<!-- BusyBot node reference — https://busybot.net/tools/thehive/ -->

> Node: TheHive (`thehive`) · Action (binary) · v1
> Category: Utility · Credentials: TheHive API (`theHiveApi`)
> Updated: 2026-08-16

# TheHive

> Manage security incidents in TheHive v3/v4 with binary file upload support

## Overview

TheHive is an open-source Security Incident Response Platform (SIRP). This tool provides full CRUD operations for alerts, cases, tasks, task logs, and observables in TheHive v3/v4. It supports binary data uploads for file-type observables and log attachments via multipart form upload (Pattern B). It integrates with Cortex for executing analyzers on observables and responders on any resource type. Supports both v0 (TheHive 3) and v1 (TheHive 4) API versions with transparent branching.

**Category:** Utility  
**Tool Name:** `thehive`  
**Version:** 1

**Appearance:** Icon: `lucide-Shield` | Color: `#F5A623`

## Node Type

**Action (Binary)** — handles file/binary data operations

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **TheHive API** credentials.
See the [Credentials Guide](https://busybot.net/credentials/the-hive-api/) for setup instructions.

### Resources

| Resource | Value |
|----------|-------|
| Alert | `alert` |
| Case | `case` |
| Log | `log` |
| Observable | `observable` |
| Task | `task` |

### Operations

| Operation | Value | Description |
|-----------|-------|-------------|
| Count | `count` | Count records matching the filters (v1 API only) |
| Create | `create` | Create a record |
| Execute Analyzer | `executeAnalyzer` | Execute Cortex analyzers |
| Execute Responder | `executeResponder` | Execute a Cortex responder |
| Get | `get` | Get a single record |
| Get Many | `getAll` | Get many records |
| Mark as Read | `markAsRead` | Mark alert as read |
| Mark as Unread | `markAsUnread` | Mark alert as unread |
| Merge | `merge` | Merge alert into an existing case |
| Promote | `promote` | Promote alert to a case |
| Search | `search` | Search records |
| Update | `update` | Update a record |

Availability per resource:

- **Alert** — `count`, `create`, `executeResponder`, `get`, `getAll`, `markAsRead`, `markAsUnread`, `merge`, `promote`, `update`
- **Case** — `count`, `create`, `executeResponder`, `get`, `getAll`, `update`
- **Observable** — `count`, `create`, `executeAnalyzer`, `executeResponder`, `get`, `getAll`, `search`, `update`
- **Task** — `count`, `create`, `executeResponder`, `get`, `getAll`, `search`, `update`
- **Log** — `create`, `executeResponder`, `get`, `getAll`

### Parameters

#### Alert: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Title | `string` | Yes | — | Title of the alert. Supports expressions. |
| Description | `string` | Yes | — | Description of the alert. Supports expressions. |
| Severity | `options` | Yes | `2` | Severity of the alert. Default=Medium. |
| | | | | Options: `1` (low), `2` (medium), `3` (high) |
| Date | `string` | Yes | — | Date and time when the alert was raised (ISO 8601). Supports expressions. |
| Tags | `string` | Yes | — | Comma-separated tags for the alert. |
| TLP | `options` | Yes | `2` | Traffic Light Protocol level. Default=Amber. |
| | | | | Options: `0` (white), `1` (green), `2` (amber), `3` (red) |
| Status | `options` | Yes | `New` | Status of the alert. |
| | | | | Options: `New`, `Updated`, `Ignored`, `Imported` |
| Type | `string` | Yes | — | Type of the alert. |
| Source | `string` | Yes | — | Source of the alert. |
| Source Reference | `string` | Yes | — | Source reference of the alert. |
| Follow | `boolean` | Yes | `true` | Whether the alert becomes active when updated. |
| Artifacts (JSON) | `json` | No | `[]` | Observable artifacts as JSON array. Each object: { dataType, data, message, tags }. |
| JSON Parameters | `boolean` | No | `true` | Whether to pass custom fields as JSON. |
| Additional Fields | `collection` | No | `{}` | Optional alert settings. |
| — Case Template | `string` | No | — | Case template to use when a case is created from this alert. |
| — Custom Fields (JSON) | `string` | No | — | Custom fields as JSON object: { "fieldRef": value }. |

