TheHive integration

Overview

TheHive is an open-source Security Incident Response Platform (SIRP). This tool provides full CRUD operations for alerts, cases, tasks, task logs, and observables in TheHive v3/v4. It supports binary data uploads for file-type observables and log attachments via multipart form upload (Pattern B). It integrates with Cortex for executing analyzers on observables and responders on any resource type. Supports both v0 (TheHive 3) and v1 (TheHive 4) API versions with transparent branching.

Node Type

Action (Binary) — handles file/binary data operations

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires TheHive API credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Alert	alert
Case	case
Log	log
Observable	observable
Task	task

Operations

Operation	Value	Description
Count	count	Count records matching the filters (v1 API only)
Create	create	Create a record
Execute Analyzer	executeAnalyzer	Execute Cortex analyzers
Execute Responder	executeResponder	Execute a Cortex responder
Get	get	Get a single record
Get Many	getAll	Get many records
Mark as Read	markAsRead	Mark alert as read
Mark as Unread	markAsUnread	Mark alert as unread
Merge	merge	Merge alert into an existing case
Promote	promote	Promote alert to a case
Search	search	Search records
Update	update	Update a record

Availability per resource:

• Alert — count, create, executeResponder, get, getAll, markAsRead, markAsUnread, merge, promote, update
• Case — count, create, executeResponder, get, getAll, update
• Observable — count, create, executeAnalyzer, executeResponder, get, getAll, search, update
• Task — count, create, executeResponder, get, getAll, search, update
• Log — create, executeResponder, get, getAll

Parameters

Alert: Count

Parameter	Type	Required	Default	Description
Filters	collection	No	{}
				Options: 1, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Title	string	No	—
— Description	string	No	—
— Severity	options	No	2
				Options: 1, 2, 3
— Tags	string	No	—
— TLP	options	No	2
				Options: 0, 1, 2, 3
— Follow	boolean	No	false
— Custom Fields (JSON)	string	No	—

Alert: Create

Parameter	Type	Required	Default	Description
Title	string	Yes	—	Title of the alert, case or task.
Description	string	Yes	—	Description of the alert or case.
Severity	options	Yes	2	Severity of the alert or case. Default=Medium.
				Options: 1, 2, 3
Date	string	Yes	—	Date and time when the alert was raised (ISO 8601).
Tags	string	Yes	—	Comma-separated tags.
TLP	options	Yes	2	Traffic Light Protocol level. Default=Amber.
				Options: 0, 1, 2, 3
Status (alertStatus)	options	Yes	New	Status the new alert is created with: New, Updated, Ignored or Imported. Default=New.
				Options: New, Updated, Ignored, Imported
Type	string	Yes	—	Type of the alert.
Source	string	Yes	—	Source of the alert.
Source Reference	string	Yes	—	Source reference of the alert.
Follow	boolean	Yes	true	Whether the alert becomes active when updated.
Artifacts (JSON)	json	No	[]	Observable artifacts as JSON array. Each object: { dataType, data, message, tags }.
JSON Parameters	boolean	No	true	Whether to pass custom fields as JSON.
Additional Fields	collection	No	{}
— Case Template	string	No	—	Case template to use when a case is created from this alert.
— Custom Fields (JSON)	string	No	—	Custom fields as JSON object: { “fieldRef”: value }.

Alert: Execute Responder

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.
Responder ID	string	Yes	—	ID of the Cortex responder to execute. Use GET /connector/cortex/responder/{type}/{id} to list available responders.

Alert: Get

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.
Options	collection	No	{}
— Include Similar Cases	boolean	No	false

Alert: Get Many

Parameter	Type	Required	Default	Description
Filters	collection	No	{}
				Options: 1, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Title	string	No	—
— Description	string	No	—
— Severity	options	No	2
				Options: 1, 2, 3
— Tags	string	No	—
— TLP	options	No	2
				Options: 0, 1, 2, 3
— Follow	boolean	No	false
— Custom Fields (JSON)	string	No	—
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Options	collection	No	{}
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc. Example: +status or -date.

Alert: Mark as Read

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.

Alert: Mark as Unread

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.

Alert: Merge

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.
Case ID (caseId)	string	Yes	—	ID of the case that owns the observable or task, or that the alert is merged into.

Alert: Promote

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.
Additional Fields	collection	No	{}
— Case Template	string	No	—	Case template to use when promoting.

