TheHive

Manage security incidents in TheHive v3/v4 with binary file upload support

Overview

TheHive is an open-source Security Incident Response Platform (SIRP). This tool provides full CRUD operations for alerts, cases, tasks, task logs, and observables in TheHive v3/v4. It supports binary data uploads for file-type observables and log attachments via multipart form upload (Pattern B). It integrates with Cortex for executing analyzers on observables and responders on any resource type. Supports both v0 (TheHive 3) and v1 (TheHive 4) API versions with transparent branching.

Category: Utility
Tool Name: thehive
Version: 1

Appearance: Icon: lucide-Shield | Color: #F5A623

Node Type

Action (Binary) — handles file/binary data operations

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires TheHive API credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Alert	alert
Case	case
Log	log
Observable	observable
Task	task

Operations

Operation	Value	Description
Count	count	Count records matching the filters (v1 API only)
Create	create	Create a record
Execute Analyzer	executeAnalyzer	Execute Cortex analyzers
Execute Responder	executeResponder	Execute a Cortex responder
Get	get	Get a single record
Get Many	getAll	Get many records
Mark as Read	markAsRead	Mark alert as read
Mark as Unread	markAsUnread	Mark alert as unread
Merge	merge	Merge alert into an existing case
Promote	promote	Promote alert to a case
Search	search	Search records
Update	update	Update a record

Availability per resource:

• Alert — count, create, executeResponder, get, getAll, markAsRead, markAsUnread, merge, promote, update
• Case — count, create, executeResponder, get, getAll, update
• Observable — count, create, executeAnalyzer, executeResponder, get, getAll, search, update
• Task — count, create, executeResponder, get, getAll, search, update
• Log — create, executeResponder, get, getAll

Parameters

Alert: Create

Parameter	Type	Required	Default	Description
Title	string	Yes	—	Title of the alert. Supports expressions.
Description	string	Yes	—	Description of the alert. Supports expressions.
Severity	options	Yes	2	Severity of the alert. Default=Medium.
				Options: 1 (low), 2 (medium), 3 (high)
Date	string	Yes	—	Date and time when the alert was raised (ISO 8601). Supports expressions.
Tags	string	Yes	—	Comma-separated tags for the alert.
TLP	options	Yes	2	Traffic Light Protocol level. Default=Amber.
				Options: 0 (white), 1 (green), 2 (amber), 3 (red)
Status	options	Yes	New	Status of the alert.
				Options: New, Updated, Ignored, Imported
Type	string	Yes	—	Type of the alert.
Source	string	Yes	—	Source of the alert.
Source Reference	string	Yes	—	Source reference of the alert.
Follow	boolean	Yes	true	Whether the alert becomes active when updated.
Artifacts (JSON)	json	No	[]	Observable artifacts as JSON array. Each object: { dataType, data, message, tags }.
JSON Parameters	boolean	No	true	Whether to pass custom fields as JSON.
Additional Fields	collection	No	{}	Optional alert settings.
— Case Template	string	No	—	Case template to use when a case is created from this alert.
— Custom Fields (JSON)	string	No	—	Custom fields as JSON object: { “fieldRef”: value }.

Alert: Get

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	The ID of the alert. Supports expressions.
Options	collection	No	{}	Extra detail to request.
— Include Similar Cases	boolean	No	false	Whether to include similar cases in the response.

Alert: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Filters	collection	No	{}	Narrows the alert list.
— Title	string	No	—	Match on the alert title.
— Description	string	No	—	Match on the alert description.
— Severity	options	No	2	Match on severity.
				Options: 1 (low), 2 (medium), 3 (high)
— Tags	string	No	—	Match on tags.
— TLP	options	No	2	Match on Traffic Light Protocol level.
				Options: 0 (white), 1 (green), 2 (amber), 3 (red)
— Follow	boolean	No	false	Match on the follow flag.
— Custom Fields (JSON)	string	No	—	Match on custom fields, given as a JSON object.
Options	collection	No	{}	Sorting for the result list.
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc. Example: +status or -date.

