The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"nodes": [
{
"id": "71dd0b5e-7bb0-4d06-9769-753156d1acf3",
"name": "TheHive Trigger",
"type": "n8n-nodes-base.theHiveProjectTrigger",
"position": [
20,
300
],
"parameters": {
"events": [
"case_create"
],
"options": {}
},
"typeVersion": 1
},
{
"id": "659339a5-3b3e-4f57-8aec-4c368b01890c",
"name": "Sticky Note",
"type": "n8n-nodes-base.stickyNote",
"position": [
280,
520
],
"parameters": {
"color": 7,
"width": 455.1635858314854,
"height": 538.2816200839441,
"content": "\n## Events Webhook Trigger\nThe first node receives all messages from Slack API via Subscription Events API. You can find more information about setting up the subscription events API by [clicking here](https://api.slack.com/apis/connections/events-api). The second node extracts the payload from slack into an object that n8n can understand. "
},
"typeVersion": 1
},
{
"id": "c3ec7525-41f5-426c-a1c9-63b4596c8632",
"name": "Sticky Note2",
"type": "n8n-nodes-base.stickyNote",
"position": [
-160,
-60
],
"parameters": {
"color": 7,
"width": 543.689530484159,
"height": 516.5011820330969,
"content": "\n## TheHive Trigger\nTo setup TheHive 5's triggers, visit the Settings in TheHive and add a webhook using the url found TheHive node."
},
"typeVersion": 1
},
{
"id": "d754ebe1-8a9e-4ae2-9a51-b6d359866ec3",
"name": "Sticky Note3",
"type": "n8n-nodes-base.stickyNote",
"position": [
400,
-60
],
"parameters": {
"color": 7,
"width": 686.8181233897246,
"height": 516.5011820330969,
"content": "\n## Post TheHive Case to Slack\nThe Case data is then mapped to Slack Block Kit and pushed to Slack. In Slack, it lives as a database object, mapping the Case Id to the block kit values themselves, so they can be updated in TheHive. "
},
"typeVersion": 1
},
{
"id": "6ac8fc89-6640-4799-93cb-eb1afa0e35c9",
"name": "Edit Fields",
"type": "n8n-nodes-base.set",
"position": [
580,
880
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "e63f9299-a19d-4ba1-93b0-59f458769fb2",
"name": "response",
"type": "object",
"value": "={{ $json.body.payload }}"
},
{
"id": "d95dda30-0a5c-4c63-8b4a-6b4e0a2bcb59",
"name": "dictionary",
"type": "object",
"value": "{\"PAP\":{\"WHITE\":\"\ud83d\udd4a\ufe0f\",\"GREEN\":\"\ud83d\udfe2\",\"AMBER\":\"\ud83d\udfe0\",\"RED\":\"\ud83d\udd34\"},\"Severity\":{\"LOW\":\"\ud83d\udfe2\",\"MEDIUM\":\"\ud83d\udfe1\",\"HIGH\":\"\ud83d\udfe0\",\"CRITICAL\":\"\ud83d\udd34\"},\"Severityid\":{\"1\":\"LOW\",\"2\":\"MEDIUM\",\"3\":\"HIGH\",\"4\":\"CRITICAL\"},\"TLP\":{\"WHITE\":\"\u26aa\",\"GREEN\":\"\ud83d\udfe2\",\"AMBER\":\"\ud83d\udfe0\",\"RED\":\"\ud83d\udd34\"},\"STATUS\":{\"1\":\"New\",\"2\":\"InProgress\",\"3\":\"Duplicated\",\"4\":\"FalsePositive\",\"5\":\"Indeterminate\",\"6\":\"Other\",\"7\":\"TruePositive\"},\"STATUSEMOJI\":{\"1\":\"\ud83c\udd95\",\"2\":\"\ud83d\udd04\",\"3\":\"\ud83d\udcd1\",\"4\":\"\u274e\",\"5\":\"\u2753\",\"6\":\"\ud83d\udfe3\",\"7\":\"\ud83d\udd34\"}}"
},
{
"id": "2303d403-1329-47b4-9b74-4f679a2cc192",
"name": "theHiveUrl",
"type": "string",
"value": "http://37.27.1.230:9000"
}
]
}
},
"typeVersion": 3.3
},
{
"id": "86f90f83-c115-4561-8c0f-432c2ebb18b5",
"name": "Task Modal",
"type": "n8n-nodes-base.httpRequest",
"position": [
1800,
3040
],
"parameters": {
"url": "https://slack.com/api/views.open",
"method": "POST",
"options": {},
