TheHive 5 n8n integrationAutomate TheHive 5 with n8n.

Pushes a new alert into TheHive from whatever raised it, a SIEM query, a reporting mailbox or a scanner, and returns the created alert so the rest of the workflow can act on it.

• Fields: the resource mapper lists the alert properties TheHive expects and lets you map each one, either to a fixed value or to an expression such as {{ $json.field }} reading the previous node.
• Observables: optional, attaches observables at creation time instead of a second call.

Removes an alert from TheHive for good. It is the operation for noise that never deserved a triage queue, such as the same scanner finding arriving twice a day.

• Alert: the resource locator, meaning you either pick the alert from the list n8n loads or pass its identifier from an earlier node.

Fires one of the responders registered on your instance against an alert, so the reaction happens inside the workflow instead of a manual click.

• Alert: the alert the responder runs on, chosen in the list or resolved from a previous node.
• Responder Name or ID: pick the responder by name in the dropdown, or pass its ID with an expression when the choice depends on what the alert contains.

Reads a single alert and returns its current state, which is how a workflow checks what changed before deciding anything.

• Alert: the alert to read, selected in the list or passed as an identifier.
• Include Similar Alerts: adds the alerts TheHive considers close to this one.
• Include Similar Cases: adds the cases TheHive considers close to this one.

Folds an existing alert into a case that is already open, so its observables and its context land in the investigation instead of a parallel queue.

• Alert: the alert being absorbed.
• Case: the destination case, picked from the list or resolved from a previous step.

Turns an alert into a full case, the moment triage stops and the investigation starts.

• Alert: the alert being promoted.
• Case Template Name or ID: optional, applies one of your case templates so the new case opens with its tasks already laid out. Pick it in the list, or pass the ID through an expression when the template depends on the alert.

Returns the alerts matching your criteria, which is how a workflow reports on a backlog or finds the one alert it needs to touch.

• Filters: conditions built from a Field, an Operator such as _eq or _like, and a Value. Dot notation in the field reaches custom fields.
• Sort: orders the result by field and Direction.
• Return All: on, n8n walks every page of alerts; off, Limit caps what comes back.

Writes new values onto an alert that already exists, leaving everything you do not map untouched.

• Fields: the resource mapper again, this time listing the alert properties that can be modified. Map only what changes, from a static value or from an expression like {{ $json.field }}.

Changes only the status of an alert, the lightest way to move it through triage.

• Alert: the alert to move.
• Status Name or ID: the target status, taken from the list your instance defines, or supplied as an ID by expression when the status depends on earlier logic.

Uploads one or more files onto an open case, so the evidence sits next to the investigation rather than in a mailbox.

• Case: the case receiving the files.
• Attachments: the binary items to upload, listed one by one.
• Attachment Field Name: the name of the binary field carrying the file in the incoming item.
• Rename Files: on, a file whose name already exists on the case gets renamed instead of colliding.

Opens a case in TheHive and returns it, which gives the workflow something to hang tasks, comments and observables on.

• Fields: the resource mapper exposes the case properties TheHive expects, each mapped to a fixed value or to data coming from the node before it.

Detaches a file from a case and deletes it.

• Case: the case holding the file.
• Attachment Name or ID: the attachment itself, chosen from the list n8n loads for that case, or given as an ID through an expression.

Deletes an entire case from TheHive, along with the tasks, comments and attachments hanging off it. There is no undo, so most teams put a manual approval step in front of it.

• Case: the case to delete, picked in the list or resolved from an identifier carried by the previous node.

Runs a responder against a whole case rather than a single alert or observable.

• Case: the case the responder acts on.
• Responder Name or ID: the responder to run, selected by name or resolved as an ID with an expression.

Fetches one case and returns its fields as they stand right now.

• Case: the case to read, taken from the list or from an identifier passed by an earlier node.

Downloads a file stored on a case and hands it to the next node as binary data.

• Case: the case holding the file.
• Attachment Name or ID: which attachment to download.
• File Name: renames the file as it is downloaded.
• Data Property Name: the binary field the file is written to, which is the name the next node has to read.

Returns the chronology TheHive keeps for a case, so a workflow reads what happened and when without rebuilding it from separate queries.