Alert: Count

Parameter	Type	Required	Default	Description
Filters	collection	No	{}	Narrows what is counted — the same sub-fields as Alert: Get Many above.

Alert: Update

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	The ID of the alert. Supports expressions.
JSON Parameters	boolean	No	true	Whether to pass custom fields as JSON.
Update Fields	collection	No	{}	Values to change on the alert.
— Title	string	No	—	New title.
— Description	string	No	—	New description.
— Severity	options	No	2	New severity.
				Options: 1 (low), 2 (medium), 3 (high)
— Status	options	No	New	New status.
				Options: New, Updated, Ignored, Imported
— Tags	string	No	—	New comma-separated tags.
— TLP	options	No	2	New Traffic Light Protocol level.
				Options: 0 (white), 1 (green), 2 (amber), 3 (red)
— Follow	boolean	No	true	Whether the alert becomes active when updated.
— Case Template	string	No	—	Case template to use when a case is created from this alert.
— Artifacts (JSON)	string	No	—	Artifacts as JSON string.
— Custom Fields (JSON)	string	No	—	Custom fields as JSON object.

Alert: Promote

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	The ID of the alert. Supports expressions.
Additional Fields	collection	No	{}	Options for the case that is created.
— Case Template	string	No	—	Case template to use when promoting.

Alert: Merge

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	The ID of the alert. Supports expressions.
Case ID (caseId)	string	Yes	—	The ID of the case to merge the alert into. Supports expressions.

Alert: Mark as Read

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	The ID of the alert. Supports expressions.

Alert: Mark as Unread

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	The ID of the alert. Supports expressions.

Alert: Execute Responder

Parameter	Type	Required	Default	Description
Alert ID	string	Yes	—	The ID of the alert. Supports expressions.
Responder ID	string	Yes	—	ID of the Cortex responder to execute. Use GET /connector/cortex/responder/{type}/{id} to list available responders.

Case: Create

Parameter	Type	Required	Default	Description
Title	string	Yes	—	Title of the case. Supports expressions.
Description	string	Yes	—	Description of the case. Supports expressions.
Severity	options	Yes	2	Severity of the case.
				Options: 1 (low), 2 (medium), 3 (high)
Start Date	string	Yes	—	Start date of the case (ISO 8601).
Owner	string	Yes	—	Owner of the case.
Flag	boolean	Yes	false	Whether to flag the case.
TLP	options	Yes	2	Traffic Light Protocol level.
				Options: 0 (white), 1 (green), 2 (amber), 3 (red)
Tags	string	Yes	—	Comma-separated tags.
JSON Parameters	boolean	No	true	Whether to pass custom fields as JSON.
Options	collection	No	{}	Optional case fields.
— End Date	string	No	—	Resolution date (ISO 8601).
— Summary	string	No	—	Summary of the case.
— Metrics (JSON)	json	No	[]	Case metrics as a JSON array.
— Custom Fields (JSON)	string	No	—	Custom fields as a JSON object.

Case: Get

Parameter	Type	Required	Default	Description
Case ID (id)	string	Yes	—	ID of the case. Supports expressions.

Case: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Filters	collection	No	{}	Narrows the case list.
— Title	string	No	—	Match on the case title.
— Description	string	No	—	Match on the case description.
— Severity	options	No	2	Match on severity.
				Options: 1 (low), 2 (medium), 3 (high)
— Tags	string	No	—	Match on tags.
— TLP	options	No	2	Match on Traffic Light Protocol level.
				Options: 0 (white), 1 (green), 2 (amber), 3 (red)
— Status	options	No	Open	Match on case status.
				Options: Open, Resolved, Deleted
— Owner	string	No	—	Match on owner.
— Flag	boolean	No	false	Match on the flag.
— Start Date	string	No	—	Match on start date.
— End Date	string	No	—	Match on end date.
— Summary	string	No	—	Match on summary.
— Impact Status	options	No	—	Match on impact status.
				Options: NoImpact, WithImpact, NotApplicable
— Resolution Status	options	No	—	Match on resolution status.
				Options: Duplicated, FalsePositive, Indeterminate, Other, TruePositive
— Custom Fields (JSON)	string	No	—	Match on custom fields, given as a JSON object.
Options	collection	No	{}	Sorting for the result list.
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc. Example: +status or -date.

