Developer · CONNECTIONRaise alerts, open and update cases, and add tasks, observables and comments in TheHive 5.
Explore 13 workflow actions for TheHive, including account permissions and operation limits.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Add a comment to a case.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Attach an observable, such as a domain or IP address, to a case.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Add a task to a case.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Record a progress log on a case task.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Raise an alert for analysts to triage.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Open a case for an investigation.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Turn an alert into a case and return the case.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Read one alert by its ID.
Depends on the connected account and selected operation. Check the service documentation.
Read one case by its ID.
Depends on the connected account and selected operation. Check the service documentation.
Read alerts newest first, one page at a time.
Depends on the connected account and selected operation. Check the service documentation.
Pagination: offset. Check the result for additional pages; a single action may not return every record.
Read cases newest first, one page at a time.
Depends on the connected account and selected operation. Check the service documentation.
Pagination: offset. Check the result for additional pages; a single action may not return every record.
Change an alert's title, description, severity, status or tags.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Change a case's title, description, severity, status or tags.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
Inspect step outputs and confirm the result in TheHive. A saved workflow is not a completed provider action.
