> Node: TheHive Trigger (`thehive_trigger`) · Webhook trigger · v1 > Category: Development · Credentials: TheHive (`theHiveApi`) > Updated: 2026-08-16 # TheHive Trigger > Triggers on TheHive security events such as alerts, cases, tasks, and observables ## Overview Receives webhook notifications from TheHive SIRP (Security Incident Response Platform) when security-related events occur, including alert creation/updates, case management operations, task lifecycle changes, observable (artifact) modifications, and task log entries. TheHive sends POST requests with a body containing objectType and operation fields; the trigger constructs an event key in the format {objectType}_{operation} and filters against the user-selected events list. Supports a wildcard (*) to accept all events. Compatible with both TheHive 3 (which uses "Creation" instead of "Create") and TheHive 4+. The webhook must be manually configured in TheHive settings to point to this trigger URL. Useful for automating incident response workflows, escalation procedures, alert triage, case tracking, and SOC automation. **Category:** Development **Tool Name:** `thehive_trigger` **Version:** 1 **Appearance:** Icon: `lucide-Shield` | Color: `#f5a623` ## Node Type **Trigger** — webhook (receives incoming HTTP callbacks) ## Input / Output | Direction | Port(s) | |-----------|--------| | Input | None (trigger node) | | Output | `Output` | ## Credentials This tool requires **TheHive** credentials. See the [Credentials Guide](https://busybot.net/credentials/the-hive-api/) for setup instructions. ### Parameters | Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | Events | `multiOptions` | Yes | `[]` | Which TheHive events to listen for. Select specific event types or use * for all events. | | | | | | Options: `*` (any event — wildcard), `alert_create`, `alert_delete`, `alert_update`, `case_create`, `case_delete`, `case_update`, `case_task_log_create`, `case_task_log_delete`, `case_task_log_update`, `case_artifact_create` (observable created), `case_artifact_delete` (observable deleted), `case_artifact_update` (observable updated), `case_task_create`, `case_task_delete`, `case_task_update` | ## Output Data Each accepted notification produces one output item: - `event` — the normalised event key, `{objectType}_{operation}` in lower case, e.g. `alert_create` - `objectType` — the object type TheHive sent, e.g. `alert`, `case`, `case_task` - `operation` — the operation TheHive sent, with TheHive 3's `Creation` normalised to `Create` - `body` — the complete request body as sent by TheHive - `headers` — the request headers - `query` — the query-string parameters - `_trigger` — always `thehive_webhook` - `_timestamp` — ISO 8601 timestamp of when the notification was received - `_webhookEvent` — the same value as `event` Notifications whose event key is outside your **Events** selection are acknowledged but do not start the workflow, as are requests missing `objectType` or `operation`. Reference the payload downstream by expression, e.g. `{{ $json.body.object.severity }}`. ## Usage Examples - Start a workflow when a new security alert is created in TheHive - Trigger incident response automation when a case is updated - Automate task assignment when a new task is created in a case - Send notifications when an observable (artifact) is added to a case - Trigger SOC playbook when any TheHive event occurs ## Example Configuration Listen for any TheHive event: ```json { "name": "TheHive All Events Trigger", "type": "thehive_trigger", "typeVersion": 1, "position": [250, 300], "parameters": { "events": ["*"] } } ``` Monitor alert creation and updates only: ```json { "name": "TheHive Alert Monitor", "type": "thehive_trigger", "typeVersion": 1, "position": [250, 300], "parameters": { "events": ["alert_create", "alert_update"] } } ``` Monitor case-related events and task operations: ```json { "name": "TheHive Case & Task Monitor", "type": "thehive_trigger", "typeVersion": 1, "position": [250, 300], "parameters": { "events": [ "case_create", "case_update", "case_task_create", "case_task_update" ] } } ``` Monitor observable (artifact) changes: ```json { "name": "TheHive Observable Monitor", "type": "thehive_trigger", "typeVersion": 1, "position": [250, 300], "parameters": { "events": [ "case_artifact_create", "case_artifact_update", "case_artifact_delete" ] } } ``` Focus on task management, including task logs: ```json { "name": "TheHive Task Management Trigger", "type": "thehive_trigger", "typeVersion": 1, "position": [250, 300], "parameters": { "events": [ "case_task_create", "case_task_update", "case_task_delete", "case_task_log_create", "case_task_log_update" ] } } ``` ### Trigger Behavior - **Activation:** When the workflow is activated, a webhook endpoint is registered with the service. - **Deactivation:** The webhook is automatically unregistered when the workflow is deactivated. - **Payload:** The incoming webhook payload is parsed and output as workflow items. - **Verification:** Supports signature verification where applicable. ## Tips Entry point that fires when TheHive sends a webhook for security events (alerts, cases, tasks, observables, logs). You must manually configure the webhook URL in your TheHive instance settings. Select which event types to listen for, or use the wildcard (*) to receive all events. The trigger normalizes TheHive 3 "Creation" events to "Create" for consistency. Events are formatted as {objectType}_{operation} (e.g., alert_create, case_update). ### Important Setup Notes 1. **Webhook Configuration Required**: Before using this trigger, you must configure a webhook in TheHive that points to the trigger URL provided by your workflow platform. Go to TheHive Settings > Webhooks and add a new webhook pointing to this trigger's URL. 2. **Event Selection**: Choose specific events rather than using the wildcard (*) when possible to avoid unnecessary workflow executions. 3. **Multiple Events**: You can select multiple specific events to monitor different types of TheHive activities in a single trigger. 4. **TheHive Integration**: Ensure your TheHive instance is properly configured to send webhook notifications to your workflow platform.