Case: Count

Parameter	Type	Required	Default	Description
Filters	collection	No	{}	Narrows what is counted — the same sub-fields as Case: Get Many above.

Case: Update

Parameter	Type	Required	Default	Description
Case ID (id)	string	Yes	—	ID of the case. Supports expressions.
JSON Parameters	boolean	No	true	Whether to pass custom fields as JSON.
Update Fields	collection	No	{}	Values to change on the case.
— Title	string	No	—	New title.
— Description	string	No	—	New description.
— Severity	options	No	2	New severity.
				Options: 1 (low), 2 (medium), 3 (high)
— Start Date	string	No	—	New start date.
— End Date	string	No	—	Resolution date.
— Owner	string	No	—	New owner.
— Flag	boolean	No	false	Whether the case is flagged.
— TLP	options	No	2	New Traffic Light Protocol level.
				Options: 0 (white), 1 (green), 2 (amber), 3 (red)
— Tags	string	No	—	New comma-separated tags.
— Status	options	No	Open	New case status.
				Options: Open, Resolved, Deleted
— Summary	string	No	—	New summary.
— Impact Status	options	No	—	Impact assessment.
				Options: NoImpact, WithImpact, NotApplicable
— Resolution Status	options	No	—	How the case was resolved.
				Options: Duplicated, FalsePositive, Indeterminate, Other, TruePositive
— Metrics (JSON)	json	No	[]	Case metrics as a JSON array.
— Custom Fields (JSON)	string	No	—	Custom fields as a JSON object.

Case: Execute Responder

Parameter	Type	Required	Default	Description
Case ID (id)	string	Yes	—	ID of the case. Supports expressions.
Responder ID	string	Yes	—	ID of the Cortex responder to execute.

Observable: Create

Parameter	Type	Required	Default	Description
Case ID (caseId)	string	Yes	—	ID of the case. Supports expressions.
Data Type	string	Yes	—	Type of the observable (e.g., ip, domain, url, file, hash, mail, etc.). Use “file” for binary upload.
Data	string	Yes	—	Observable data value (e.g., IP address, domain name, URL). (hidden when Data Type is file)
Binary Property	string	Yes	data	Name of the binary property on the input item containing the file to upload. (shown when Data Type is file)
Message	string	Yes	—	Description of the observable in the context of the case.
Start Date	string	Yes	—	Start date (ISO 8601).
TLP	options	Yes	2	Traffic Light Protocol level.
				Options: 0 (white), 1 (green), 2 (amber), 3 (red)
IOC	boolean	Yes	false	Whether the observable is an Indicator of Compromise.
Sighted	boolean	Yes	false	Whether the observable has been sighted.
Status	options	Yes	Ok	Status of the observable.
				Options: Ok, Deleted
Options	collection	No	{}	Optional observable fields.
— Tags	string	No	—	Comma-separated tags.

Observable: Get

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the observable. Supports expressions.

Observable: Get Many

Parameter	Type	Required	Default	Description
Case ID (caseId)	string	Yes	—	ID of the case whose observables to list. Supports expressions.
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Options	collection	No	{}	Sorting for the result list.
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc. Example: +status or -date.

Observable: Search

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Filters	collection	No	{}	What to search for.
— Data Type	string	No	—	Comma-separated data type filter.
— Value	string	No	—	Match on the observable’s value.
— Description	string	No	—	Match on the description.
— Keyword	string	No	—	Free-text keyword search.
— Message	string	No	—	Match on the message.
— Tags	string	No	—	Match on tags.
— IOC	boolean	No	false	Match on the IOC flag.
— Sighted	boolean	No	false	Match on the sighted flag.
— TLP	options	No	2	Match on Traffic Light Protocol level.
				Options: 0 (white), 1 (green), 2 (amber), 3 (red)
— Status (Status)	options	No	Ok	Match on status. Note the capital S in the field name.
				Options: Ok, Deleted
Options	collection	No	{}	Sorting for the result list.
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc.

