—	ID of the case to merge the alert into.

Alert: Promote to Case

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert (e.g. ~123456).
Case Template	string	No	—	Optional case template name to use when promoting alert to case.

Alert: Search

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Filters (JSON Array)	json	No	[]	JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values).
Sort (JSON Array)	json	No	[]	JSON array of sort objects: [{ field, direction }]. Direction: “asc” or “desc”.
Return Count	boolean	No	false	Whether to return only the count of matching results.
Extra Data	string	No	—	Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats).

Alert: Update

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert (e.g. ~123456).
Update Fields (JSON) (updateFields)	json	No	{}	JSON object with fields to update. Supports addTags, removeTags for incremental tag management.

Alert: Update Status

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert (e.g. ~123456).
Status	options	No	New	New status for the alert.
				Options: New, Updated, Ignored, Imported

Case: Add Attachment

Parameter	Type	Required	Default	Description
Case ID	string	Yes	—	ID of the case (e.g. ~123456).
Binary Property	string	No	data	Name of the binary property to read from (upload) or write to (download) on the item. Names are case-sensitive — see the upstream node’s Binary Data panel for the exact names to use.
Attachment Binary Properties (Comma-Separated) (attachmentFields)	string	No	data	Comma-separated list of binary property names on the input item to upload as attachments.
Rename Files	boolean	No	false	Whether to rename the file if one with the same name already exists.

Case: Create

Parameter	Type	Required	Default	Description
Case Fields (JSON)	json	Yes	{}	JSON object with case fields: title, description, severity (1-4), startDate, tags, tlp (0-3), pap (0-3), endDate, flag, summary, status, assignee, caseTemplate, tasks, sharingParameters, impactStatus, taskRule, observableRule.

Case: Delete Attachment

Parameter	Type	Required	Default	Description
Case ID	string	Yes	—	ID of the case (e.g. ~123456).
Attachment ID (attachmentId)	string	Yes	—	ID of the attachment to download or delete.

Case: Delete Case

Parameter	Type	Required	Default	Description
Case ID	string	Yes	—	ID of the case (e.g. ~123456).

Case: Execute Responder

Parameter	Type	Required	Default	Description
Case ID	string	Yes	—	ID of the case (e.g. ~123456).
Responder ID	string	Yes	—	ID of the Cortex responder to execute.

Case: Get

Parameter	Type	Required	Default	Description
Case ID	string	Yes	—	ID of the case (e.g. ~123456).

Case: Get Attachment

Parameter	Type	Required	Default	Description
Case ID	string	Yes	—	ID of the case (e.g. ~123456).
Attachment ID (attachmentId)	string	Yes	—	ID of the attachment to download or delete.
Binary Property	string	No	data	Name of the binary property to read from (upload) or write to (download) on the item. Names are case-sensitive — see the upstream node’s Binary Data panel for the exact names to use.
File Name	string	No	—	Rename the file when downloading. Leave empty to use the original name.

Case: Get Timeline

Parameter	Type	Required	Default	Description
Case ID	string	Yes	—	ID of the case (e.g. ~123456).

Case: Search

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Filters (JSON Array)	json	No	[]	JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values).
Sort (JSON Array)	json	No	[]	JSON array of sort objects: [{ field, direction }]. Direction: “asc” or “desc”.
Return Count	boolean	No	false	Whether to return only the count of matching results.
Extra Data	string	No	—	Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats).

Case: Update

Parameter	Type	Required	Default	Description
Case ID	string	Yes	—	ID of the case (e.g. ~123456).
Update Fields (JSON) (updateFields)	json	No	{}	JSON object with fields to update on the case.

Comment: Create

Parameter	Type	Required	Default	Description
Add To	options	No	case	Whether to add the comment to an alert or a case.
				Options: alert, case
Parent ID (parentId)	string	Yes	—	ID of the alert or case to add the comment to.
Message	string	Yes	—	The comment message text.

Comment: Delete

Parameter	Type	Required	Default	Description
Comment ID	string	Yes	—	ID of the comment.

Comment: Search

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Filters (JSON Array)	json	No	[]	JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values).
Sort (JSON Array)	json	No	[]	JSON array of sort objects: [{ field, direction }]. Direction: “asc” or “desc”.
Return Count	boolean	No	false	Whether to return only the count of matching results.
Extra Data	string	No	—	Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats).

Comment: Update

Parameter	Type	Required	Default	Description
Comment ID	string	Yes	—	ID of the comment.
Message	string	Yes	—	The comment message text.