Alert: Update

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.
JSON Parameters	boolean	No	true	Whether to pass custom fields as JSON.
Update Fields	collection	No	{}
				Options: 1, New, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Title	string	No	—
— Description	string	No	—
— Severity	options	No	2
				Options: 1, 2, 3
— Status	options	No	New
				Options: New, Updated, Ignored, Imported
— Tags	string	No	—
— TLP	options	No	2
				Options: 0, 1, 2, 3
— Follow	boolean	No	true
— Case Template	string	No	—
— Artifacts (JSON)	string	No	—	Artifacts as JSON string.
— Custom Fields (JSON)	string	No	—	Custom fields as JSON object.

Case: Count

Parameter	Type	Required	Default	Description
Filters	collection	No	{}
				Options: 1, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Title	string	No	—
— Description	string	No	—
— Severity	options	No	2
				Options: 1, 2, 3
— Tags	string	No	—
— TLP	options	No	2
				Options: 0, 1, 2, 3
— Status	options	No	Open
				Options: Open, Resolved, Deleted
— Owner	string	No	—
— Flag	boolean	No	false
— Start Date	string	No	—
— End Date	string	No	—
— Summary	string	No	—
— Impact Status	options	No	—
				Options: NoImpact, WithImpact, NotApplicable
— Resolution Status	options	No	—
				Options: Duplicated, FalsePositive, Indeterminate, Other, TruePositive
— Custom Fields (JSON)	string	No	—

Case: Create

Parameter	Type	Required	Default	Description
Title	string	Yes	—	Title of the alert, case or task.
Description	string	Yes	—	Description of the alert or case.
Severity	options	Yes	2	Severity of the alert or case. Default=Medium.
				Options: 1, 2, 3
Start Date	string	Yes	—	Start date of the case or observable, or the submission date of the log (ISO 8601).
Owner	string	Yes	—	Owner of the case.
Flag	boolean	Yes	false	Whether to flag the case or task.
TLP	options	Yes	2	Traffic Light Protocol level. Default=Amber.
				Options: 0, 1, 2, 3
Tags	string	Yes	—	Comma-separated tags.
JSON Parameters	boolean	No	true
Options	collection	No	{}
— End Date	string	No	—	Resolution date (ISO 8601).
— Summary	string	No	—
— Metrics (JSON)	json	No	[]
— Custom Fields (JSON)	string	No	—

Case: Execute Responder

Parameter	Type	Required	Default	Description
Responder ID	string	Yes	—	ID of the Cortex responder to execute. Use GET /connector/cortex/responder/{type}/{id} to list available responders.
Case ID (id)	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.

Case: Get

Parameter	Type	Required	Default	Description
Case ID (id)	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.

Case: Get Many

Parameter	Type	Required	Default	Description
Filters	collection	No	{}
				Options: 1, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Title	string	No	—
— Description	string	No	—
— Severity	options	No	2
				Options: 1, 2, 3
— Tags	string	No	—
— TLP	options	No	2
				Options: 0, 1, 2, 3
— Status	options	No	Open
				Options: Open, Resolved, Deleted
— Owner	string	No	—
— Flag	boolean	No	false
— Start Date	string	No	—
— End Date	string	No	—
— Summary	string	No	—
— Impact Status	options	No	—
				Options: NoImpact, WithImpact, NotApplicable
— Resolution Status	options	No	—
				Options: Duplicated, FalsePositive, Indeterminate, Other, TruePositive
— Custom Fields (JSON)	string	No	—
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Options	collection	No	{}
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc. Example: +status or -date.

Case: Update

Parameter	Type	Required	Default	Description
Case ID (id)	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.
JSON Parameters	boolean	No	true
Update Fields	collection	No	{}
				Options: 1, New, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Title	string	No	—
— Description	string	No	—
— Severity	options	No	2
				Options: 1, 2, 3
— Start Date	string	No	—
— End Date	string	No	—
— Owner	string	No	—
— Flag	boolean	No	false
— TLP	options	No	2
				Options: 0, 1, 2, 3
— Tags	string	No	—
— Status	options	No	Open
				Options: Open, Resolved, Deleted
— Summary	string	No	—
— Impact Status	options	No	—
				Options: NoImpact, WithImpact, NotApplicable
— Resolution Status	options	No	—
				Options: Duplicated, FalsePositive, Indeterminate, Other, TruePositive
— Metrics (JSON)	json	No	[]
— Custom Fields (JSON)	string	No	—

Log: Create

Parameter	Type	Required	Default	Description
Task ID (taskId)	string	Yes	—	ID of the task.
Message	string	Yes	—	Description of the observable in its case, or the content of the log.
Start Date	string	Yes	—	Start date of the case or observable, or the submission date of the log (ISO 8601).
Status (logStatus)	options	Yes	Ok	Status the new task log is created with: Ok or Deleted. Default=Ok.
				Options: Ok, Deleted
Options	collection	No	{}
— Attachment Binary Property	string	No	—	Name of the binary property on the input item to attach. Leave empty for no attachment.