"jsonBody": "= {\n \"trigger_id\": \"{{ $('Edit Fields').item.json['response']['trigger_id'] }}\",\n \"external_id\": \"TheHive Task Adder\",\n \"view\": {\n\t\"type\": \"modal\",\n\t\"callback_id\": \"add_task_modal\",\n\t\"title\": {\n\t\t\"type\": \"plain_text\",\n\t\t\"text\": \"Add a Task to Case\",\n\t\t\"emoji\": true\n\t},\n\t\"submit\": {\n\t\t\"type\": \"plain_text\",\n\t\t\"text\": \"Submit\",\n\t\t\"emoji\": true\n\t},\n\t\"close\": {\n\t\t\"type\": \"plain_text\",\n\t\t\"text\": \"Cancel\",\n\t\t\"emoji\": true\n\t},\n\t\"blocks\": [\n\t\t{\n\t\t\t\"type\": \"context\",\n\t\t\t\"block_id\": \"case_number_context\",\n\t\t\t\"elements\": [\n\t\t\t\t{\n\t\t\t\t\t\"type\": \"mrkdwn\",\n\t\t\t\t\t\"text\": \"{{ $('Edit Fields').item.json[\"response\"][\"message\"][\"blocks\"][1][\"text\"][\"text\"] }}\"\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\t\"type\": \"plain_text\",\n\t\t\t\t\t\"text\": \"{{ $('Edit Fields').item.json.response.message.blocks[0].alt_text }}\",\n\t\t\t\t\t\"emoji\": true\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\t{\n\t\t\t\"type\": \"input\",\n\t\t\t\"block_id\": \"title_block\",\n\t\t\t\"element\": {\n\t\t\t\t\"type\": \"plain_text_input\",\n\t\t\t\t\"action_id\": \"title_input\",\n\t\t\t\t\"placeholder\": {\n\t\t\t\t\t\"type\": \"plain_text\",\n\t\t\t\t\t\"text\": \"Enter the task title\"\n\t\t\t\t}\n\t\t\t},\n\t\t\t\"label\": {\n\t\t\t\t\"type\": \"plain_text\",\n\t\t\t\t\"text\": \"Title\",\n\t\t\t\t\"emoji\": true\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"type\": \"input\",\n\t\t\t\"block_id\": \"description_block\",\n\t\t\t\"element\": {\n\t\t\t\t\"type\": \"plain_text_input\",\n\t\t\t\t\"action_id\": \"description_input\",\n\t\t\t\t\"multiline\": true,\n\t\t\t\t\"placeholder\": {\n\t\t\t\t\t\"type\": \"plain_text\",\n\t\t\t\t\t\"text\": \"Enter a description for the task\"\n\t\t\t\t}\n\t\t\t},\n\t\t\t\"label\": {\n\t\t\t\t\"type\": \"plain_text\",\n\t\t\t\t\"text\": \"Description\",\n\t\t\t\t\"emoji\": true\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"type\": \"input\",\n\t\t\t\"block_id\": \"group_block\",\n\t\t\t\"element\": {\n\t\t\t\t\"type\": \"plain_text_input\",\n\t\t\t\t\"action_id\": \"group_input\",\n\t\t\t\t\"placeholder\": {\n\t\t\t\t\t\"type\": \"plain_text\",\n\t\t\t\t\t\"text\": \"Enter the group name\"\n\t\t\t\t}\n\t\t\t},\n\t\t\t\"label\": {\n\t\t\t\t\"type\": \"plain_text\",\n\t\t\t\t\"text\": \"Group\",\n\t\t\t\t\"emoji\": true\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"type\": \"actions\",\n\t\t\t\"block_id\": \"case-options\",\n\t\t\t\"elements\": [\n\t\t\t\t{\n\t\t\t\t\t\"type\": \"checkboxes\",\n\t\t\t\t\t\"options\": [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"text\": {\n\t\t\t\t\t\t\t\t\"type\": \"mrkdwn\",\n\t\t\t\t\t\t\t\t\"text\": \":exclamation: *Mandatory*\"\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\"description\": {\n\t\t\t\t\t\t\t\t\"type\": \"mrkdwn\",\n\t\t\t\t\t\t\t\t\"text\": \"Make this case Mandatory\"\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\"value\": \"mandatory\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"text\": {\n\t\t\t\t\t\t\t\t\"type\": \"mrkdwn\",\n\t\t\t\t\t\t\t\t\"text\": \":triangular_flag_on_post: *Flagged*\"\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\"description\": {\n\t\t\t\t\t\t\t\t\"type\": \"mrkdwn\",\n\t\t\t\t\t\t\t\t\"text\": \"Flag this case\"\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\"value\": \"flagged\"\n\t\t\t\t\t\t}\n\t\t\t\t\t],\n\t\t\t\t\t\"action_id\": \"submit-task-option\"\n\t\t\t\t}\n\t\t\t]\n\t\t},\n\t\t{\n\t\t\t\"type\": \"input\",\n\t\t\t\"block_id\": \"due_date_block\",\n\t\t\t\"element\": {\n\t\t\t\t\"type\": \"datepicker\",\n\t\t\t\t\"action_id\": \"due_date_input\",\n\t\t\t\t\"placeholder\": {\n\t\t\t\t\t\"type\": \"plain_text\",\n\t\t\t\t\t\"text\": \"Select