Observable: Create

Parameter	Type	Required	Default	Description
Create In (createIn)	options	No	case	Whether to create the observable in a case or an alert.
				Options: case, alert
Parent ID (parentId)	string	Yes	—	ID of the parent case or alert.
Data Type (dataType)	string	Yes	file	Observable data type: file, ip, domain, url, hash, filename, mail, registry, etc. Use “file” for binary upload.
Data	string	No	—	Observable value (e.g., IP address, domain, hash). Not used when dataType is “file”.
Observable Fields (JSON)	json	No	{}	JSON object with additional observable fields: message, tags, tlp (0-3), pap (0-3), ioc, sighted, sightedAt, ignoreSimilarity, isZip, zipPassword.
Attachment Binary Properties (Comma-Separated) (attachmentFields)	string	No	data	Comma-separated list of binary property names on the input item to upload as file-type observable attachments.

Observable: Delete

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the observable.

Observable: Execute Analyzer

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the observable.
Analyzer IDs (Comma-Separated)	string	Yes	—	Comma-separated list of analyzer IDs in format “analyzerId::cortexId”.
Data Type (dataType)	string	No	—	Observable data type (required for analyzer execution).

Observable: Execute Responder

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the observable.
Responder ID	string	Yes	—	ID of the Cortex responder to execute.

Observable: Get

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the observable.

Observable: Search

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Filters (JSON Array)	json	No	[]	JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values).
Sort (JSON Array)	json	No	[]	JSON array of sort objects: [{ field, direction }]. Direction: “asc” or “desc”.
Return Count	boolean	No	false	Whether to return only the count of matching results.
Extra Data	string	No	—	Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats).

Observable: Update

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the observable.
Update Fields (JSON) (updateFields)	json	No	{}	JSON object with fields to update on the observable.

Page: Create

Parameter	Type	Required	Default	Description
Create In (pageLocation)	options	No	case	Whether to create the page inside a case or in the knowledge base.
				Options: case, knowledgeBase
Case ID (For Page)	string	No	—	ID of the case to create the page under. Required when creating in a case. (shown when Create In (pageLocation) is case)
Title	string	Yes	—	Page title.
Category	string	Yes	—	Page category.
Content	string	Yes	—	Page content (supports markdown).

Page: Delete

Parameter	Type	Required	Default	Description
Page ID	string	Yes	—	ID of the page.

Page: Search

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Filters (JSON Array)	json	No	[]	JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values).
Sort (JSON Array)	json	No	[]	JSON array of sort objects: [{ field, direction }]. Direction: “asc” or “desc”.
Return Count	boolean	No	false	Whether to return only the count of matching results.
Extra Data	string	No	—	Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats).

Page: Update

Parameter	Type	Required	Default	Description
Page ID	string	Yes	—	ID of the page.
Update Fields (JSON) (updateFields)	json	No	{}	JSON object with fields to update: title, category, content.

Query: Execute Query

Parameter	Type	Required	Default	Description
Query (JSON)	json	Yes	[{"_name": "listOrganisation"}]	TheHive Query DSL as a JSON array. See TheHive API docs for query syntax.

Task: Create

Parameter	Type	Required	Default	Description
Case ID (For Task)	string	Yes	—	ID of the case to create the task under.
Task Fields (JSON)	json	Yes	{}	JSON object with task fields: title (required), description, group, flag, status, startDate, dueDate, endDate, assignee, mandatory, order.

Task: Delete

Parameter	Type	Required	Default	Description
Task ID	string	Yes	—	ID of the task.

Task: Execute Responder

Parameter	Type	Required	Default	Description
Task ID	string	Yes	—	ID of the task.
Responder ID	string	Yes	—	ID of the Cortex responder to execute.

Task: Get

Parameter	Type	Required	Default	Description
Task ID	string	Yes	—	ID of the task.

Task: Search

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Filters (JSON Array)	json	No	[]	JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values).
Sort (JSON Array)	json	No	[]	JSON array of sort objects: [{ field, direction }]. Direction: “asc” or “desc”.
Return Count	boolean	No	false	Whether to return only the count of matching results.
Extra Data	string	No	—	Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats).

Task: Update

Parameter	Type	Required	Default	Description
Task ID	string	Yes	—	ID of the task.
Update Fields (JSON) (updateFields)	json	No	{}	JSON object with fields to update on the task.

Task Log: Add Attachment

Parameter	Type	Required	Default	Description
Log ID	string	Yes	—	ID of the task log entry.
Binary Property	string	No	data	Name of the binary property to read from (upload) or write to (download) on the item. Names are case-sensitive — see the upstream node’s Binary Data panel for the exact names to use.
Attachment Binary Properties (Comma-Separated) (attachmentFields)	string	No	data	Comma-separated list of binary property names on the input item to upload as attachments.

