STEP 1
Connect Box and TheHive
Save credentials in WEXTL once. We store them encrypted and reuse the authorization across every workflow [3]. No coding or API skills required.
Box and TheHive Integration
Connect Box and TheHive to automate developer tools workflows. Trigger events from one app, run actions in the other and use AI to make smart decisions. Integrate apps in 3 simple steps - no code required.
3-day trialCancel anytimeUp to 10 minutes quick set up
- GDPR
- Data Encryption
- 2FA
- Local Data Region
How to connect Box to TheHive
Set up your Box and TheHive integration in 3 simple steps [2] — no coding required. Up to 10 minutes setup.
STEP 2
Build a workflow
Paste selected Box and TheHive nodes onto the canvas [4], or describe what you want and WEXTL wires the flow together with AI Builder.
STEP 3
Map your data
Choose which fields need to sync between Box and TheHive. Use filters or leverage a JS custom code step in between — everything is on the canvas.
How does the integration between Box and TheHive work in WEXTL?
WEXTL exposes actions and triggers for Box and TheHive that help you connect apps and automate repetitive tasks [1]. A trigger is an event that happens, an action — a step that performs when the event has occurred.
Box triggersTheHive actions
Box modules
- Add a User to a GroupCreates a membership that adds a user to a group.
- Add or Update a User's AvatarUploads or replaces a user's profile picture.
- Add Shared Link to FileCreates a public or company-scoped link to a file.
- Add Shared Link to FolderCreates a public or company-scoped link to a folder.
- Apply Watermark To FileOverlays a visual watermark on a file's previews.
- Apply Watermark To FolderOverlays a visual watermark on a folder's previews.
- Assign TaskAssigns a task to a user.
- Cancel Box Sign RequestCancels an existing Box Sign request.
- Commit Upload SessionAssembles the uploaded parts into the final file.
- Copy FileCopies a file to another folder in Box.
- Copy File RequestDuplicates a file request onto a different folder.
- Copy FolderCopies a folder to another location in Box.
- Create a GroupCreates a new group in the enterprise.
- Create a UserCreates a new managed user in the enterprise.
- Create Box Sign RequestCreates a new Box Sign request with specified signers and source files.
- Create CollaborationInvites a user or group to collaborate on an item.
- Create CommentPosts a new comment on a file, folder, or other item.
- Create FolderCreates a new folder in Box.
- Create Folder LockLocks a folder to prevent it from being moved or deleted.
- Create Metadata Instance on FileApplies a metadata template's values to a file.
- Create Metadata Instance on FolderApplies a metadata template's values to a folder.
- Create Metadata TemplateDefines a new custom metadata template schema for the enterprise.
- Create TaskCreates a new task on a file.
- Create Upload SessionStarts a chunked upload session for a new file.
- Create Upload Session for Existing FileStarts a chunked upload session for a new version of an existing file.
- Create User InviteInvites an external user to become a collaborator in the enterprise.
- Create Web LinkSaves a URL as a bookmark inside a folder.
- Create Zip DownloadBundles multiple files and folders into a downloadable zip archive.
- Delete a UserDeletes a managed user from the enterprise.
- Delete a User's AvatarRemoves a managed user's profile picture.
- Delete FileMoves a file to the trash, from which it can still be restored or permanently erased.
- Delete File RequestRemoves a file request page from Box.
- Delete FolderMoves a folder to the trash, from which it can still be restored or permanently erased.
- Delete Folder LockReleases a lock that prevented a folder from being moved or deleted.
- Download FileDownloads the binary content of a file.
- Download Zip ArchiveDownloads the binary content of a zip archive.
- Find File for Shared LinkResolves a shared link URL to its file.
- Find Folder for Shared LinkResolves a shared link URL to its folder.
- Find Metadata Template by Instance IDFinds the metadata template a specific metadata instance was created from, by that instance's ID.
- Get a GroupReturns the details of a single group.
- Get a Group MembershipReturns a single user's role and status within a group.
- Get a UserReturns the profile of a single user.
- Get a User's AvatarReturns the binary image data of a managed user's profile picture.
- Get Box Sign Request by IDRetrieves a specific Box Sign request by its ID.
- Get Box Sign Template by IDRetrieves a specific Box Sign template by its ID.
- Get CollaborationReturns the details of a single collaboration.
- Get Collection by IDReturns the name and type of a single collection, such as Favorites.
- Get CommentRetrieves a specific comment by ID.
- Get File InformationReturns a file's metadata, including its name, size, and parent folder.
- Get File RequestReturns the title, status, and destination folder of a file request page.
TheHive modules
- Analyze ObservableRuns a Cortex analyzer on an observable through TheHive.
- Create AlertCreates a new alert in TheHive.
- Create Alert ObservableAdds a text observable, such as an IP address, domain, or hash, to an alert.