#### Alert: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | The ID of the alert. Supports expressions. |
| Options | `collection` | No | `{}` | Extra detail to request. |
| — Include Similar Cases | `boolean` | No | `false` | Whether to include similar cases in the response. |

#### Alert: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to the limit. |
| Limit | `number` | No | `100` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters | `collection` | No | `{}` | Narrows the alert list. |
| — Title | `string` | No | — | Match on the alert title. |
| — Description | `string` | No | — | Match on the alert description. |
| — Severity | `options` | No | `2` | Match on severity. |
| | | | | Options: `1` (low), `2` (medium), `3` (high) |
| — Tags | `string` | No | — | Match on tags. |
| — TLP | `options` | No | `2` | Match on Traffic Light Protocol level. |
| | | | | Options: `0` (white), `1` (green), `2` (amber), `3` (red) |
| — Follow | `boolean` | No | `false` | Match on the follow flag. |
| — Custom Fields (JSON) | `string` | No | — | Match on custom fields, given as a JSON object. |
| Options | `collection` | No | `{}` | Sorting for the result list. |
| — Sort | `string` | No | — | Sort attribute with prefix: + for asc, - for desc. Example: +status or -date. |

#### Alert: Count

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Filters | `collection` | No | `{}` | Narrows what is counted — the same sub-fields as Alert: Get Many above. |

#### Alert: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | The ID of the alert. Supports expressions. |
| JSON Parameters | `boolean` | No | `true` | Whether to pass custom fields as JSON. |
| Update Fields | `collection` | No | `{}` | Values to change on the alert. |
| — Title | `string` | No | — | New title. |
| — Description | `string` | No | — | New description. |
| — Severity | `options` | No | `2` | New severity. |
| | | | | Options: `1` (low), `2` (medium), `3` (high) |
| — Status | `options` | No | `New` | New status. |
| | | | | Options: `New`, `Updated`, `Ignored`, `Imported` |
| — Tags | `string` | No | — | New comma-separated tags. |
| — TLP | `options` | No | `2` | New Traffic Light Protocol level. |
| | | | | Options: `0` (white), `1` (green), `2` (amber), `3` (red) |
| — Follow | `boolean` | No | `true` | Whether the alert becomes active when updated. |
| — Case Template | `string` | No | — | Case template to use when a case is created from this alert. |
| — Artifacts (JSON) | `string` | No | — | Artifacts as JSON string. |
| — Custom Fields (JSON) | `string` | No | — | Custom fields as JSON object. |

#### Alert: Promote

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | The ID of the alert. Supports expressions. |
| Additional Fields | `collection` | No | `{}` | Options for the case that is created. |
| — Case Template | `string` | No | — | Case template to use when promoting. |

#### Alert: Merge

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | The ID of the alert. Supports expressions. |
| Case ID (`caseId`) | `string` | Yes | — | The ID of the case to merge the alert into. Supports expressions. |

#### Alert: Mark as Read

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | The ID of the alert. Supports expressions. |

#### Alert: Mark as Unread

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | The ID of the alert. Supports expressions. |

#### Alert: Execute Responder

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Alert ID | `string` | Yes | — | The ID of the alert. Supports expressions. |
| Responder ID | `string` | Yes | — | ID of the Cortex responder to execute. Use GET /connector/cortex/responder/{type}/{id} to list available responders. |

