TheHive Integration

Open-source security incident response platform for SOC teams. Bring TheHive into visual workflows so engineering operations do not depend on glue scripts. Start from Watch New Alerts, then trigger Get Alert or Get Case.

Explore Documentation

3-day trialCancel anytimeUp to 10 minutes quick set up

GDPR
Data Encryption
2FA
Local Data Region

Supported triggers and actions for TheHive integration

Triggers can detect changes in TheHive and run actions that can create, search or modify data inside TheHive automatically [3] — exactly how you set them.

Watch New AlertsTriggers when a new alert is created.
Watch New CasesTriggers when a new case is created.
Get AlertReturns a single alert by ID.
Get CaseReturns a single case by ID or number.
Get Case ExportExports a case as a password-protected archive file.
Get Case TimelineReturns the timeline of events for a case.
Get Cortex JobReturns the status and report of a Cortex analyzer job.
Get ObservableReturns a single observable by ID.
Get Observable TypeReturns a single observable type.
Get Similar Alert ObservablesRetrieves the observables an alert shares with another alert or case.
Get Similar Case ObservablesRetrieves the observables a case shares with another alert or case.
List Alert ObservablesRetrieves the observables of an alert.
List AlertsRetrieves a list of alerts, newest first.
List Case LinksRetrieves the cases linked to a case with the observables they share.
List Case Link TypesRetrieves the link types already used between cases.
List Case ObservablesRetrieves the observables of a case.
List CasesRetrieves a list of cases, newest first.
List Case SharesRetrieves the organisations a case is shared with.
List ObservablesRetrieves a list of observables from alerts and cases, newest first.
List Observable SharesRetrieves the organisations an observable is shared with.
Analyze ObservableRuns a Cortex analyzer on an observable through TheHive.
Create AlertCreates a new alert in TheHive.
Create Alert ObservableAdds a text observable, such as an IP address, domain, or hash, to an alert.
Create Alert Observable FileUploads a file as an observable on an alert.
Create Alert ProcedureLinks a MITRE ATT&CK technique to an alert as a TTP.
Create Alert ProceduresLinks several MITRE ATT&CK techniques to an alert in one call.
Create CaseCreates a new case in TheHive.
Create Case AccessSets who can see a case.
Create Case Access in BulkSets who can see several cases at once.
Create Case Custom EventAdds a custom event to a case timeline.
Create Case from ImportCreates a case from an archive exported from TheHive.
Create Case LinkLinks a case to another case with a link type.
Create Case ObservableAdds a text observable, such as an IP address, domain, or hash, to a case.
Create Case Observable FileUploads a file as an observable on a case.
Create Case ProcedureLinks a MITRE ATT&CK technique to a case as a TTP.
Create Case ProceduresLinks several MITRE ATT&CK techniques to a case in one call.
Create Case ShareShares a case with one or more linked organisations.
Create External Case LinkLinks a case to an external web page with a link type.
Create Observable ShareShares an observable with organisations its case is already shared with.
Create Observable TypeCreates a custom observable type.
Delete AlertPermanently deletes an alert.
Delete Alerts in BulkPermanently deletes several alerts at once.
Delete CasePermanently deletes a case.
Delete Case LinkRemoves the link between a case and another case.
Delete Case ShareRemoves one share from a case.
Delete Case SharesStops sharing a case with the given organisations.
Delete Case Shares by IDRemoves the chosen case shares by their share IDs.
Delete External Case LinkRemoves a link between a case and an external web page.
Delete ObservablePermanently deletes an observable.
Delete Observable SharesStops sharing an observable with the given organisations.
Delete Observable TypeDeletes a custom observable type.
Import Alert into CaseImports an alert's observables and TTPs into an existing case without changing the case description.
Make an API CallPerforms an arbitrary authorized API call.
Promote Alert to CaseCreates a new case from an alert, carrying over its observables, TTPs, and custom fields.
Remove Alert from CaseUnlinks an alert from a case and returns the alert to the New stage.
Set Alert FollowedFollows an alert so it keeps updating from its MISP event.
Set Alert UnfollowedUnfollows an alert so it stops updating from its MISP event.
Set Case OwnerTransfers a case to another organisation.
Update AlertUpdates the fields of an alert.
Update Alert into CaseMerges an alert into an existing case and links it there.
Update Alerts by MergeMerges several alerts into one existing case.
Update Alerts in BulkApplies the same changes to several alerts at once.
Update CaseUpdates the fields of a case.
Update Case Observables by MergeMerges duplicate observables in a case into one observable each.
Update Cases by MergeMerges two or more cases into one new case and deletes the originals.
Update Cases from TemplateApplies a case template to one or more existing cases.
Update Case ShareChanges the permission profile of a case share.
Update Case SharesReplaces all shares of a case with the given list.
Update Cases in BulkApplies the same changes to several cases at once.
Update ObservableUpdates the fields of an observable.
Update Observables in BulkApplies the same changes to several observables at once.
Update Observable TypeChanges whether an observable type is case sensitive.