Log: Execute Responder

Parameter	Type	Required	Default	Description
Responder ID	string	Yes	—	ID of the Cortex responder to execute. Use GET /connector/cortex/responder/{type}/{id} to list available responders.
Log ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.

Log: Get

Parameter	Type	Required	Default	Description
Log ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.

Log: Get Many

Parameter	Type	Required	Default	Description
Task ID (taskId)	string	Yes	—	ID of the task.
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)

Observable: Count

Parameter	Type	Required	Default	Description
Filters	collection	No	{}
				Options: 1, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Data Type	string	No	—	Comma-separated data type filter.
— Value	string	No	—
— Description	string	No	—
— Keyword	string	No	—
— Message	string	No	—
— Tags	string	No	—
— IOC	boolean	No	false
— Sighted	boolean	No	false
— TLP	options	No	2
				Options: 0, 1, 2, 3
— Status	options	No	Ok
				Options: Ok, Deleted

Observable: Create

Parameter	Type	Required	Default	Description
Case ID (caseId)	string	Yes	—	ID of the case that owns the observable or task, or that the alert is merged into.
Data Type	string	Yes	—	Type of the observable (e.g., ip, domain, url, file, hash, mail, etc.). Use “file” for binary upload.
Data	string	Yes	—	Observable data value (e.g., IP address, domain name, URL). (hidden when Data Type is file)
Binary Property	string	Yes	data	Name of the binary property on the input item containing the file to upload. (shown when Data Type is file)
Message	string	Yes	—	Description of the observable in its case, or the content of the log.
Start Date	string	Yes	—	Start date of the case or observable, or the submission date of the log (ISO 8601).
TLP	options	Yes	2	Traffic Light Protocol level. Default=Amber.
				Options: 0, 1, 2, 3
IOC	boolean	Yes	false	Whether the observable is an Indicator of Compromise.
Sighted	boolean	Yes	false	Whether the observable has been sighted.
Status (observableStatus)	options	Yes	Ok	Status the new observable is created with: Ok or Deleted. Default=Ok.
				Options: Ok, Deleted
Options	collection	No	{}
— Tags	string	No	—	Comma-separated tags.

Observable: Execute Analyzer

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.
Data Type	string	Yes	—	Type of the observable (e.g., ip, domain, url, file, hash, mail, etc.). Use “file” for binary upload.
Analyzer IDs	string	Yes	—	Comma-separated analyzer IDs in format “analyzerId::cortexId”.

Observable: Execute Responder

Parameter	Type	Required	Default	Description
Responder ID	string	Yes	—	ID of the Cortex responder to execute. Use GET /connector/cortex/responder/{type}/{id} to list available responders.
Observable ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.

Observable: Get

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.

Observable: Get Many

Parameter	Type	Required	Default	Description
Case ID (caseId)	string	Yes	—	ID of the case that owns the observable or task, or that the alert is merged into.
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Options	collection	No	{}
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc. Example: +status or -date.

Observable: Search

Parameter	Type	Required	Default	Description
Filters	collection	No	{}
				Options: 1, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Data Type	string	No	—	Comma-separated data type filter.
— Value	string	No	—
— Description	string	No	—
— Keyword	string	No	—
— Message	string	No	—
— Tags	string	No	—
— IOC	boolean	No	false
— Sighted	boolean	No	false
— TLP	options	No	2
				Options: 0, 1, 2, 3
— Status	options	No	Ok
				Options: Ok, Deleted
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Options	collection	No	{}
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc. Example: +status or -date.

