TheHive

Raise a security alert in TheHive with a title, severity, and threat source so analysts can triage it immediately.

Open a structured incident case in TheHive, assigning it to a team, setting severity, and linking related alerts for coordinated investigation.

Append a timestamped investigation log entry to an existing TheHive case, preserving analyst actions, findings, and decision rationale.

Add an indicator of compromise — IP, domain, hash, email, or URL — to a TheHive case for enrichment, correlation, and downstream SIEM export.

Create an investigation or remediation task inside a TheHive case, assigning it to a responder with a due date and description.

Fetch a specific TheHive alert by ID to read its current status, severity, and attached artifacts before deciding the next action.

Modify an existing alert's severity, status, tags, or custom fields as new threat intelligence arrives during triage.

Convert a validated TheHive alert into a full incident case, carrying over all observables, tags, and attachments automatically.

Retrieve a full TheHive case by ID or number, including its status, assignees, observables list, and task summary.

Modify a TheHive case's title, status, severity, assignee, tags, or custom fields as the investigation evolves.

Mark a TheHive case as resolved with a closing summary, resolution type, and impact assessment, archiving it for audit.

List all tasks inside a TheHive case — with their status, assignee, and due date — to build a progress report or trigger next-step automation.

Retrieve all indicators of compromise attached to a TheHive case, ready for bulk enrichment, SIEM export, or deduplication checks.

Acknowledge a TheHive alert, moving it out of the 'New' queue to prevent duplicate analyst attention on the same event.

Append classification tags to a TheHive case for filtering, SLA routing, and reporting without overwriting existing tags.

Fires when a new alert is created in TheHive, giving your automation the earliest possible entry point into the incident response lifecycle.

Fires when an alert is deleted from TheHive, enabling audit trail enforcement and downstream system synchronisation when records are removed.

Fires whenever an alert's fields change in TheHive — status, severity, assignee, or custom fields — letting automation react to triage decisions in real time.

Fires when a new incident case is opened in TheHive, providing an automation hook at the moment a confirmed investigation begins.

Fires when any case field changes in TheHive — status, severity, assignee, tags, or custom metadata — enabling downstream automation to react to investigation state transitions.

Fires when an investigation task within a TheHive case is marked as Done, enabling the next step in a structured playbook to execute automatically.