• Case: the case whose timeline you want.

Lists the cases matching your conditions, the operation most reporting workflows start from.

• Filters: conditions combining a Field, an Operator such as _gte, and a Value.
• Sort: the field plus a Direction, desc to read the newest first.
• Return All: on, every page is fetched; off, Limit stops the run short.

Applies changes to a case that already exists, field by field.

• Fields: the resource mapper lists what can be modified on a case. Anything you leave unmapped stays as it was, and the rest takes a value or an expression such as {{ $json.field }}.

Posts a comment, which is how an automated step leaves a readable trace for whoever picks the file up later.

• Add to: whether the comment lands on a case or on an alert.
• Case: the target, resolved from the list or from an identifier.
• Message: the text itself, usually assembled from the nodes before it.

Removes a comment from the case or alert it was posted on.

• Comment: the comment to delete, selected from the list or resolved as an identifier by an earlier step.

Returns comments, either across the whole instance or inside one case or one alert.

• Search in: all to scan alerts and cases together, or a narrower scope.
• Case and Alert: the object to look inside, depending on the choice above.
• Return All: on, every match comes back; off, Limit applies. Filters and Sort narrow and order the result.

Rewrites the text of a comment that is already posted.

• Comment: the comment to rewrite.
• Message: the new text, which replaces the old one entirely.

Adds an observable to a case or an alert, so the indicator sits inside the investigation instead of a chat thread.

• Case: the case that receives the observable, picked from the list or passed as an expression like {{ $json.field }}.
• Data Type: the kind of indicator, chosen from the list the node loads from your server.
• Data: the value itself.
• Attachments: files carried with the observable, added one entry at a time.
• Fields: the resource mapper where the remaining observable fields get their values.
• Create in: optional, switches the target between Case and Alert.

Removes one observable from TheHive for good. Nothing else in the case moves, only that indicator disappears from the list.

• Observable: the observable to remove, selected in the picker or built from an expression such as {{ $json.field }} when the identifier arrives from an earlier node.

Runs one or more analyzers against an observable and hands the job to TheHive instead of a human clicking through the interface.

• Observable: the observable to analyze.
• Analyzer Names or IDs: one or several analyzers, picked from the list or given as identifiers through an expression.
• Data Type: optional, the type of the observable, useful when the analyzer list depends on it.

Fires a responder, the action side of TheHive, from a single observable. The responder does the work outside n8n and the node reports that it was launched.

• Observable: the observable the responder acts on.
• Responder Name or ID: the responder to run, chosen from the list or passed as an identifier with an expression.

Reads a single observable back from TheHive, which is how a workflow checks what is currently stored before deciding anything.

• Observable: the observable to read, selected in the picker or resolved from an expression such as {{ $json.field }}.

Returns a list of observables rather than a single one, with the filters doing the narrowing on TheHive side.

• Case and Alert: the containers the search runs against.
• Search in: optional, limits the scope to one case, one alert, or both.
• Return All: on, n8n walks through every page of results; off, Limit caps how many observables come back.
• Filters and Sort: conditions and ordering rules, added one line at a time.

Changes the values already stored on an observable. Only the fields you map are touched, the rest stays as the analyst left it.

• Fields: the resource mapper that lists the observable fields and the value each one receives, typically an expression pointing at the item coming in.

Writes a documentation page, either attached to a case or filed in the knowledge base, so procedures stop living in someone's notes.

• Case: the case the page belongs to.
• Title: the page name shown in the list.
• Category: the grouping the page falls under.
• Content: the body text, often built from data collected earlier in the workflow.
• Create in: optional, Case or Knowledge Base.

Takes a page out of a case or out of the knowledge base. The case itself is untouched, only that page and its content go away.

• Case: the case the page currently sits in.
• Page: the page to remove, picked from the list or resolved through an expression.
• Delete From ...: optional, tells the node whether to look in the case or in the knowledge base.

Goes through the pages of a case, and optionally the knowledge base, and returns those that match. Handy when a workflow needs to know whether a page already exists.

• Case: the case whose pages are searched.
• Search in Knowledge Base: optional, widens the search beyond the selected case.
• Return All: on, every matching page comes back; off, Limit sets the ceiling.
• Filters and Sort: the matching conditions and the order of the results.