#### Case: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Title | `string` | Yes | — | Title of the case. Supports expressions. |
| Description | `string` | Yes | — | Description of the case. Supports expressions. |
| Severity | `options` | Yes | `2` | Severity of the case. |
| | | | | Options: `1` (low), `2` (medium), `3` (high) |
| Start Date | `string` | Yes | — | Start date of the case (ISO 8601). |
| Owner | `string` | Yes | — | Owner of the case. |
| Flag | `boolean` | Yes | `false` | Whether to flag the case. |
| TLP | `options` | Yes | `2` | Traffic Light Protocol level. |
| | | | | Options: `0` (white), `1` (green), `2` (amber), `3` (red) |
| Tags | `string` | Yes | — | Comma-separated tags. |
| JSON Parameters | `boolean` | No | `true` | Whether to pass custom fields as JSON. |
| Options | `collection` | No | `{}` | Optional case fields. |
| — End Date | `string` | No | — | Resolution date (ISO 8601). |
| — Summary | `string` | No | — | Summary of the case. |
| — Metrics (JSON) | `json` | No | `[]` | Case metrics as a JSON array. |
| — Custom Fields (JSON) | `string` | No | — | Custom fields as a JSON object. |

#### Case: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID (`id`) | `string` | Yes | — | ID of the case. Supports expressions. |

#### Case: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to the limit. |
| Limit | `number` | No | `100` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters | `collection` | No | `{}` | Narrows the case list. |
| — Title | `string` | No | — | Match on the case title. |
| — Description | `string` | No | — | Match on the case description. |
| — Severity | `options` | No | `2` | Match on severity. |
| | | | | Options: `1` (low), `2` (medium), `3` (high) |
| — Tags | `string` | No | — | Match on tags. |
| — TLP | `options` | No | `2` | Match on Traffic Light Protocol level. |
| | | | | Options: `0` (white), `1` (green), `2` (amber), `3` (red) |
| — Status | `options` | No | `Open` | Match on case status. |
| | | | | Options: `Open`, `Resolved`, `Deleted` |
| — Owner | `string` | No | — | Match on owner. |
| — Flag | `boolean` | No | `false` | Match on the flag. |
| — Start Date | `string` | No | — | Match on start date. |
| — End Date | `string` | No | — | Match on end date. |
| — Summary | `string` | No | — | Match on summary. |
| — Impact Status | `options` | No | — | Match on impact status. |
| | | | | Options: `NoImpact`, `WithImpact`, `NotApplicable` |
| — Resolution Status | `options` | No | — | Match on resolution status. |
| | | | | Options: `Duplicated`, `FalsePositive`, `Indeterminate`, `Other`, `TruePositive` |
| — Custom Fields (JSON) | `string` | No | — | Match on custom fields, given as a JSON object. |
| Options | `collection` | No | `{}` | Sorting for the result list. |
| — Sort | `string` | No | — | Sort attribute with prefix: + for asc, - for desc. Example: +status or -date. |

#### Case: Count

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Filters | `collection` | No | `{}` | Narrows what is counted — the same sub-fields as Case: Get Many above. |

#### Case: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID (`id`) | `string` | Yes | — | ID of the case. Supports expressions. |
| JSON Parameters | `boolean` | No | `true` | Whether to pass custom fields as JSON. |
| Update Fields | `collection` | No | `{}` | Values to change on the case. |
| — Title | `string` | No | — | New title. |
| — Description | `string` | No | — | New description. |
| — Severity | `options` | No | `2` | New severity. |
| | | | | Options: `1` (low), `2` (medium), `3` (high) |
| — Start Date | `string` | No | — | New start date. |
| — End Date | `string` | No | — | Resolution date. |
| — Owner | `string` | No | — | New owner. |
| — Flag | `boolean` | No | `false` | Whether the case is flagged. |
| — TLP | `options` | No | `2` | New Traffic Light Protocol level. |
| | | | | Options: `0` (white), `1` (green), `2` (amber), `3` (red) |
| — Tags | `string` | No | — | New comma-separated tags. |
| — Status | `options` | No | `Open` | New case status. |
| | | | | Options: `Open`, `Resolved`, `Deleted` |
| — Summary | `string` | No | — | New summary. |
| — Impact Status | `options` | No | — | Impact assessment. |
| | | | | Options: `NoImpact`, `WithImpact`, `NotApplicable` |
| — Resolution Status | `options` | No | — | How the case was resolved. |
| | | | | Options: `Duplicated`, `FalsePositive`, `Indeterminate`, `Other`, `TruePositive` |
| — Metrics (JSON) | `json` | No | `[]` | Case metrics as a JSON array. |
| — Custom Fields (JSON) | `string` | No | — | Custom fields as a JSON object. |

