TheHive Trigger

Triggers on TheHive security events such as alerts, cases, tasks, and observables

Overview

Receives webhook notifications from TheHive SIRP (Security Incident Response Platform) when security-related events occur, including alert creation/updates, case management operations, task lifecycle changes, observable (artifact) modifications, and task log entries. TheHive sends POST requests with a body containing objectType and operation fields; the trigger constructs an event key in the format {objectType}_{operation} and filters against the user-selected events list. Supports a wildcard (*) to accept all events. Compatible with both TheHive 3 (which uses “Creation” instead of “Create”) and TheHive 4+. The webhook must be manually configured in TheHive settings to point to this trigger URL. Useful for automating incident response workflows, escalation procedures, alert triage, case tracking, and SOC automation.

Category: Development
Tool Name: thehive_trigger
Version: 1

Appearance: Icon: lucide-Shield | Color: #f5a623

Node Type

Trigger — webhook (receives incoming HTTP callbacks)

Input / Output

Direction	Port(s)
Input	None (trigger node)
Output	Output

Credentials

This tool requires TheHive credentials. See the Credentials Guide for setup instructions.

Parameters

Parameter	Type	Required	Default	Description
Events	multiOptions	Yes	[]	Which TheHive events to listen for. Select specific event types or use * for all events.
				Options: * (any event — wildcard), alert_create, alert_delete, alert_update, case_create, case_delete, case_update, case_task_log_create, case_task_log_delete, case_task_log_update, case_artifact_create (observable created), case_artifact_delete (observable deleted), case_artifact_update (observable updated), case_task_create, case_task_delete, case_task_update

Output Data

Each accepted notification produces one output item:

• event — the normalised event key, {objectType}_{operation} in lower case, e.g. alert_create
• objectType — the object type TheHive sent, e.g. alert, case, case_task
• operation — the operation TheHive sent, with TheHive 3’s Creation normalised to Create
• body — the complete request body as sent by TheHive
• headers — the request headers
• query — the query-string parameters
• _trigger — always thehive_webhook
• _timestamp — ISO 8601 timestamp of when the notification was received
• _webhookEvent — the same value as event

Notifications whose event key is outside your Events selection are acknowledged but do not start the workflow, as are requests missing objectType or operation.

Reference the payload downstream by expression, e.g. {{ $json.body.object.severity }}.

Usage Examples

• Start a workflow when a new security alert is created in TheHive
• Trigger incident response automation when a case is updated
• Automate task assignment when a new task is created in a case
• Send notifications when an observable (artifact) is added to a case
• Trigger SOC playbook when any TheHive event occurs

Example Configuration

Listen for any TheHive event:

{
  "name": "TheHive All Events Trigger",
  "type": "thehive_trigger",
  "typeVersion": 1,
  "position": [250, 300],
  "parameters": {
    "events": ["*"]
  }
}

Monitor alert creation and updates only:

{
  "name": "TheHive Alert Monitor",
  "type": "thehive_trigger",
  "typeVersion": 1,
  "position": [250, 300],
  "parameters": {
    "events": ["alert_create", "alert_update"]
  }
}

Monitor case-related events and task operations:

{
  "name": "TheHive Case & Task Monitor",
  "type": "thehive_trigger",
  "typeVersion": 1,
  "position": [250, 300],
  "parameters": {
    "events": [
      "case_create",
      "case_update",
      "case_task_create",
      "case_task_update"
    ]
  }
}

Monitor observable (artifact) changes:

{
  "name": "TheHive Observable Monitor",
  "type": "thehive_trigger",
  "typeVersion": 1,
  "position": [250, 300],
  "parameters": {
    "events": [
      "case_artifact_create",
      "case_artifact_update",
      "case_artifact_delete"
    ]
  }
}

Focus on task management, including task logs:

{
  "name": "TheHive Task Management Trigger",
  "type": "thehive_trigger",
  "typeVersion": 1,
  "position": [250, 300],
  "parameters": {
    "events": [
      "case_task_create",
      "case_task_update",
      "case_task_delete",
      "case_task_log_create",
      "case_task_log_update"
    ]
  }
}

Trigger Behavior

• Activation: When the workflow is activated, a webhook endpoint is registered with the service.
• Deactivation: The webhook is automatically unregistered when the workflow is deactivated.
• Payload: The incoming webhook payload is parsed and output as workflow items.
• Verification: Supports signature verification where applicable.

Tips

Entry point that fires when TheHive sends a webhook for security events (alerts, cases, tasks, observables, logs). You must manually configure the webhook URL in your TheHive instance settings. Select which event types to listen for, or use the wildcard (*) to receive all events. The trigger normalizes TheHive 3 “Creation” events to “Create” for consistency. Events are formatted as {objectType}_{operation} (e.g., alert_create, case_update).

Important Setup Notes

1. Webhook Configuration Required: Before using this trigger, you must configure a webhook in TheHive that points to the trigger URL provided by your workflow platform. Go to TheHive Settings > Webhooks and add a new webhook pointing to this trigger’s URL.

2. Event Selection: Choose specific events rather than using the wildcard (*) when possible to avoid unnecessary workflow executions.

3. Multiple Events: You can select multiple specific events to monitor different types of TheHive activities in a single trigger.

4. TheHive Integration: Ensure your TheHive instance is properly configured to send webhook notifications to your workflow platform.