How to integrate TheHive in automation workflow?

3 simple steps to make your TheHive connected with other apps in automation workflows on WEXTL. Up to 10 minutes integration set up.

STEP 1

Select TheHive in workflow

Pick TheHive app in the workflow builder [4] - just one click to select the app.

STEP 2

Connect TheHive

When prompted, authorize access to TheHive in WEXTL once. TheHive credentials are encrypted and never shared with WEXTL. Authorization will be reused in any future API calls [3].

WEXTL wants to integrate with your TheHive account. Approve?

STEP 3

Build a workflow

Build your workflow with TheHive yourself or with WEXTL® AI Builder. Connect TheHive to any available integrations [5], or use HTTP node to go beyond them.

TheHive

How TheHive connects and integrates with WEXTL

Save and approve your credentials once — WEXTL® stores authorization information encrypted and reuses the authentication whenever TheHive app is called in workflows. That allows your developer tools automations to run without your attention, per defined schedule [7]. Explore documentation [6] for a detailed list of fields that TheHive supports.

Full TheHive API documentation

The following table illustrates what fields TheHive integration require during authorization flow inside our workflow builder [4].

Demonstration of TheHive connection step inside WEXTL Workflow Builder [4].

Field	Type	Help
Server URLRequired	url	The public address you open TheHive at, for example https://thehive.example.com. Leave off /api/v1. Private and local network addresses are blocked.
API KeyRequired	password	In TheHive, open your user settings and create or reveal your API key. An admin can also create one for a service account.
Organisation	text	Only needed when your account belongs to several organisations. Enter the organisation name to act in, or admin for observable type changes.

Connect TheHive to popular apps on WEXTL

Enter a name of the other app you want to sync with TheHive below. Click on selected app to explore integration options with TheHive. If the app you search for is not available in WEXTL yet, you can use HTTP node [10] instead to integrate it directly.

Example automation with TheHive integration

Select Watch New Cases trigger from TheHive - this will be a starting point in your automation. Whenever event happens in TheHive, workflow will start [7] from Watch New Cases node.

Search for Create Case Access, connect it as the next step of integration sequence. You can use filters between Watch New Cases and Create Case Access, so only important data pass from Watch New Cases to the next step. WEXTL gives you full control over the process of TheHive automation. All parts of workflow are visible on the canvas [4].

TheHive on WEXTL has 72 modules for creating developer tools automations. Explore TheHive documentation for more.

TheHive

Watch New Cases

Agenty

Performs action

Agenty

Triggers

TheHive

Create Case Access

Demonstration of how visual TheHive automation [6] looks in WEXTL.

Frequently asked questions

Common questions about automating TheHive in your workflows.

TheHive has 2 triggers, including "Watch New Alerts" and "Watch New Cases". Triggers are start points of the workflow, and automations may start from them.

Integration has 70 actions, including "Get Alert", "Get Case", and "Get Case Export", and more. Refer to our TheHive Documentation for detailed inputs and outputs.

No. Most automations are built visually on the canvas by picking triggers, actions, and mapping fields. You can add custom JavaScript with Functions when advanced logic is needed — but our customers do that in rare cases [4].

Yes. Connections are authenticated per account, credentials are encrypted at rest, and you can enforce approvals and team-level access controls on any automation.

The TheHive integration on WEXTL runs directly on its vendor public API — every field name, authentication method, and rate limit is controlled by TheHive official API and covered in documentation [3]. WEXTL handles the request signing and pagination for you.

Absolutely. Where TheHive provides native webhooks, you can use instant triggers to eliminate polling delay. For custom webhooks, WEXTL offers Custom Webhook node, so you can start automation whenever TheHive or any other service sends event to webhook URL.

WEXTL is an AI-first visual canvas. The platform allows you to describe automation in plain text — and AI will wire nodes for TheHive inside the workflow builder [4]. You can also use built-in workflow nodes (AI Agent, Human in the Loop, Condition, Aggregate Results) in pair with TheHive modules to craft complex integration flows with branches, filtering, and conditional logic. There are absolutely no limits of what you can build.

References

List of sources used to gather information about the TheHive integration.

TheHive integration source code, module specs and credentials implementation.
Internal TheHive integration documentation, structured input and output parameters, scopes, and authentication methods.
Official TheHive vendor API documentation — used to verify field meanings, authentication flows, and anything our own specs don't fully capture.
WEXTL® Visual Workflow Builder, anonymized data from our technical support team.
WEXTL® Apps Library
WEXTL® TheHive App Documentation
WEXTL® Workflow Scheduler
WEXTL® HTTP node documentation

TheHive Integration

Supported triggers and actions for TheHive integration