#### Case: Execute Responder

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID (`id`) | `string` | Yes | — | ID of the case. Supports expressions. |
| Responder ID | `string` | Yes | — | ID of the Cortex responder to execute. |

#### Observable: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID (`caseId`) | `string` | Yes | — | ID of the case. Supports expressions. |
| Data Type | `string` | Yes | — | Type of the observable (e.g., ip, domain, url, file, hash, mail, etc.). Use "file" for binary upload. |
| Data | `string` | Yes | — | Observable data value (e.g., IP address, domain name, URL). _(hidden when Data Type is `file`)_ |
| Binary Property | `string` | Yes | `data` | Name of the binary property on the input item containing the file to upload. _(shown when Data Type is `file`)_ |
| Message | `string` | Yes | — | Description of the observable in the context of the case. |
| Start Date | `string` | Yes | — | Start date (ISO 8601). |
| TLP | `options` | Yes | `2` | Traffic Light Protocol level. |
| | | | | Options: `0` (white), `1` (green), `2` (amber), `3` (red) |
| IOC | `boolean` | Yes | `false` | Whether the observable is an Indicator of Compromise. |
| Sighted | `boolean` | Yes | `false` | Whether the observable has been sighted. |
| Status | `options` | Yes | `Ok` | Status of the observable. |
| | | | | Options: `Ok`, `Deleted` |
| Options | `collection` | No | `{}` | Optional observable fields. |
| — Tags | `string` | No | — | Comma-separated tags. |

#### Observable: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Observable ID | `string` | Yes | — | ID of the observable. Supports expressions. |

#### Observable: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID (`caseId`) | `string` | Yes | — | ID of the case whose observables to list. Supports expressions. |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to the limit. |
| Limit | `number` | No | `100` | Max number of results to return. _(shown when Return All is `false`)_ |
| Options | `collection` | No | `{}` | Sorting for the result list. |
| — Sort | `string` | No | — | Sort attribute with prefix: + for asc, - for desc. Example: +status or -date. |

#### Observable: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to the limit. |
| Limit | `number` | No | `100` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters | `collection` | No | `{}` | What to search for. |
| — Data Type | `string` | No | — | Comma-separated data type filter. |
| — Value | `string` | No | — | Match on the observable's value. |
| — Description | `string` | No | — | Match on the description. |
| — Keyword | `string` | No | — | Free-text keyword search. |
| — Message | `string` | No | — | Match on the message. |
| — Tags | `string` | No | — | Match on tags. |
| — IOC | `boolean` | No | `false` | Match on the IOC flag. |
| — Sighted | `boolean` | No | `false` | Match on the sighted flag. |
| — TLP | `options` | No | `2` | Match on Traffic Light Protocol level. |
| | | | | Options: `0` (white), `1` (green), `2` (amber), `3` (red) |
| — Status (`Status`) | `options` | No | `Ok` | Match on status. Note the capital S in the field name. |
| | | | | Options: `Ok`, `Deleted` |
| Options | `collection` | No | `{}` | Sorting for the result list. |
| — Sort | `string` | No | — | Sort attribute with prefix: + for asc, - for desc. |

#### Observable: Count

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Filters | `collection` | No | `{}` | Narrows what is counted — the same sub-fields as Observable: Search above. |