Task Log: Create

Parameter	Type	Required	Default	Description
Task ID (For Log)	string	Yes	—	ID of the task to create the log entry under.
Log Fields (JSON)	json	Yes	{}	JSON object with log fields: message (required), startDate.
Attachment Binary Properties (Comma-Separated) (attachmentFields)	string	No	—	Comma-separated list of binary property names to upload as attachments when creating a log entry. Leave empty for no attachments.

Task Log: Delete

Parameter	Type	Required	Default	Description
Log ID	string	Yes	—	ID of the task log entry.

Task Log: Delete Attachment

Parameter	Type	Required	Default	Description
Log ID	string	Yes	—	ID of the task log entry.
Attachment ID (attachmentId)	string	Yes	—	ID of the log attachment to delete.

Task Log: Execute Responder

Parameter	Type	Required	Default	Description
Log ID	string	Yes	—	ID of the task log entry.
Responder ID	string	Yes	—	ID of the Cortex responder to execute.

Task Log: Get

Parameter	Type	Required	Default	Description
Log ID	string	Yes	—	ID of the task log entry.

Task Log: Search

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Filters (JSON Array)	json	No	[]	JSON array of filter objects: [{ field, operator, value }]. Operators: _eq, _ne, _gt, _gte, _lt, _lte, _like, _startsWith, _endsWith, _match, _between (use from/to), _in (use values).
Sort (JSON Array)	json	No	[]	JSON array of sort objects: [{ field, direction }]. Direction: “asc” or “desc”.
Return Count	boolean	No	false	Whether to return only the count of matching results.
Extra Data	string	No	—	Comma-separated list of extra data fields to include (e.g., isOwner, links, permissions, shares, shareCount, taskStats, observableStats).

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	number	No	10	Maximum number of items to process concurrently.

Output Data

Most operations produce one output item per input item, but the shape of that item is not uniform across operations — this node has three distinct behaviours, so check the table below before writing downstream expressions.

• Merged — the response is spread over the incoming item JSON, so your own fields survive alongside it.
• Replaced — the response object becomes the item JSON, and the incoming fields are gone.
• Marked — nothing useful comes back from TheHive, so the node adds a small marker (deleted, success) to the incoming item JSON.

Binary data on the input item is forwarded on every branch. Case: Get Attachment is the only operation that produces new binary: the downloaded file is added under the name in Binary Property (default data), next to any binary already on the item. Uploads read their files from Attachment Binary Properties, and file-type observables sent with Alert: Create read theirs from the binaryProperty name inside each observable entry.

Which operations fan out. Every search operation — Alert: Search, Case: Search, Comment: Search, Observable: Search, Page: Search, Task: Search and Task Log: Search — emits one output item per matching record, with the record replacing the item JSON. Query: Execute Query fans out the same way whenever the query returns an array. Special cases: a search that matches nothing emits a single item carrying the input JSON plus results: []; an empty query result emits one item with queryResult: []; and with Return Count on, a search emits a single item carrying count instead of records.

Operation	Shape	What lands on the output item
Alert: Create, Case: Create, Observable: Create, Task: Create, Task Log: Create	Merged	The created record, spread over the incoming item JSON
Alert: Get, Alert: Update, Alert: Update Status, Alert: Merge Into Case, Alert: Promote to Case	Replaced	The alert (or resulting case) returned by TheHive
Case: Get, Case: Update, Case: Get Timeline	Replaced	The case record, or the timeline for getTimeline
Comment: Create, Comment: Update	Replaced	The comment record
Observable: Get, Observable: Update	Replaced	The observable record
Page: Create, Page: Update	Replaced	The page record
Task: Get, Task: Update, Task Log: Get	Replaced	The task or log record
Alert: Delete	Marked	deleted: true and alertId
Case: Delete Case	Marked	deleted: true and caseId
Case: Delete Attachment, Task Log: Delete Attachment	Marked	deleted: true and attachmentId
Comment: Delete	Marked	deleted: true and commentId
Observable: Delete	Marked	deleted: true and observableId
Page: Delete	Marked	deleted: true and pageId
Task: Delete	Marked	deleted: true and taskId
Task Log: Delete	Marked	deleted: true and logId
Task Log: Add Attachment	Marked	success: true
Case: Add Attachment	Replaced	The upload response; when TheHive returns a list, the uploaded files land on attachments
Case: Get Attachment	Replaced	_id, caseId, fileName and mimeType, plus the downloaded file in binary
Alert / Case / Observable / Task / Task Log: Execute Responder	Replaced	The finished Cortex action, polled until it is no longer waiting or in progress; a list of actions lands on results
Observable: Execute Analyzer	Replaced	The last analyzer job’s result, polled to completion
Any search	Replaced, fanned out	One record per output item
Query: Execute Query	Replaced, fanned out for arrays	One query result per output item; a single object replaces the item JSON