Edits a page that already exists, which keeps a procedure current instead of piling up near-identical copies.

• Case: the case holding the page.
• Page: the page to edit.
• Update in: optional, Case or Knowledge Base.
• Content: optional, the new body text.
• Category, Title and Order: optional, the grouping, the name and the position of the page in the list.

Sends a raw query to TheHive Query API, which is the way out when the dedicated operations stop short of what you need.

• Query: the query itself, an array of operations with the selection you want and, optionally, filtering, sorting and pagination.

Opens a task inside a case, so the next step of an investigation is assigned and visible rather than implied.

• Case: the case the task is created in, picked from the list or built from an expression such as {{ $json.field }}.
• Fields: the resource mapper listing the task fields and the value each one takes.

Pulls a task out of its case permanently. Use it on tasks an automation created, not on ones an analyst filled in.

• Task: the task to remove, selected in the picker or resolved with an expression when the identifier comes from a search step.

Launches a responder from a task rather than from an observable, which fits the actions a playbook step is supposed to trigger.

• Task: the task the responder runs on.
• Responder Name or ID: the responder to launch, chosen from the list or given as an identifier through an expression.

Fetches one task by its identifier, which is how a branch checks where a playbook step actually stands.

• Task: the task to read, selected from the list or passed as an expression like {{ $json.field }}.

Lists the tasks of a case, or of every case, with the selection done on TheHive side before anything reaches n8n.

• Case: the case whose tasks are listed.
• Search in All Cases: optional, drops the single-case restriction.
• Return All: on, n8n pages through every task; off, Limit stops the run at the number you set.
• Filters and Sort: the conditions and the ordering.

Moves a task forward by changing its status or its owner, without touching anything else in the case.

• Fields: the resource mapper that lists the task fields and the value each one receives, usually expressions pointing at the incoming item.

Evidence usually arrives after the note that describes it. This operation pushes one or more files onto a task log that already exists in TheHive, so the proof sits next to the write-up instead of in a shared drive nobody opens.

• Task Log: the log that receives the files, picked from the list or passed as an ID through an n8n expression, a value read from the incoming item such as {{ $json.id }}.
• Attachments: the collection of files to upload, one entry per file carried by the item.

Analysts type task logs by hand while they work a case. This operation writes one from the workflow, so an automated enrichment leaves the same visible trace inside the task as a human note.

• Task: the task the new log belongs to, chosen from the list or given as an ID like {{ $json.taskId }}.
• Fields: a resource mapper that fills the log content from the incoming item, field by field, with no hand-written JSON.
• Attachments: optional files sent in the same call, so the note and its supporting file arrive together.

Wrong task, duplicated note, leftover from a test run: removing a task log is sometimes the cleanest fix. The operation deletes the log itself, text and all, and there is nothing to undo afterwards.

• Task Log: the log to remove, selected from the list or resolved by ID when the workflow already carries it from a previous step.

A log can lose one file and keep its text. That is what this operation does: it detaches a single file from a task log, while the note stays readable in the task timeline.

• Task Log: the log holding the file, picked from the list or passed as an ID.
• Attachment Name or ID: the file to detach, chosen from the list n8n loads for that log, or given as an ID through an expression.

Responders are the actions TheHive can run on an object. Here the object is a task log, so a note written during an investigation becomes the input of an automated response instead of a dead end.

• Task Log: the log the responder runs against, selected from the list or resolved by ID.
• Responder Name or ID: the responder to run, picked from the list your instance exposes, or set with an expression when the choice depends on the incoming item.

Reading one log back is what makes the rest of a workflow decidable. The operation returns a single task log, and the following nodes branch on what it contains.

• Task Log: the log to read, chosen from the list or passed as an ID, typically one collected earlier in the run.

Task logs pile up fast on a long case. This operation lists them, in one task or across all of them.

• Task: the task to search in, selected from the list or given as an ID.
• Search in All Tasks: on, the scope widens to every task instead of the selected one.
• Return All: on, n8n pages through the API until every log is back; off, Limit caps how many come out.
• Filters and Sort: narrow the set with operators such as _like or _between, and order it asc or desc.