Resources · n8n integration

TheHive n8n integrationAutomate TheHive with n8n.

Every alert raised in TheHive can start an n8n workflow. The TheHive n8n integration pairs a trigger node listening to 14 events across alerts, cases, tasks, logs and observables with a node that exposes 4 Log operations. Built for security teams tired of copying findings by hand.

Try the TheHive integration on n8nSee the 4 operations

Verified Trustpilot reviews · AI, automation & growth agency

Why automate

What does the TheHive n8n integration actually do?

The TheHive n8n integration connects your incident response platform to the rest of the toolchain. One node reads and writes inside TheHive, a second node starts a workflow the moment something moves in an alert, a case or a task. Both talk to TheHive 3 and TheHive 4, through an API key created in your own instance.

Start with triage. An analyst receives a phishing report, an alert lands in TheHive, and alert_create fires the workflow. n8n queries your threat intelligence sources, then writes the verdict straight into the investigation task with Create a log. A short summary goes to the on-call channel through the Slack node, so nobody refreshes a dashboard waiting for news.

Second pattern: the audit trail. Compliance asks what happened on a case and when. Get many logs pulls every entry attached to a task, Return All walks through the pages of the API instead of stopping at the first batch, and the result lands in a Postgres table or a Google Sheets tab that anyone can read without a TheHive account.

Third pattern: responders. TheHive lets you attach responders to an object, and Execute a responder fires one on a specific log from a workflow. Useful when a decision has already been made elsewhere, in a ticket or in an approval step, and the action just has to be applied without an analyst clicking through the interface.

Now the honest part. The catalogue exposes 4 operations, all on the Log resource. The node itself covers 5 resources (Alert, Case, Log, Observable and Task), but the operations n8n shows you depend on the API version you pick in the credential, the saved connection you fill in once: create the credential first, choose the version, then come back to the node and the list appears. Anything the node does not offer is still reachable with HTTP Request, which calls any TheHive endpoint while reusing the same credential.

Two limits worth knowing before you build. This node targets the version 3 and version 4 APIs; a TheHive 5 server needs the separate TheHive 5 node instead. And the trigger will not register its own webhook, you declare it in the TheHive configuration file yourself. If you are still weighing the platform, the n8n review covers that ground, and the n8n training goes through building workflows step by step.

Connect

How do you connect TheHive to n8n?

  1. 01

    Create an API key in TheHive

    TheHive runs on your own server, so the key comes from your instance, not from a vendor portal. Open Organization > Create API Key and copy the value straight away. That key carries the permissions of the account it belongs to, which is worth thinking about: a workflow that writes logs into tasks does not need an administrator. Create a dedicated service account with the rights it actually uses and you keep your audit trail readable.

  2. 02

    Fill the credential in n8n

    In n8n, open the Credentials menu and add a TheHive credential. Paste the API Key, then set URL to the address of your TheHive server, the same one your analysts open in their browser. A credential is a saved connection: you fill it once and every workflow picks it from a dropdown, so a rotated key is updated in a single place rather than in ten nodes.

  3. 03

    Pick the API version, then open the node

    The API Version field offers TheHive 3 (api v0) and TheHive 4 (api v1), and this choice drives what the node can do. Ignore SSL Issues lets n8n connect when certificate validation fails, which happens on internal instances with a self-signed certificate. Save, go back to the node, select a resource, and the operations available for your version show up in the list.

Triggers

What starts a workflow from TheHive ?

TheHive Trigger is the node that starts a workflow when something happens in TheHive. It listens to 14 events, listed below by family. Pick one or several, activate the workflow: n8n registers the webhook on your TheHive account.

What you see in n8n

Every event, by family

One row per object, one chip per action. The event to tick in the node is object.action; hover a chip to read exactly when it fires.

alert_create.*1
  • alert_create.
    • alert_create
alert_delete.*1
  • alert_delete.
    • alert_delete
alert_update.*1
  • alert_update.
    • alert_update
case_artifact_create.*1
  • case_artifact_create.
    • case_artifact_create
case_artifact_delete.*1
  • case_artifact_delete.
    • case_artifact_delete
case_artifact_update.*1
  • case_artifact_update.
    • case_artifact_update
case_create.*1
  • case_create.
    • case_create
case_delete.*1
  • case_delete.
    • case_delete
case_task_create.*1
  • case_task_create.
    • case_task_create
case_task_log_create.*1
  • case_task_log_create.
    • case_task_log_create
case_task_log_delete.*1
  • case_task_log_delete.
    • case_task_log_delete
case_task_log_update.*1
  • case_task_log_update.
    • case_task_log_update
case_task_update.*1
  • case_task_update.
    • case_task_update
case_update.*1
  • case_update.
    • case_update

The trigger also accepts * (any event). Handy for logging, dangerous in production.

