AutomationFlows › Thehive

n8n workflows for Thehive.

All n8n workflows that use the Thehive integration. Each is integration-tagged, privacy-stripped, and importable into your n8n instance in one click.

Most-used Thehive workflows

  1. Thehive[v4]:alert:create Update Get Getall Promote Merge:case:create Update Get Getall:observable:create Update Get Search Getall:task:create Update Get Search Getall:log:create Get Getall (46 nodes)
  2. Email (email Read Imap) (email Read Imap) — n8n Thehive workflow (16 nodes)
  3. Email (15 nodes)
  4. Weekly_shodan_query___report_accidents__no_function_node_ — n8n Thehive workflow (15 nodes)
  5. Weekly Shodan Query - Report Accidents (15 nodes)
  6. Analyze Emails with S1em — n8n Thehive workflow (15 nodes)
  7. Analyze Emails with S1em (email Read Imap) (15 nodes)
  8. Thehive (the Hive) — n8n Thehive workflow (9 nodes)
  9. Thehive (the Hive) (the Hive) (8 nodes)
  10. Thehive — n8n Thehive workflow (7 nodes)
General
Thehive[v4]:alert:create Update Get Getall Promote Merge:case:create Update Get Getall:observable:create Update Get Search Getall:task:create Update Get Search Getall:log:create Get Getall

TheHive[v4]:Alert:create update get getAll promote merge:Case:create update get getAll:Observable:create update get search getAll:Task:create update get search getAll:Log:create get getAll. Uses start

Start, The Hive
Email & Gmail
Email (email Read Imap) (email Read Imap)

Email. Uses emailReadImap, theHive, cortex. Event-driven trigger; 16 nodes.

Email Read Imap, The Hive, Cortex
Email & Gmail
Email

Email. Uses emailReadImap, theHive, cortex. Manual trigger; 15 nodes.

Email Read Imap, The Hive, Cortex
Web Scraping
Weekly_shodan_query___report_accidents__no_function_node_

Weekly_Shodan_Query___Report_Accidents__no_function_node_. Uses httpRequest, itemLists, html, markdown. Scheduled trigger; 15 nodes.

HTTP Request, Item Lists, The Hive
Web Scraping
Weekly Shodan Query - Report Accidents

This n8n workflow, which runs every Monday at 5:00 AM, initiates a comprehensive process to monitor and analyze network security by scrutinizing IP addresses and their associated ports. It begins by f

HTTP Request, Item Lists, The Hive
Email & Gmail
Analyze Emails with S1em

With workflow, you analyze Email with TheHive/Cortex

Email Read Imap, The Hive, Cortex
Email & Gmail
Analyze Emails with S1em (email Read Imap)

Analyze emails with S1EM. Uses emailReadImap, theHive, cortex. Manual trigger; 15 nodes.

Email Read Imap, The Hive, Cortex
General
Thehive (the Hive)

TheHive. Uses theHive, signl4, stopAndError. Webhook trigger; 9 nodes.

The Hive, Signl4, Stop And Error
General
Thehive (the Hive) (the Hive)

TheHive. Uses theHive, signl4, stopAndError. Webhook trigger; 8 nodes.

The Hive, Signl4, Stop And Error
General
Thehive

TheHive. Uses theHive, signl4, manualTrigger. Webhook trigger; 7 nodes.

The Hive, Signl4
General
Send Thehive Alerts Using Signl4

This sample workflow allows you to forward alerts from TheHive 5 to SIGNL4 in order to send reliable alerts to your team.

The Hive, Signl4
General
Create, Update and Get a Case in Thehive

Create, update and get a case in TheHive. Uses manualTrigger, theHive. Event-driven trigger; 4 nodes.

The Hive

12 of 12 workflows in this view · Browse all →

FAQ

How many n8n Thehive workflows are in the catalog?

12 n8n workflows in AutomationFlows currently use the Thehive integration — triggers, actions, or both.

How do I connect Thehive in n8n?

After importing the workflow JSON, n8n will prompt for Thehive credentials on the relevant nodes. AutomationFlows strips credential IDs before publishing — you'll add your own.

Can I combine these with other integrations?

Yes — most Thehive workflows pair with adjacent tools (Slack alerts, Google Sheets logging, OpenAI summarisation). Browse the integration tags on each workflow page to discover pairings.