#### Observable: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Observable ID | `string` | Yes | — | ID of the observable. Supports expressions. |
| Update Fields | `collection` | No | `{}` | Values to change on the observable. |
| — Message | `string` | No | — | New description in the context of the case. |
| — Tags | `string` | No | — | New comma-separated tags. |
| — TLP | `options` | No | `2` | New Traffic Light Protocol level. |
| | | | | Options: `0` (white), `1` (green), `2` (amber), `3` (red) |
| — IOC | `boolean` | No | `false` | Whether the observable is an Indicator of Compromise. |
| — Sighted | `boolean` | No | `false` | Whether the observable has been sighted. |
| — Status | `options` | No | `Ok` | New status. |
| | | | | Options: `Ok`, `Deleted` |

#### Observable: Execute Analyzer

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Observable ID | `string` | Yes | — | ID of the observable. Supports expressions. |
| Data Type | `string` | Yes | — | Type of the observable (e.g., ip, domain, url, file, hash, mail, etc.). |
| Analyzer IDs | `string` | Yes | — | Comma-separated analyzer IDs in format "analyzerId::cortexId". |

#### Observable: Execute Responder

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Observable ID | `string` | Yes | — | ID of the observable. Supports expressions. |
| Responder ID | `string` | Yes | — | ID of the Cortex responder to execute. |

#### Task: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID (`caseId`) | `string` | Yes | — | ID of the case. Supports expressions. |
| Title | `string` | Yes | — | Title of the task. Supports expressions. |
| Status | `options` | Yes | `Waiting` | Status of the task. |
| | | | | Options: `Waiting`, `InProgress`, `Completed`, `Cancel` |
| Flag | `boolean` | Yes | `false` | Whether to flag the task. |
| Options | `collection` | No | `{}` | Optional task fields. |
| — Description | `string` | No | — | Description of the task. |
| — Owner | `string` | No | — | Owner of the task. |
| — Start Date | `string` | No | — | Start date (ISO 8601). |
| — End Date | `string` | No | — | End date (ISO 8601). |

#### Task: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Task ID (`id`) | `string` | Yes | — | ID of the task. Supports expressions. |

#### Task: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Case ID (`caseId`) | `string` | Yes | — | ID of the case whose tasks to list. Supports expressions. |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to the limit. |
| Limit | `number` | No | `100` | Max number of results to return. _(shown when Return All is `false`)_ |
| Options | `collection` | No | `{}` | Sorting for the result list. |
| — Sort | `string` | No | — | Sort attribute with prefix: + for asc, - for desc. |

#### Task: Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to the limit. |
| Limit | `number` | No | `100` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters | `collection` | No | `{}` | What to search for. |
| — Title | `string` | No | — | Match on the task title. |
| — Description | `string` | No | — | Match on the description. |
| — Owner | `string` | No | — | Match on the owner. |
| — Status | `options` | No | `Waiting` | Match on status. |
| | | | | Options: `Waiting`, `InProgress`, `Completed`, `Cancel` |
| — Flag | `boolean` | No | `false` | Match on the flag. |
| — Start Date | `string` | No | — | Match on start date. |
| — End Date | `string` | No | — | Match on end date. |
| Options | `collection` | No | `{}` | Sorting for the result list. |
| — Sort | `string` | No | — | Sort attribute with prefix: + for asc, - for desc. |

#### Task: Count

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Filters | `collection` | No | `{}` | Narrows what is counted — the same sub-fields as Task: Search above. |

#### Task: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Task ID (`id`) | `string` | Yes | — | ID of the task. Supports expressions. |
| Update Fields | `collection` | No | `{}` | Values to change on the task. |
| — Title | `string` | No | — | New title. |
| — Description | `string` | No | — | New description. |
| — Owner | `string` | No | — | New owner. |
| — Status | `options` | No | `Waiting` | New status. |
| | | | | Options: `Waiting`, `InProgress`, `Completed`, `Cancel` |
| — Flag | `boolean` | No | `false` | Whether the task is flagged. |
| — Start Date | `string` | No | — | New start date. |
| — End Date | `string` | No | — | New end date. |

#### Task: Execute Responder

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Task ID (`id`) | `string` | Yes | — | ID of the task. Supports expressions. |
| Responder ID | `string` | Yes | — | ID of the Cortex responder to execute. |