Configuration notes

01Configure the TheHive TriggerThe TheHive Trigger starts a workflow when your instance reports activity. It works by webhook, meaning TheHive calls an n8n URL as things happen and the execution begins within seconds, with no polling loop asking for changes on a timer.

The TheHive Trigger starts a workflow when your instance reports activity. It works by webhook, meaning TheHive calls an n8n URL as things happen and the execution begins within seconds, with no polling loop asking for changes on a timer.

Key parameters

  • Events: the list of things you want to react to, 14 of them in total. Leave the wildcard * selected to catch everything and filter later in the workflow, or tick only the ones you need and keep executions clean.
When to use it
the node is at version 2 and does not register the webhook for you. Copy the testing and production URLs from the trigger, add them to notification.webhook.endpoints in the application.conf file of your server, name each endpoint, list your organisation, then run the documented cURL command against /api/config/organisation/notification to switch notifications on.
Use cases
one activated workflow per reaction you want automated, rather than an analyst checking a queue between two investigations.
02Alert Created, Alert Updated, Alert DeletedAlerts are what reaches TheHive before anyone decides it deserves a case: a SIEM detection, a mailbox report, a feed. Three events cover their whole life and they are the ones most workflows start from.

Alerts are what reaches TheHive before anyone decides it deserves a case: a SIEM detection, a mailbox report, a feed. Three events cover their whole life and they are the ones most workflows start from.

Key parameters

  • Events: tick Alert Created (alert_create) for anything new, Alert Updated (alert_update) when severity or status changes, Alert Deleted (alert_delete) when one is discarded.
When to use it
creation is your enrichment hook, since that is the moment you still have time to add context before a human reads the alert. Update is your escalation hook, because a severity that climbs usually means someone just learned something. Deletion is mostly worth logging, so a quiet queue can be explained later.
Use cases
a new alert triggers reputation lookups, and the workflow writes what it found as a task log the analyst reads inside the case.
03Case Created, Case Updated, Case DeletedA case is the investigation itself, the container analysts work in for hours or days. Its three events give you a reliable way to keep the rest of the company informed without anyone writing a status update by hand.

A case is the investigation itself, the container analysts work in for hours or days. Its three events give you a reliable way to keep the rest of the company informed without anyone writing a status update by hand.

Key parameters

  • Events: Case Created (case_create) opens the story, Case Updated (case_update) covers every change made along the way, Case Deleted (case_delete) closes it out.
When to use it
creation pairs well with anything that has to exist alongside the investigation, a ticket, a channel, a folder. Update fires often, so filter it early on the field you care about instead of letting every edit run a full workflow. That habit keeps your execution list readable.
Use cases
a case opens, the workflow creates the matching ticket in your ITSM tool and posts the reference back as a task log, so both systems point at each other.
04Task, Log and Observable eventsUnderneath cases sit the pieces analysts actually manipulate: tasks to do, logs describing what was done, observables holding the technical indicators. Eight events cover them.

Underneath cases sit the pieces analysts actually manipulate: tasks to do, logs describing what was done, observables holding the technical indicators. Eight events cover them.

Key parameters

  • Events: Task Created (case_task_create) and Task Updated (case_task_update); Log Created (case_task_log_create), Log Updated (case_task_log_update) and Log Deleted (case_task_log_delete); Observable Created (case_artifact_create), Observable Updated (case_artifact_update) and Observable Deleted (case_artifact_delete).
When to use it
observable creation is the sharpest hook of the three, because a fresh indicator is exactly what you want to send to enrichment before an analyst asks. Task events track who is doing what. Log events are useful for mirroring, though a workflow that writes logs and also listens to log events can feed itself, so filter on the author.
Use cases
an observable appears, the workflow checks it against your blocklist and reports the verdict in the task timeline.
Actions

What can the TheHive node do?

The TheHive node exposes 4 operations across 5 resources. For each one: the node as you configure it in n8n, the required fields, and our field notes.

Resources × operations matrix
ResourceCreateGetGet ManyExecute Responder
Alert
Case
Log✓✓✓✓
Observable
Task

Alert

0 operations

Case

0 operations

Log

4 operations
01

Create a log

log.create

What you see in n8n

Notes & use cases

Adds an entry to the timeline of a TheHive task, which is how an automated step leaves a trace an analyst can read later.