Observable: Update

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.
Update Fields	collection	No	{}
				Options: 1, New, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Message	string	No	—
— Tags	string	No	—
— TLP	options	No	2
				Options: 0, 1, 2, 3
— IOC	boolean	No	false
— Sighted	boolean	No	false
— Status	options	No	Ok
				Options: Ok, Deleted

Task: Count

Parameter	Type	Required	Default	Description
Filters	collection	No	{}
				Options: 1, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Title	string	No	—
— Description	string	No	—
— Owner	string	No	—
— Status	options	No	Waiting
				Options: Waiting, InProgress, Completed, Cancel
— Flag	boolean	No	false
— Start Date	string	No	—
— End Date	string	No	—

Task: Create

Parameter	Type	Required	Default	Description
Case ID (caseId)	string	Yes	—	ID of the case that owns the observable or task, or that the alert is merged into.
Title	string	Yes	—	Title of the alert, case or task.
Status (taskStatus)	options	Yes	Waiting	Status the new task is created with: Waiting, InProgress, Completed or Cancel. Default=Waiting.
				Options: Waiting, InProgress, Completed, Cancel
Flag	boolean	Yes	false	Whether to flag the case or task.
Options	collection	No	{}
— Description	string	No	—
— Owner	string	No	—
— Start Date	string	No	—
— End Date	string	No	—

Task: Execute Responder

Parameter	Type	Required	Default	Description
Responder ID	string	Yes	—	ID of the Cortex responder to execute. Use GET /connector/cortex/responder/{type}/{id} to list available responders.
Task ID (id)	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.

Task: Get

Parameter	Type	Required	Default	Description
Task ID (id)	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.

Task: Get Many

Parameter	Type	Required	Default	Description
Case ID (caseId)	string	Yes	—	ID of the case that owns the observable or task, or that the alert is merged into.
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Options	collection	No	{}
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc. Example: +status or -date.

Task: Search

Parameter	Type	Required	Default	Description
Filters	collection	No	{}
				Options: 1, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Title	string	No	—
— Description	string	No	—
— Owner	string	No	—
— Status	options	No	Waiting
				Options: Waiting, InProgress, Completed, Cancel
— Flag	boolean	No	false
— Start Date	string	No	—
— End Date	string	No	—
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Options	collection	No	{}
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc. Example: +status or -date.

Task: Update

Parameter	Type	Required	Default	Description
Task ID (id)	string	Yes	—	ID of the alert, case, observable, task or log the operation acts on.
Update Fields	collection	No	{}
				Options: 1, New, 0, Open, NoImpact, Duplicated, Ok, Waiting
— Title	string	No	—
— Description	string	No	—
— Owner	string	No	—
— Status	options	No	Waiting
				Options: Waiting, InProgress, Completed, Cancel
— Flag	boolean	No	false
— Start Date	string	No	—
— End Date	string	No	—

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	number	No	5	Maximum number of items to process concurrently.

Output Data

Every operation produces exactly one output item per input item — nothing fans out. Anything already on the item passes through, and binary data is forwarded unchanged.

• Single-record operations (create, get, update, promote, merge, markAsRead, markAsUnread, executeAnalyzer, executeResponder) merge the returned record onto the top level of the item JSON.
• List operations (getAll, search) put the whole list on one item as results, alongside resultCount. Use a Split Out node on results when you need one item per record downstream.
• count puts the number on the item as count.
• Endpoints that answer with no content leave success: true on the item.

executeAnalyzer accepts several analyzers at once and runs them in sequence; the item carries the last analyzer’s job result, so run one analyzer per node when you need each result separately.

Example Configuration

Create an alert:

{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "create",
    "title": "Suspicious Network Activity",
    "description": "Detected unusual traffic patterns",
    "severity": 2,
    "tlp": 2,
    "status": "New",
    "type": "network",
    "source": "SIEM",
    "sourceRef": "{{ $json.eventId }}",
    "date": "{{ $json.detectedAt }}",
    "follow": true,
    "tags": "network,suspicious,investigation"
  }
}

Create an alert carrying observable artifacts and custom fields:

{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "create",
    "title": "Malware Detection",
    "description": "Malicious file detected on endpoint",
    "severity": 3,
    "tlp": 2,
    "status": "New",
    "type": "malware",
    "source": "EDR",
    "sourceRef": "{{ $json.eventId }}",
    "date": "{{ $json.detectedAt }}",
    "follow": true,
    "tags": "malware",
    "artifactsJson": "[{\"dataType\":\"file_hash\",\"data\":\"5d41402abc4b2a76b9719d911017c592\",\"message\":\"MD5 hash of malicious file\",\"tags\":[\"malware\",\"hash\"]}]",
    "additionalFields": {
      "caseTemplate": "malware-investigation",
      "customFieldsJson": "{\"priority\":\"high\",\"department\":\"IT\"}"
    }
  }
}

Update an alert:

{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "update",
    "id": "alert-123",
    "updateFields": {
      "title": "Updated Alert Title",
      "severity": 3,
      "status": "Updated",
      "tags": "network,confirmed,escalated"
    }
  }
}