#### Log: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Task ID (`taskId`) | `string` | Yes | — | ID of the task the log belongs to. Supports expressions. |
| Message | `string` | Yes | — | Content of the log. Supports expressions. |
| Start Date | `string` | Yes | — | Date of the log submission (ISO 8601). |
| Status | `options` | Yes | `Ok` | Status of the log. |
| | | | | Options: `Ok`, `Deleted` |
| Options | `collection` | No | `{}` | Optional log fields. |
| — Attachment Binary Property | `string` | No | — | Name of the binary property on the input item to attach. Leave empty for no attachment. |

#### Log: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Log ID | `string` | Yes | — | ID of the log. Supports expressions. |

#### Log: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Task ID (`taskId`) | `string` | Yes | — | ID of the task whose logs to list. Supports expressions. |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to the limit. |
| Limit | `number` | No | `100` | Max number of results to return. _(shown when Return All is `false`)_ |

#### Log: Execute Responder

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Log ID | `string` | Yes | — | ID of the log. Supports expressions. |
| Responder ID | `string` | Yes | — | ID of the Cortex responder to execute. |

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Max Concurrency | `number` | No | `5` | Maximum number of items to process concurrently. |

## Output Data

**Every operation produces exactly one output item per input item — nothing fans out.** Anything already on the item passes through, and binary data is forwarded unchanged.

- **Single-record operations** (`create`, `get`, `update`, `promote`, `merge`, `markAsRead`, `markAsUnread`, `executeAnalyzer`, `executeResponder`) merge the returned record onto the top level of the item JSON.
- **List operations** (`getAll`, `search`) put the whole list on one item as `results`, alongside `resultCount`. Use a Split Out node on `results` when you need one item per record downstream.
- **`count`** puts the number on the item as `count`.
- Endpoints that answer with no content leave `success: true` on the item.

`executeAnalyzer` accepts several analyzers at once and runs them in sequence; the item carries the **last** analyzer's job result, so run one analyzer per node when you need each result separately.

## Usage Examples

- Create a security alert in TheHive
- Get all cases with severity High
- Create a file observable with binary upload
- Execute a Cortex analyzer on an observable
- Create a task log with file attachment
- Promote an alert to a case
- Execute a Cortex responder on a case

## Example Configuration

Create an alert:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "create",
    "title": "Suspicious Network Activity",
    "description": "Detected unusual traffic patterns",
    "severity": 2,
    "tlp": 2,
    "status": "New",
    "type": "network",
    "source": "SIEM",
    "sourceRef": "{{ $json.eventId }}",
    "date": "{{ $json.detectedAt }}",
    "follow": true,
    "tags": "network,suspicious,investigation"
  }
}
```

Create an alert carrying observable artifacts and custom fields:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "create",
    "title": "Malware Detection",
    "description": "Malicious file detected on endpoint",
    "severity": 3,
    "tlp": 2,
    "status": "New",
    "type": "malware",
    "source": "EDR",
    "sourceRef": "{{ $json.eventId }}",
    "date": "{{ $json.detectedAt }}",
    "follow": true,
    "tags": "malware",
    "artifactsJson": "[{\"dataType\":\"file_hash\",\"data\":\"5d41402abc4b2a76b9719d911017c592\",\"message\":\"MD5 hash of malicious file\",\"tags\":[\"malware\",\"hash\"]}]",
    "additionalFields": {
      "caseTemplate": "malware-investigation",
      "customFieldsJson": "{\"priority\":\"high\",\"department\":\"IT\"}"
    }
  }
}
```

Update an alert:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "update",
    "id": "alert-123",
    "updateFields": {
      "title": "Updated Alert Title",
      "severity": 3,
      "status": "Updated",
      "tags": "network,confirmed,escalated"
    }
  }
}
```

Promote an alert to a case:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "promote",
    "id": "alert-123",
    "additionalFields": {
      "caseTemplate": "security-incident"
    }
  }
}
```