Key parameters

  • Task ID: the identifier of the task the entry belongs to, often {{ $json.id }} coming from a Task Created event.
  • Message: the content of the log, the text your previous nodes assembled.
  • Start Date: the submission date, already set to now, so you only touch it when backfilling.
  • Status: Ok or Deleted, Ok by default.
  • Attachment: in the Options collection, attaches a file to the entry.
Use cases
a sandbox returns its verdict and the workflow drops it in the investigation task, so the analyst reads one timeline instead of three tabs.
02

Execute a responder

log.executeResponder

What you see in n8n

Notes & use cases

Runs one of the responders configured on your instance against a single log entry, and the action happens in TheHive rather than in the workflow.

Key parameters

  • Log ID: the identifier of the entry the responder acts on, taken from a Log Created event or from Get many logs.
  • Responder Name or ID: picked from the list your instance exposes, or supplied as an identifier through an expression, a value such as {{ $json.id }} pulled from an earlier node, when the choice depends on the data.
Use cases
an approval arrives in a ticketing tool, and the workflow fires the matching responder on the log that requested it, so the decision is applied without anyone going back into the interface.
03

Get many logs

log.getAll

What you see in n8n

Notes & use cases

Reads the entries attached to a task and returns them as separate items, one per log, ready for the next node.

Key parameters

  • Task ID: the task whose timeline you want to read.
  • Return All: enabled, n8n walks through the pages of the API until every entry is retrieved.
  • Limit: the ceiling when Return All is off, handy while testing so a busy task does not flood your execution.
Use cases
at the end of an investigation, the workflow collects the full timeline of each task and files it in a reporting table, which spares the team from rebuilding the sequence of events by hand.
04

Get a log

log.get

What you see in n8n

Notes & use cases

Fetches a single entry and returns its current content, which matters when the log was written minutes ago and may have changed since.

Key parameters

  • Log ID: the identifier of the entry, not its message. A Log Updated event gives it to you directly, and so does an earlier call in the same workflow.
Use cases
a workflow waits for a colleague to complete an entry before moving on, and reads it again to confirm the content is there. It is also the quickest way to verify a write, since the same identifier returns exactly what TheHive stored.

Observable

0 operations

Task

0 operations
Need help

Need help automating TheHive with n8n?

A person reads every message.

FAQ

TheHive and n8n, the questions that come up

01Is the TheHive n8n integration free?
Yes. The TheHive node and the TheHive Trigger ship with n8n, so there is nothing to install and nothing extra to pay on the n8n side. That holds on n8n Cloud, the hosted offer run by n8n, and on a self-hosted instance under the Community Edition and its Sustainable Use licence. A workflow behaves the same either way, which means you can prototype in one place and run it in the other. TheHive itself runs on your own server, and what that costs you depends on your own setup rather than on n8n.
02What credentials do you need for TheHive in n8n?
One API key, created inside your instance under Organization then Create API Key. The n8n credential asks for that key, the URL of your TheHive server, and the API version, either TheHive 3 with api v0 or TheHive 4 with api v1. There is an Ignore SSL Issues switch for instances that use a self-signed certificate. The key carries the rights of the account that created it, so a service account limited to what the workflow really needs is a better idea than an administrator key. Save the credential once and every workflow can select it.
03What are the limits of the TheHive node in n8n?
The catalogue exposes 4 operations, all on the Log resource, while the node covers 5 resources in total: Alert, Case, Log, Observable and Task. The list you actually see depends on the API version stored in the credential, so create the credential first, then reopen the node. On reads, Return All is what pulls every page of results; without it you stop at the Limit you set. Whatever the node does not offer is still reachable with HTTP Request, which calls any TheHive endpoint and reuses the same credential for authentication.
04Does the TheHive Trigger react in real time?
It does, because it works by webhook rather than by polling. TheHive calls an n8n URL as events happen, so an execution starts within seconds instead of waiting for the next scheduled check. One thing to plan for: this trigger does not register itself. You copy the testing and production URLs from the node, declare them as webhook endpoints in the application.conf file on your server with your organisation name, then run the cURL command from the n8n documentation to enable notifications. After that, the 14 events reach your workflows on their own.
05n8n or Make for TheHive?
It comes down to where the data lives. TheHive is usually self-hosted for a reason, and n8n can be self-hosted too, on Docker or npm, so alerts and case content never leave your infrastructure. Make is hosted only, and billed per operation, which is worth modelling when a noisy trigger fires all day. Both give you a visual canvas. n8n adds a code node and the HTTP Request fallback, useful here since the node covers one resource out of 5. If your security policy is relaxed and you want zero infrastructure, Make is a fair answer.
Same platform

Other docs you might need on this stack.

Browse all integrations