THEHIVE n8n INTEGRATION: AUTOMATE THEHIVE WITH N8N

The Update Task action allows you to modify existing tasks within TheHive cases. This is essential for automating task lifecycle management—updating statuses, reassigning ownership, or adding notes as investigations progress.

Key parameters: Task ID (required text field specifying the unique identifier), and Update Fields (optional section to select which task properties to modify such as status, title, description, assignee).

Use cases: Automatically mark tasks as "In Progress" when an analyst clicks a button in Slack, update task status to "Completed" when corresponding Jira tickets are resolved, or add automated notes to tasks documenting enrichment results from external tools.

Search for tasks across your TheHive instance using flexible filtering criteria. This action is perfect for building dashboards, generating reports, or finding tasks that match specific conditions.

Key parameters: Return All (optional toggle to fetch all matching tasks), Limit (optional number field to restrict results, default: 100), Options (add additional search parameters), and Filters (define specific criteria to narrow down results).

Use cases: Find all overdue tasks across open cases for daily standup reports, search for tasks assigned to a specific analyst for workload balancing, or identify tasks in "Waiting" status that need follow-up.

Retrieve detailed information about a specific task by its ID. Use this when you need complete task data for processing in subsequent workflow steps.

Key parameters: Task ID (required text field for the unique task identifier).

Use cases: Fetch task details before updating to preserve certain fields, pull task information to include in notification messages, or verify task status before triggering dependent actions.

Retrieve multiple tasks at once, optionally filtered by case. This bulk retrieval action is ideal for workflows that need to process or analyze multiple tasks simultaneously.

Key parameters: Case ID (optional text field to filter tasks by specific case), Return All (toggle to fetch all tasks), Limit (maximum number of tasks to retrieve, default: 100), and Options (additional configuration parameters).

Use cases: Generate task summaries for case review meetings, calculate task completion metrics for SOC performance dashboards, or identify all incomplete tasks before case closure.

Trigger a Cortex responder directly on a specific task. Responders are automated actions in TheHive's ecosystem that can perform operations like sending notifications, blocking IPs, or isolating hosts.

Key parameters: Task ID (required text field identifying the target task).

Use cases: Automatically execute containment responders when high-priority tasks are created, trigger notification responders to alert external teams about critical tasks, or chain multiple responders based on task attributes.

Create new tasks within TheHive cases programmatically. This action is fundamental for automating investigation playbooks and ensuring consistent task creation across incidents.

Key parameters: Case ID (optional field to associate the task with a specific case), Title (optional text field for the task name), Status (dropdown to set initial status such as "Waiting" or "In Progress"), Flag (toggle to mark the task as flagged/important), and Options (additional task properties).

Use cases: Automatically generate investigation task templates when new cases are created, create follow-up tasks when alerts are promoted to cases, or spawn remediation tasks based on observable analysis results.

Modify existing observables in TheHive. Update IOC status, add tags, change TLP levels, or add contextual information based on enrichment results.

Key parameters: Observable ID (required text field for the observable's unique identifier) and Update Fields (select which properties to modify).

Use cases: Mark observables as IOCs after threat intelligence confirms maliciousness, update TLP levels based on data classification workflows, or add tags from external enrichment sources.

Search across all observables in your TheHive instance using flexible criteria. Essential for threat hunting, deduplication, and cross-case correlation.

Key parameters: Return All (toggle to fetch all matching observables), Limit (maximum results, default: 100), Options (additional search configuration), and Filters (define search criteria).

Use cases: Check if an IP address has appeared in previous cases before creating duplicates, find all observables of a specific type (hashes, domains) across your instance, or generate threat intelligence reports based on observable patterns.

Retrieve complete details about a specific observable. Use this to fetch all metadata, tags, and analysis results for a known observable.

Key parameters: Observable ID (required text field for the unique identifier).

Use cases: Fetch observable details before running analyzers, pull complete observable data for external reporting, or verify observable attributes before updating.

Bulk retrieve observables, optionally filtered by case. Perfect for workflows that need to process multiple observables or generate comprehensive reports.

Key parameters: Case ID (optional filter by specific case), Return All (toggle to fetch all), Limit (maximum number of observables, default: 100), and Options (additional configuration).

Use cases: Export all case observables to a threat intelligence platform, generate IOC lists for firewall block rules, or analyze observable patterns across multiple cases.

Trigger a Cortex responder on an observable. This enables automated response actions like blocking domains, quarantining files, or sending enriched data to external systems.