Promote an alert to a case:

{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "promote",
    "id": "alert-123",
    "additionalFields": {
      "caseTemplate": "security-incident"
    }
  }
}

List new high-severity alerts:

{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "getAll",
    "returnAll": false,
    "limit": 50,
    "filters": {
      "severity": 3,
      "tags": "malware"
    },
    "options": {
      "sort": "-date"
    }
  }
}

Create a case:

{
  "type": "thehive",
  "parameters": {
    "resource": "case",
    "operation": "create",
    "title": "Security Incident - Data Breach",
    "description": "Potential data breach detected in customer database",
    "severity": 3,
    "owner": "security-analyst",
    "flag": true,
    "tlp": 3,
    "startDate": "{{ $json.detectedAt }}",
    "tags": "breach,database,urgent",
    "options": {
      "summary": "Initial investigation required",
      "customFieldsJson": "{\"affectedSystems\":[\"db-prod-01\"],\"estimatedImpact\":\"high\"}"
    }
  }
}

Add an IP observable to a case:

{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "create",
    "caseId": "case-456",
    "dataType": "ip",
    "data": "192.168.1.100",
    "message": "Suspicious IP address from network logs",
    "startDate": "{{ $json.detectedAt }}",
    "ioc": true,
    "sighted": true,
    "status": "Ok",
    "tlp": 2,
    "options": {
      "tags": "network,suspicious,internal"
    }
  }
}

Attach a file from an upstream node as a file observable:

{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "create",
    "caseId": "case-456",
    "dataType": "file",
    "binaryPropertyName": "malwareFile",
    "message": "Suspected malware sample",
    "startDate": "{{ $json.detectedAt }}",
    "ioc": true,
    "sighted": false,
    "status": "Ok",
    "tlp": 3
  }
}

Run Cortex analyzers on an observable:

{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "executeAnalyzer",
    "id": "observable-789",
    "dataType": "file",
    "analyzers": "Cuckoo_Sandbox_URL_analysis::cortex-01,VirusTotal_GetReport::cortex-01"
  }
}

Search observables:

{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "search",
    "returnAll": false,
    "limit": 100,
    "filters": {
      "dataType": "ip",
      "ioc": true,
      "tlp": 2,
      "tags": "malicious"
    },
    "options": {
      "sort": "-createdAt"
    }
  }
}

Create an investigation task:

{
  "type": "thehive",
  "parameters": {
    "resource": "task",
    "operation": "create",
    "caseId": "case-456",
    "title": "Analyze Network Logs",
    "status": "Waiting",
    "flag": false,
    "options": {
      "description": "Review network logs for the past 24 hours",
      "owner": "network-analyst",
      "startDate": "{{ $json.detectedAt }}"
    }
  }
}

Log progress on a task, attaching a report file:

{
  "type": "thehive",
  "parameters": {
    "resource": "log",
    "operation": "create",
    "taskId": "task-101",
    "message": "Analysis completed. Found 15 suspicious connections. See attached report.",
    "startDate": "{{ $json.completedAt }}",
    "status": "Ok",
    "options": {
      "attachmentBinaryProperty": "reportFile"
    }
  }
}

Run a containment responder on a case:

{
  "type": "thehive",
  "parameters": {
    "resource": "case",
    "operation": "executeResponder",
    "id": "case-456",
    "responder": "Block_IP::cortex-01"
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

This tool manages security incidents by creating, getting, and updating alerts, cases, observables, and tasks, and by creating and getting logs within TheHive. It is ideal for managing incident response workflows, including executing Cortex analyzers on observables and responders on various resources, and uploading binary files for observables or log attachments. The tool produces updated incident data, new alerts, cases, tasks, observables, and logs, or the results from Cortex analyzer and responder executions.

Alert Investigation Workflow

1. Create Alert — initial security event detection
2. Get Alert Details — retrieve full alert information
3. Update Alert — add analysis findings
4. Promote to Case — escalate for full investigation
5. Create Observables — add IOCs and evidence
6. Execute Analyzers — run automated analysis
7. Create Tasks — assign investigation steps
8. Execute Responders — take containment actions

Custom Fields

Custom fields are supplied as a JSON object string in the Custom Fields (JSON) field of the relevant collection, for example {"priority":"P1","department":"SOC","assignee":"analyst@company.com"}. Malformed JSON fails the item rather than being silently dropped.

API Versions

The node speaks both TheHive 3 (v0) and TheHive 4 (v1) APIs and picks the right calls for your instance. count is available on the v1 API only.