Most-used Thehive workflows
- Email (email Read Imap) (email Read Imap) (16 nodes)
- Email — n8n Thehive workflow (15 nodes)
- Weekly_shodan_query___report_accidents__no_function_node_ (15 nodes)
- Weekly Shodan Query - Report Accidents — n8n Thehive workflow (15 nodes)
- Analyze Emails with S1em (15 nodes)
- Analyze Emails with S1em (email Read Imap) — n8n Thehive workflow (15 nodes)
- Thehive (the Hive) (9 nodes)
- Thehive (the Hive) (the Hive) — n8n Thehive workflow (8 nodes)
- Thehive (7 nodes)
- Send Thehive Alerts Using Signl4 — n8n Thehive workflow (7 nodes)
Email. Uses emailReadImap, theHive, cortex. Event-driven trigger; 16 nodes.
Email. Uses emailReadImap, theHive, cortex. Manual trigger; 15 nodes.
Weekly_Shodan_Query___Report_Accidents__no_function_node_. Uses httpRequest, itemLists, html, markdown. Scheduled trigger; 15 nodes.
This n8n workflow, which runs every Monday at 5:00 AM, initiates a comprehensive process to monitor and analyze network security by scrutinizing IP addresses and their associated ports. It begins by f
With workflow, you analyze Email with TheHive/Cortex
Analyze emails with S1EM. Uses emailReadImap, theHive, cortex. Manual trigger; 15 nodes.
TheHive. Uses theHive, signl4, stopAndError. Webhook trigger; 9 nodes.
TheHive. Uses theHive, signl4, stopAndError. Webhook trigger; 8 nodes.
This sample workflow allows you to forward alerts from TheHive 5 to SIGNL4 in order to send reliable alerts to your team.
Create, update and get a case in TheHive. Uses manualTrigger, theHive. Event-driven trigger; 4 nodes.
11 of 11 workflows in this view · Browse all →
FAQ
How many n8n Thehive workflows are in the catalog?
11 n8n workflows in AutomationFlows currently use the Thehive integration — triggers, actions, or both.
How do I connect Thehive in n8n?
After importing the workflow JSON, n8n will prompt for Thehive credentials on the relevant nodes. AutomationFlows strips credential IDs before publishing — you'll add your own.
Can I combine these with other integrations?
Yes — most Thehive workflows pair with adjacent tools (Slack alerts, Google Sheets logging, OpenAI summarisation). Browse the integration tags on each workflow page to discover pairings.