Observable: Count

Parameter	Type	Required	Default	Description
Filters	collection	No	{}	Narrows what is counted — the same sub-fields as Observable: Search above.

Observable: Update

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the observable. Supports expressions.
Update Fields	collection	No	{}	Values to change on the observable.
— Message	string	No	—	New description in the context of the case.
— Tags	string	No	—	New comma-separated tags.
— TLP	options	No	2	New Traffic Light Protocol level.
				Options: 0 (white), 1 (green), 2 (amber), 3 (red)
— IOC	boolean	No	false	Whether the observable is an Indicator of Compromise.
— Sighted	boolean	No	false	Whether the observable has been sighted.
— Status	options	No	Ok	New status.
				Options: Ok, Deleted

Observable: Execute Analyzer

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the observable. Supports expressions.
Data Type	string	Yes	—	Type of the observable (e.g., ip, domain, url, file, hash, mail, etc.).
Analyzer IDs	string	Yes	—	Comma-separated analyzer IDs in format “analyzerId::cortexId”.

Observable: Execute Responder

Parameter	Type	Required	Default	Description
Observable ID	string	Yes	—	ID of the observable. Supports expressions.
Responder ID	string	Yes	—	ID of the Cortex responder to execute.

Task: Create

Parameter	Type	Required	Default	Description
Case ID (caseId)	string	Yes	—	ID of the case. Supports expressions.
Title	string	Yes	—	Title of the task. Supports expressions.
Status	options	Yes	Waiting	Status of the task.
				Options: Waiting, InProgress, Completed, Cancel
Flag	boolean	Yes	false	Whether to flag the task.
Options	collection	No	{}	Optional task fields.
— Description	string	No	—	Description of the task.
— Owner	string	No	—	Owner of the task.
— Start Date	string	No	—	Start date (ISO 8601).
— End Date	string	No	—	End date (ISO 8601).

Task: Get

Parameter	Type	Required	Default	Description
Task ID (id)	string	Yes	—	ID of the task. Supports expressions.

Task: Get Many

Parameter	Type	Required	Default	Description
Case ID (caseId)	string	Yes	—	ID of the case whose tasks to list. Supports expressions.
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Options	collection	No	{}	Sorting for the result list.
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc.

Task: Search

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)
Filters	collection	No	{}	What to search for.
— Title	string	No	—	Match on the task title.
— Description	string	No	—	Match on the description.
— Owner	string	No	—	Match on the owner.
— Status	options	No	Waiting	Match on status.
				Options: Waiting, InProgress, Completed, Cancel
— Flag	boolean	No	false	Match on the flag.
— Start Date	string	No	—	Match on start date.
— End Date	string	No	—	Match on end date.
Options	collection	No	{}	Sorting for the result list.
— Sort	string	No	—	Sort attribute with prefix: + for asc, - for desc.

Task: Count

Parameter	Type	Required	Default	Description
Filters	collection	No	{}	Narrows what is counted — the same sub-fields as Task: Search above.

Task: Update

Parameter	Type	Required	Default	Description
Task ID (id)	string	Yes	—	ID of the task. Supports expressions.
Update Fields	collection	No	{}	Values to change on the task.
— Title	string	No	—	New title.
— Description	string	No	—	New description.
— Owner	string	No	—	New owner.
— Status	options	No	Waiting	New status.
				Options: Waiting, InProgress, Completed, Cancel
— Flag	boolean	No	false	Whether the task is flagged.
— Start Date	string	No	—	New start date.
— End Date	string	No	—	New end date.

Task: Execute Responder

Parameter	Type	Required	Default	Description
Task ID (id)	string	Yes	—	ID of the task. Supports expressions.
Responder ID	string	Yes	—	ID of the Cortex responder to execute.