- Create Alert Observable FileUploads a file as an observable on an alert.
- Create Alert ProcedureLinks a MITRE ATT&CK technique to an alert as a TTP.
- Create Alert ProceduresLinks several MITRE ATT&CK techniques to an alert in one call.
- Create CaseCreates a new case in TheHive.
- Create Case AccessSets who can see a case.
- Create Case Access in BulkSets who can see several cases at once.
- Create Case Custom EventAdds a custom event to a case timeline.
- Create Case from ImportCreates a case from an archive exported from TheHive.
- Create Case LinkLinks a case to another case with a link type.
- Create Case ObservableAdds a text observable, such as an IP address, domain, or hash, to a case.
- Create Case Observable FileUploads a file as an observable on a case.
- Create Case ProcedureLinks a MITRE ATT&CK technique to a case as a TTP.
- Create Case ProceduresLinks several MITRE ATT&CK techniques to a case in one call.
- Create Case ShareShares a case with one or more linked organisations.
- Create External Case LinkLinks a case to an external web page with a link type.
- Create Observable ShareShares an observable with organisations its case is already shared with.
- Create Observable TypeCreates a custom observable type.
- Delete AlertPermanently deletes an alert.
- Delete Alerts in BulkPermanently deletes several alerts at once.
- Delete CasePermanently deletes a case.
- Delete Case LinkRemoves the link between a case and another case.
- Delete Case ShareRemoves one share from a case.
- Delete Case SharesStops sharing a case with the given organisations.
- Delete Case Shares by IDRemoves the chosen case shares by their share IDs.
- Delete External Case LinkRemoves a link between a case and an external web page.
- Delete ObservablePermanently deletes an observable.
- Delete Observable SharesStops sharing an observable with the given organisations.
- Delete Observable TypeDeletes a custom observable type.
- Get AlertReturns a single alert by ID.
- Get CaseReturns a single case by ID or number.
- Get Case ExportExports a case as a password-protected archive file.
- Get Case TimelineReturns the timeline of events for a case.
- Get Cortex JobReturns the status and report of a Cortex analyzer job.
- Get ObservableReturns a single observable by ID.
- Get Observable TypeReturns a single observable type.
- Get Similar Alert ObservablesRetrieves the observables an alert shares with another alert or case.
- Get Similar Case ObservablesRetrieves the observables a case shares with another alert or case.
- Import Alert into CaseImports an alert's observables and TTPs into an existing case without changing the case description.
- List Alert ObservablesRetrieves the observables of an alert.
- List AlertsRetrieves a list of alerts, newest first.
- List Case LinksRetrieves the cases linked to a case with the observables they share.
- List Case Link TypesRetrieves the link types already used between cases.
- List Case ObservablesRetrieves the observables of a case.
- List CasesRetrieves a list of cases, newest first.
- List Case SharesRetrieves the organisations a case is shared with.
- List ObservablesRetrieves a list of observables from alerts and cases, newest first.
- List Observable SharesRetrieves the organisations an observable is shared with.
Frequently asked questions
Common questions about connecting Box and TheHive.
Connect your Box and TheHive accounts once, pick a trigger in one app and an action in the other, then map the fields so data flows automatically between them. [3]
Example: when Box's "Watch Admin Log Events" fires, WEXTL can "Analyze Observable" in TheHive. Box has 2 triggers (including Watch Admin Log Events and Watch Box Webhook); TheHive has 70 actions (including Analyze Observable, Create Alert, and Create Alert Observable). Add filters and transforms between steps when you need them. [1]
Yes — the integration works in both directions. Use each app's triggers to start a workflow and the other app's actions to update it. [2]
No. Box-to-TheHive automations are built visually on the canvas. You can optionally add custom JavaScript with Functions when you need advanced logic. [4]
Yes. Trigger-based automations start the moment Box (or TheHive) fires a new event — webhook-backed apps run within seconds, and polling-only apps re-check on a schedule you control. [7]
A first automation typically takes 5–10 minutes: connect each app's credential once, drop a trigger + action onto the canvas, map the fields, and turn the workflow on.
You can build your Box + TheHive automation on a 3-day trial with every feature unlocked. Cancel anytime. For your protection, a small deposit is charged to your card when your trial starts. It counts toward your first payment and is non-refundable. [8]
References
List of sources used to gather information about the Box and TheHive integration.
- Box and TheHive integration source code, module specs and credentials implementation.
- Our Box and TheHive integration documentation, structured input and output parameters, scopes, and authentication methods.
- Official vendor API documentation for Box and TheHive — used to verify field meanings, authentication flows, and anything our own specs don't fully capture.
- WEXTL® visual workflow builder, anonymized data from our technical support team.
- Box integration information
- TheHive integration information
- WEXTL® Scheduling
- WEXTL® Pricing and Trial
- WEXTL® Apps Library