List new high-severity alerts:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "getAll",
    "returnAll": false,
    "limit": 50,
    "filters": {
      "severity": 3,
      "tags": "malware"
    },
    "options": {
      "sort": "-date"
    }
  }
}
```

Create a case:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "case",
    "operation": "create",
    "title": "Security Incident - Data Breach",
    "description": "Potential data breach detected in customer database",
    "severity": 3,
    "owner": "security-analyst",
    "flag": true,
    "tlp": 3,
    "startDate": "{{ $json.detectedAt }}",
    "tags": "breach,database,urgent",
    "options": {
      "summary": "Initial investigation required",
      "customFieldsJson": "{\"affectedSystems\":[\"db-prod-01\"],\"estimatedImpact\":\"high\"}"
    }
  }
}
```

Add an IP observable to a case:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "create",
    "caseId": "case-456",
    "dataType": "ip",
    "data": "192.168.1.100",
    "message": "Suspicious IP address from network logs",
    "startDate": "{{ $json.detectedAt }}",
    "ioc": true,
    "sighted": true,
    "status": "Ok",
    "tlp": 2,
    "options": {
      "tags": "network,suspicious,internal"
    }
  }
}
```

Attach a file from an upstream node as a file observable:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "create",
    "caseId": "case-456",
    "dataType": "file",
    "binaryPropertyName": "malwareFile",
    "message": "Suspected malware sample",
    "startDate": "{{ $json.detectedAt }}",
    "ioc": true,
    "sighted": false,
    "status": "Ok",
    "tlp": 3
  }
}
```

Run Cortex analyzers on an observable:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "executeAnalyzer",
    "id": "observable-789",
    "dataType": "file",
    "analyzers": "Cuckoo_Sandbox_URL_analysis::cortex-01,VirusTotal_GetReport::cortex-01"
  }
}
```

Search observables:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "search",
    "returnAll": false,
    "limit": 100,
    "filters": {
      "dataType": "ip",
      "ioc": true,
      "tlp": 2,
      "tags": "malicious"
    },
    "options": {
      "sort": "-createdAt"
    }
  }
}
```

Create an investigation task:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "task",
    "operation": "create",
    "caseId": "case-456",
    "title": "Analyze Network Logs",
    "status": "Waiting",
    "flag": false,
    "options": {
      "description": "Review network logs for the past 24 hours",
      "owner": "network-analyst",
      "startDate": "{{ $json.detectedAt }}"
    }
  }
}
```

Log progress on a task, attaching a report file:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "log",
    "operation": "create",
    "taskId": "task-101",
    "message": "Analysis completed. Found 15 suspicious connections. See attached report.",
    "startDate": "{{ $json.completedAt }}",
    "status": "Ok",
    "options": {
      "attachmentBinaryProperty": "reportFile"
    }
  }
}
```

Run a containment responder on a case:

```json
{
  "type": "thehive",
  "parameters": {
    "resource": "case",
    "operation": "executeResponder",
    "id": "case-456",
    "responder": "Block_IP::cortex-01"
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Manage security incidents in TheHive v3/v4 -- alerts, cases, observables, tasks, logs, with Cortex integration and binary file upload support.

### Alert Investigation Workflow

1. **Create Alert** — initial security event detection
2. **Get Alert Details** — retrieve full alert information
3. **Update Alert** — add analysis findings
4. **Promote to Case** — escalate for full investigation
5. **Create Observables** — add IOCs and evidence
6. **Execute Analyzers** — run automated analysis
7. **Create Tasks** — assign investigation steps
8. **Execute Responders** — take containment actions

### Custom Fields

Custom fields are supplied as a JSON object string in the **Custom Fields (JSON)** field of the relevant collection, for example `{"priority":"P1","department":"SOC","assignee":"analyst@company.com"}`. Malformed JSON fails the item rather than being silently dropped.

### API Versions

The node speaks both TheHive 3 (v0) and TheHive 4 (v1) APIs and picks the right calls for your instance. `count` is available on the v1 API only.