Log: Create

Parameter	Type	Required	Default	Description
Task ID (taskId)	string	Yes	—	ID of the task the log belongs to. Supports expressions.
Message	string	Yes	—	Content of the log. Supports expressions.
Start Date	string	Yes	—	Date of the log submission (ISO 8601).
Status	options	Yes	Ok	Status of the log.
				Options: Ok, Deleted
Options	collection	No	{}	Optional log fields.
— Attachment Binary Property	string	No	—	Name of the binary property on the input item to attach. Leave empty for no attachment.

Log: Get

Parameter	Type	Required	Default	Description
Log ID	string	Yes	—	ID of the log. Supports expressions.

Log: Get Many

Parameter	Type	Required	Default	Description
Task ID (taskId)	string	Yes	—	ID of the task whose logs to list. Supports expressions.
Return All	boolean	No	false	Whether to return all results or only up to the limit.
Limit	number	No	100	Max number of results to return. (shown when Return All is false)

Log: Execute Responder

Parameter	Type	Required	Default	Description
Log ID	string	Yes	—	ID of the log. Supports expressions.
Responder ID	string	Yes	—	ID of the Cortex responder to execute.

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	number	No	5	Maximum number of items to process concurrently.

Output Data

Every operation produces exactly one output item per input item — nothing fans out. Anything already on the item passes through, and binary data is forwarded unchanged.

• Single-record operations (create, get, update, promote, merge, markAsRead, markAsUnread, executeAnalyzer, executeResponder) merge the returned record onto the top level of the item JSON.
• List operations (getAll, search) put the whole list on one item as results, alongside resultCount. Use a Split Out node on results when you need one item per record downstream.
• count puts the number on the item as count.
• Endpoints that answer with no content leave success: true on the item.

executeAnalyzer accepts several analyzers at once and runs them in sequence; the item carries the last analyzer’s job result, so run one analyzer per node when you need each result separately.

Usage Examples

• Create a security alert in TheHive
• Get all cases with severity High
• Create a file observable with binary upload
• Execute a Cortex analyzer on an observable
• Create a task log with file attachment
• Promote an alert to a case
• Execute a Cortex responder on a case

Example Configuration

Create an alert:

{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "create",
    "title": "Suspicious Network Activity",
    "description": "Detected unusual traffic patterns",
    "severity": 2,
    "tlp": 2,
    "status": "New",
    "type": "network",
    "source": "SIEM",
    "sourceRef": "{{ $json.eventId }}",
    "date": "{{ $json.detectedAt }}",
    "follow": true,
    "tags": "network,suspicious,investigation"
  }
}

Create an alert carrying observable artifacts and custom fields:

{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "create",
    "title": "Malware Detection",
    "description": "Malicious file detected on endpoint",
    "severity": 3,
    "tlp": 2,
    "status": "New",
    "type": "malware",
    "source": "EDR",
    "sourceRef": "{{ $json.eventId }}",
    "date": "{{ $json.detectedAt }}",
    "follow": true,
    "tags": "malware",
    "artifactsJson": "[{\"dataType\":\"file_hash\",\"data\":\"5d41402abc4b2a76b9719d911017c592\",\"message\":\"MD5 hash of malicious file\",\"tags\":[\"malware\",\"hash\"]}]",
    "additionalFields": {
      "caseTemplate": "malware-investigation",
      "customFieldsJson": "{\"priority\":\"high\",\"department\":\"IT\"}"
    }
  }
}

Update an alert:

{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "update",
    "id": "alert-123",
    "updateFields": {
      "title": "Updated Alert Title",
      "severity": 3,
      "status": "Updated",
      "tags": "network,confirmed,escalated"
    }
  }
}

Promote an alert to a case:

{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "promote",
    "id": "alert-123",
    "additionalFields": {
      "caseTemplate": "security-incident"
    }
  }
}

List new high-severity alerts:

{
  "type": "thehive",
  "parameters": {
    "resource": "alert",
    "operation": "getAll",
    "returnAll": false,
    "limit": 50,
    "filters": {
      "severity": 3,
      "tags": "malware"
    },
    "options": {
      "sort": "-date"
    }
  }
}