When TheHive answers with something that is not an object, the node falls back to a marker on the incoming item JSON instead: updated: true for the update operations, merged: true for Alert: Merge Into Case, promoted: true for Alert: Promote to Case, the chosen status value for Alert: Update Status, success: true for Comment: Create and Case: Add Attachment, and the raw body on result, timeline or queryResult.

Reference the result downstream by expression, e.g. {{ $json.deleted }} after a delete, {{ $json.fileName }} after Case: Get Attachment, or {{ $json.count }} after a search with Return Count on.

Usage Examples

• Create a new security case in TheHive
• Search alerts by severity
• Upload a file as a case attachment
• Download a case attachment
• Create an observable with a file upload
• Execute a Cortex analyzer on an observable
• Run a TheHive Query DSL query

Example Configuration

Create an alert with observables:

{
  "type": "thehive_project",
  "parameters": {
    "resource": "alert",
    "operation": "create",
    "alertFields": {
      "title": "Suspicious Activity Detected",
      "description": "Malicious IP detected in network traffic",
      "type": "network-intrusion",
      "source": "SIEM",
      "sourceRef": "ALERT-2024-001",
      "severity": 3,
      "tlp": 2,
      "pap": 1,
      "tags": "malware,network,suspicious",
      "status": "New"
    },
    "observables": [
      {
        "dataType": "ip",
        "data": "192.168.1.100",
        "message": "Suspicious source IP",
        "tags": ["suspicious", "network"]
      },
      {
        "dataType": "domain",
        "data": "malicious-domain.com",
        "message": "C2 domain"
      }
    ]
  }
}

Search cases with filters:

{
  "type": "thehive_project",
  "parameters": {
    "resource": "case",
    "operation": "search",
    "returnAll": false,
    "limit": 50,
    "filters": [
      {
        "field": "severity",
        "operator": "_gte",
        "value": 3
      },
      {
        "field": "status",
        "operator": "_in",
        "values": ["Open", "InProgress"]
      }
    ],
    "sortFields": [
      {
        "field": "createdAt",
        "direction": "desc"
      }
    ],
    "extraData": "taskStats,observableStats"
  }
}

Create a task in a case:

{
  "type": "thehive_project",
  "parameters": {
    "resource": "task",
    "operation": "create",
    "caseId": "~123456",
    "taskFields": {
      "title": "Analyze network logs",
      "description": "Review network logs for the timeframe of the incident",
      "group": "Investigation",
      "status": "Waiting",
      "assignee": "analyst@company.com",
      "mandatory": true
    }
  }
}

Create an observable in a case with a file attachment:

{
  "type": "thehive_project",
  "parameters": {
    "resource": "observable",
    "operation": "create",
    "createIn": "case",
    "parentId": "~123456",
    "dataType": "file",
    "observableFields": {
      "message": "Malware sample",
      "tags": ["malware", "sample"],
      "ioc": true,
      "tlp": 3
    },
    "attachmentFields": "malware_sample"
  }
}

Execute a responder on an alert:

{
  "type": "thehive_project",
  "parameters": {
    "resource": "alert",
    "operation": "executeResponder",
    "alertId": "~789012",
    "responderId": "EmailNotification_1_0"
  }
}

Add a comment to a case:

{
  "type": "thehive_project",
  "parameters": {
    "resource": "comment",
    "operation": "add",
    "addTo": "case",
    "parentId": "~123456",
    "message": "Investigation completed. No evidence of data exfiltration found."
  }
}

Update a case:

{
  "type": "thehive_project",
  "parameters": {
    "resource": "case",
    "operation": "update",
    "caseId": "~123456",
    "updateFields": {
      "status": "Resolved",
      "summary": "False positive - benign network activity",
      "endDate": "2024-01-15T10:30:00Z",
      "addTags": "false-positive,resolved"
    }
  }
}

Download a case attachment:

{
  "type": "thehive_project",
  "parameters": {
    "resource": "case",
    "operation": "getAttachment",
    "caseId": "~123456",
    "attachmentId": "~attachment789",
    "binaryPropertyName": "downloaded_file",
    "fileName": "evidence.zip"
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

Manage security incidents in TheHive 5 — alerts, cases, observables, tasks, logs, comments, pages, with binary attachment support.