TheHive
Business appsBearer tokenConnection test available
Manage TheHive cases, tasks, task logs, observables and alerts.
OCNORA ships 38 typed TheHive operations. Each node has a schema-driven form, input and output tables beside its settings, and is pre-flighted by Workflow Health before your first real run.
Before you connect TheHive
- Authentication
- Bearer token
- Credential
- the TheHive API key, or {"api_key": "…"}
- Connection test
- Available: the stored credential can be checked against the provider when you add it. This is not a record that a test was run or passed.
What you can do with TheHive
Operations, grouped by what they do to your data.
Create and send 7
Read and search 13
Update 8
Delete and cancel 5
A sample TheHive workflow
- 1A core triggerStart the run from a chat, form, manual, schedule, webhook, workflow trigger — no TheHive trigger is needed.
- 2Count Casesthehive.count_casesCount the cases that match a filter, without fetching them.
- 3Comment On Alertthehive.add_alert_commentAdd a comment to an alert.
An outline built from this provider’s node contracts, not a recorded run. Each step’s output fields are available to the next in the field picker.
Every node below has a reference page: what it does, the connection it needs, its config fields with types, constraints and examples, and the shapes it emits.
Operations 38
- Comment On AlertAdd a comment to an alert.thehive.add_alert_comment
- Comment On CaseAdd a comment to a case.thehive.add_case_comment
- Merge Alerts Into CaseMerge several alerts into one existing case in a single call.thehive.bulk_merge_alerts_into_case
- Bulk Update CasesApply the same field changes to several cases in one call.thehive.bulk_update_cases
- Count CasesCount the cases that match a filter, without fetching them.thehive.count_cases
- Create AlertRaise an alert for triage. The source and source reference together identify it, so re-sending the same pair is refused as a duplicate instead of creating a second alert.thehive.create_alert
- Add Observable To AlertAttach one or more observables to an alert before it is triaged.thehive.create_alert_observable
- Create CaseOpen a new case, with its severity, TLP, tags and assignee.thehive.create_case
- Add Observable To CaseAttach one or more observables to a case. Several comma-separated values create several observables in a single call.thehive.create_case_observable
- Create TaskAdd an investigation task to a case.thehive.create_task
- Add Task LogWrite a log entry on a task, which is how analysts record work.thehive.create_task_log
- Delete AlertDelete an alert from TheHive.thehive.delete_alert
- Delete CaseDelete a case from TheHive.thehive.delete_case
- Delete ObservableDelete an observable from its case or alert.thehive.delete_observable
- Delete TaskDelete a task from its case.thehive.delete_task
- Delete Task LogDelete a task log entry.thehive.delete_task_log
- Follow Or Unfollow AlertStart or stop following an alert, which controls source updates.thehive.follow_alert
- Get AlertRead one alert by its id.thehive.get_alert
- Get CaseRead one case by its id or its case number.thehive.get_case
- Get Case TimelineRead the ordered timeline of everything that happened on a case.thehive.get_case_timeline
- Get ObservableRead one observable by its id.thehive.get_observable
- Get TaskRead one task by its id.thehive.get_task
- List Case ObservablesList the observables attached to one case.thehive.list_case_observables
- List Case TasksList the tasks that belong to one case.thehive.list_case_tasks
- List Task LogsList the log entries written on one task.thehive.list_task_logs
- Merge Alert Into CaseMerge one alert into an existing case rather than opening a new one.thehive.merge_alert_into_case
- Merge CasesMerge two or more cases into a single new case.thehive.merge_cases
- Promote Alert To CaseTurn an alert into a new case, optionally overriding its fields.thehive.promote_alert_to_case
- Run QueryRun any TheHive query as a raw list of steps, for the reads the curated nodes above do not cover.thehive.query
- Search AlertsSearch alerts by title, type, source, status or a raw filter.thehive.search_alerts
- Search CasesSearch cases by title, status, assignee or a raw filter expression.thehive.search_cases
- Search ObservablesSearch observables by value, type, IOC flag or a raw filter.thehive.search_observables
- Search TasksSearch tasks across every case the connection can see.thehive.search_tasks
- Update AlertMerge fields into an alert, such as its status or severity.thehive.update_alert
- Update CaseMerge fields into an existing case, such as status or assignee.thehive.update_case
- Update ObservableMerge fields into an observable, such as its IOC or sighted flag.thehive.update_observable
- Update TaskMerge fields into a task, such as its status or assignee.thehive.update_task
- Update Task LogEdit the text of a task log, or pin it to the case timeline.thehive.update_task_log
TheHive questions
- How does OCNORA authenticate with TheHive?
- With a stored Bearer token credential, shaped the TheHive API key, or {"api_key": "…"}. A connection test can check it when you add it.
- What can I automate with TheHive?
- 38 typed operations, each with a reference page listing its config fields and the shapes it emits.
- What if the TheHive operation I need is not listed?
- Where TheHive has an HTTP API, call it from the HTTP node with the same credential, or describe the step to the AI builder, which asks our team for a typed node when one is missing.
- Are there templates that use TheHive?
- Not yet. Start from a blank workflow, or describe the workflow to Build with AI.
- How are TheHive calls controlled?
- Every call and every run step is audited, runs count against the execution budget, and Workflow Health pre-flights the workflow when you save it.
More in Business apps
See your first TheHive workflow run.
Book a technical demo. We add the connection, pick a template or describe the workflow to Build with AI, and Workflow Health checks it before it runs.