Create a case:

{
  "type": "thehive",
  "parameters": {
    "resource": "case",
    "operation": "create",
    "title": "Security Incident - Data Breach",
    "description": "Potential data breach detected in customer database",
    "severity": 3,
    "owner": "security-analyst",
    "flag": true,
    "tlp": 3,
    "startDate": "{{ $json.detectedAt }}",
    "tags": "breach,database,urgent",
    "options": {
      "summary": "Initial investigation required",
      "customFieldsJson": "{\"affectedSystems\":[\"db-prod-01\"],\"estimatedImpact\":\"high\"}"
    }
  }
}

Add an IP observable to a case:

{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "create",
    "caseId": "case-456",
    "dataType": "ip",
    "data": "192.168.1.100",
    "message": "Suspicious IP address from network logs",
    "startDate": "{{ $json.detectedAt }}",
    "ioc": true,
    "sighted": true,
    "status": "Ok",
    "tlp": 2,
    "options": {
      "tags": "network,suspicious,internal"
    }
  }
}

Attach a file from an upstream node as a file observable:

{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "create",
    "caseId": "case-456",
    "dataType": "file",
    "binaryPropertyName": "malwareFile",
    "message": "Suspected malware sample",
    "startDate": "{{ $json.detectedAt }}",
    "ioc": true,
    "sighted": false,
    "status": "Ok",
    "tlp": 3
  }
}

Run Cortex analyzers on an observable:

{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "executeAnalyzer",
    "id": "observable-789",
    "dataType": "file",
    "analyzers": "Cuckoo_Sandbox_URL_analysis::cortex-01,VirusTotal_GetReport::cortex-01"
  }
}

Search observables:

{
  "type": "thehive",
  "parameters": {
    "resource": "observable",
    "operation": "search",
    "returnAll": false,
    "limit": 100,
    "filters": {
      "dataType": "ip",
      "ioc": true,
      "tlp": 2,
      "tags": "malicious"
    },
    "options": {
      "sort": "-createdAt"
    }
  }
}

Create an investigation task:

{
  "type": "thehive",
  "parameters": {
    "resource": "task",
    "operation": "create",
    "caseId": "case-456",
    "title": "Analyze Network Logs",
    "status": "Waiting",
    "flag": false,
    "options": {
      "description": "Review network logs for the past 24 hours",
      "owner": "network-analyst",
      "startDate": "{{ $json.detectedAt }}"
    }
  }
}

Log progress on a task, attaching a report file:

{
  "type": "thehive",
  "parameters": {
    "resource": "log",
    "operation": "create",
    "taskId": "task-101",
    "message": "Analysis completed. Found 15 suspicious connections. See attached report.",
    "startDate": "{{ $json.completedAt }}",
    "status": "Ok",
    "options": {
      "attachmentBinaryProperty": "reportFile"
    }
  }
}

Run a containment responder on a case:

{
  "type": "thehive",
  "parameters": {
    "resource": "case",
    "operation": "executeResponder",
    "id": "case-456",
    "responder": "Block_IP::cortex-01"
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

Manage security incidents in TheHive v3/v4 — alerts, cases, observables, tasks, logs, with Cortex integration and binary file upload support.

Alert Investigation Workflow

1. Create Alert — initial security event detection
2. Get Alert Details — retrieve full alert information
3. Update Alert — add analysis findings
4. Promote to Case — escalate for full investigation
5. Create Observables — add IOCs and evidence
6. Execute Analyzers — run automated analysis
7. Create Tasks — assign investigation steps
8. Execute Responders — take containment actions

Custom Fields

Custom fields are supplied as a JSON object string in the Custom Fields (JSON) field of the relevant collection, for example {"priority":"P1","department":"SOC","assignee":"analyst@company.com"}. Malformed JSON fails the item rather than being silently dropped.

API Versions

The node speaks both TheHive 3 (v0) and TheHive 4 (v1) APIs and picks the right calls for your instance. count is available on the v1 API only.