Key parameters: Observable ID (required identifier for the target observable).

Use cases: Automatically block malicious IPs on firewalls when marked as IOC, trigger email notifications when critical observables are identified, or execute cleanup responders for known-bad file hashes.

Run a Cortex analyzer on an observable to gather threat intelligence and enrichment data. Analyzers can query VirusTotal, MISP, Shodan, and dozens of other sources.

Key parameters: Observable ID (required identifier for the observable to analyze) and Data Type Name or ID (specify the observable data type for analyzer compatibility).

Use cases: Automatically enrich new observables with VirusTotal reputation data, run geolocation analysis on suspicious IP addresses, or query WHOIS for domain registration details.

Add new observables to TheHive cases. This is essential for automated data ingestion from external threat feeds, SIEM alerts, or user-submitted indicators.

Key parameters: Case ID (optional association with a specific case), Data Type Name or ID (type of observable such as IP, domain, hash), Data (required - the actual observable value), Message (optional context or description), Start Date (when the observable was first observed), TLP (required Traffic Light Protocol level, default: Amber), and IOC (toggle to mark as Indicator of Compromise).

Use cases: Ingest IOCs from threat intelligence feeds automatically, create observables from SIEM alert data when promoting to cases, or add user-reported suspicious indicators from a Slack command.

Retrieve a specific log entry by ID. Logs in TheHive track investigation activities and analyst notes within tasks.

Key parameters: Log ID (optional identifier for the specific log entry).

Use cases: Fetch log content for inclusion in reports, verify log entries before performing updates, or pull analyst notes for escalation summaries.

Retrieve multiple log entries, optionally filtered by task. Useful for generating investigation timelines or audit trails.

Key parameters: Task ID (optional filter by specific task), Return All (toggle to fetch all logs), and Limit (maximum number of logs, default: 100).

Use cases: Generate investigation timeline reports, export analyst notes for compliance documentation, or review all activities on a specific task.

Trigger a Cortex responder on a specific log entry. Enable automated reactions to logged investigation activities.

Key parameters: Log ID (required identifier for the target log entry).

Use cases: Trigger alerts when specific keywords appear in logs, automate follow-up actions based on logged findings, or chain responders based on investigation progress.

Create new log entries within tasks. Logs document investigation progress, findings, and analyst activities.

Key parameters: Task ID (optional association with a specific task), Message (optional content of the log entry), Start Date (optional timestamp for the log), Status (optional status indicator such as Success, Failure, In Progress), and Options (additional log properties).

Use cases: Automatically log enrichment results from external tools, document automated actions taken by workflows, or create timestamped investigation notes from Slack inputs.

Modify existing TheHive cases. Update severity, status, custom fields, or any other case property based on workflow logic.

Key parameters: Case ID (required identifier for the target case), JSON Parameters (toggle to enable JSON-formatted field updates), and Update Fields (select specific fields to modify).

Use cases: Automatically escalate case severity when critical observables are found, update case status based on task completion percentages, or add custom field data from external enrichment sources.

Retrieve complete details about a specific case. Essential for workflows that need full case context before taking action.

Key parameters: Case ID (required identifier for the case to retrieve).

Use cases: Fetch case details for Slack notifications, pull case metadata for report generation, or verify case status before performing updates.

Bulk retrieve cases with optional filtering. Perfect for generating dashboards, reports, or processing multiple cases in batch.

Key parameters: Return All (toggle to fetch all cases), Limit (maximum number of cases, default: 100), Options (additional retrieval parameters), and Filters (define criteria to narrow results).

Use cases: Generate daily open case reports for leadership, calculate SLA compliance metrics across all cases, or identify cases requiring escalation based on age or severity.

Trigger a Cortex responder on a case. Enable automated case-level actions like notifications, escalations, or external integrations.

Key parameters: Case ID (required identifier for the target case).

Use cases: Send executive summaries when cases are closed, trigger PagerDuty alerts for critical case creation, or automate ticket creation in external systems.

Create new cases in TheHive programmatically. This is the foundation for automated incident creation from alerts, external systems, or user requests.

Key parameters: Title (text field for the case name), Description (text area for detailed case information), Severity (dropdown: Low, Medium, High, Critical), Start Date (when the incident began), Owner (assign responsibility to a specific analyst), Flag (toggle to mark as flagged/important), and TLP (required Traffic Light Protocol level, default: Amber).

Use cases: Automatically create cases from promoted SIEM alerts, generate cases from phishing reports submitted via email, or create investigation cases from threat intelligence matches.