TheHive Event Listener

This n8n workflow listens for and triggers upon specific events occurring within TheHive security incident response platform. It acts as a webhook receiver, initiating subsequent actions whenever a configured event takes place in TheHive.

What it does

This workflow is designed to simplify the process of reacting to events in TheHive.

1. Listens for TheHive Events: The workflow starts by acting as a webhook listener for events originating from a configured TheHive instance.

Prerequisites/Requirements

To use this workflow, you will need:

• TheHive Instance: An active TheHive instance from which you want to receive event updates.
• TheHive API Key/Credentials: Appropriate credentials configured in n8n to allow TheHive to communicate with the workflow.
• n8n Webhook URL: The webhook URL provided by this n8n workflow must be configured within your TheHive instance to send events to it.

Setup/Usage

1. Import the workflow: Import the provided JSON into your n8n instance.
2. Configure TheHive Trigger:
   • Open the "TheHive Trigger" node.
   • Ensure your TheHive credentials are set up correctly in n8n.
   • Activate the workflow.
   • Copy the generated webhook URL from the "TheHive Trigger" node.
3. Configure TheHive:
   • In your TheHive instance, navigate to the webhook configuration.
   • Paste the copied n8n webhook URL into TheHive's webhook settings.
   • Configure TheHive to send the desired events (e.g., case creation, alert updates) to this webhook URL.
4. Extend the workflow: After the "TheHive Trigger" node, you can add any subsequent nodes to process the incoming TheHive event data. For example, you could:
   • Filter events based on specific criteria.
   • Send notifications to Slack, Microsoft Teams, or email.
   • Create or update records in other systems (e.g., a ticketing system, CMDB).
   • Trigger further automated security actions.