a due date and time\"\n\t\t\t\t},\n\t\t\t\t\"initial_date\": \"{{$today.format('yyyy-MM-dd')}}\"\n\t\t\t},\n\t\t\t\"label\": {\n\t\t\t\t\"type\": \"plain_text\",\n\t\t\t\t\"text\": \"Due Date\",\n\t\t\t\t\"emoji\": true\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"type\": \"input\",\n\t\t\t\"block_id\": \"assignee_block\",\n\t\t\t\"element\": {\n\t\t\t\t\"type\": \"users_select\",\n\t\t\t\t\"action_id\": \"assignee_input\",\n\t\t\t\t\"placeholder\": {\n\t\t\t\t\t\"type\": \"plain_text\",\n\t\t\t\t\t\"text\": \"Select an assignee\"\n\t\t\t\t}\n\t\t\t},\n\t\t\t\"label\": {\n\t\t\t\t\"type\": \"plain_text\",\n\t\t\t\t\"text\": \"Assignee\",\n\t\t\t\t\"emoji\": true\n\t\t\t}\n\t\t}\n\t]\n}\n}",
"sendBody": true,
"jsonQuery": "{\n \"Content-type\": \"application/json\"\n}",
"sendQuery": true,
"specifyBody": "json",
"specifyQuery": "json",
"authentication": "predefinedCredentialType",
"nodeCredentialType": "slackApi"
},
"credentials": {
"slackApi": {
"name": "<your credential>"
}
},
"typeVersion": 4.2
},
{
"id": "e2874195-4b4e-4288-937f-201e4a361438",
"name": "HTTP Request",
"type": "n8n-nodes-base.httpRequest",
"position": [
460,
300
],
"parameters": {
"url": "https://slack.com/api/users.lookupByEmail",
"options": {},
"sendQuery": true,
"authentication": "predefinedCredentialType",
"queryParameters": {
"parameters": [
{
"name": "email",
"value": "={{ $('TheHive Trigger').item.json[\"body\"][\"object\"][\"assignee\"] }}"
}
]
},
"nodeCredentialType": "slackApi"
},
"credentials": {
"slackApi": {
"name": "<your credential>"
}
},
"typeVersion": 4.2
},
{
"id": "9fbf2b59-e6c3-45b5-aceb-5e98ebad9814",
"name": "Formatting Dictionaries",
"type": "n8n-nodes-base.set",
"position": [
240,
300
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "4a0f7bf9-f346-4ccf-8026-79c984cdedb5",
"name": "dictionary",
"type": "object",
"value": "{\"PAP\":{\"CLEAR\":\"\ud83d\udd4a\ufe0f\",\"GREEN\":\"\ud83d\udfe2\",\"AMBER\":\"\ud83d\udfe0\",\"RED\":\"\ud83d\udd34\"},\"Severity\":{\"LOW\":\"\ud83d\udfe2\",\"MEDIUM\":\"\ud83d\udfe1\",\"HIGH\":\"\ud83d\udfe0\",\"CRITICAL\":\"\ud83d\udd34\"},\"TLP\":{\"CLEAR\":\"\u26aa\",\"GREEN\":\"\ud83d\udfe2\",\"AMBER\":\"\ud83d\udfe0\",\"RED\":\"\ud83d\udd34\"},\"STATUS\":{\"NEW\":\"\ud83c\udd95\",\"inprogress\":\"\ud83d\udd04\",\"Duplicated\":\"\ud83d\udcd1\",\"Falsepositive\":\"\u274e\",\"Indeterminate\":\"\u2753\",\"Other\":\"\ud83d\udfe3\",\"Truepositive\":\"\ud83d\udd34\"}}"
},
{
"id": "32a165d5-cd94-454e-bcf9-9254decb63cb",
"name": "theHiveUrl",
"type": "string",
"value": "=http://37.27.1.230:9000"
}
]
}
},
"typeVersion": 3.3
},
{
"id": "f5ab276e-809b-41df-ba86-020c1b3681e1",
"name": "Prep Fields For Slack",
"type": "n8n-nodes-base.set",
"position": [
680,
300
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "0001aed3-a3fb-4229-8fa1-1941f0ee8a12",
"name": "title",
"type": "string",
"value": "=:computer: *Case Title:*\\n {{ $('TheHive Trigger').item.json.body.details.title }}"
},
{
"id": "6f40871c-ea6f-4c61-9272-9342c99637e8",
"name": "datecreated",
"type": "string",
"value": "=*:date: Date Created:*\\n{{DateTime.fromMillis($('TheHive Trigger').item.json[\"body\"][\"context\"][\"_createdAt\"]).toLocaleString({month: 'long', day: 'numeric', year: 'numeric'})}}"
},
{
"id": "2ea20d66-380f-4a0f-a1ea-c4740293f48b",
"name": "number",
"type": "string",
"value": "=:hash: Case #{{ $('TheHive Trigger').item.json.body.details.number }} created on TheHive "
},
{
"id": "a22dd686-ac38-4e73-a0ec-051dce57f9fa",
"name": "severity",
"type": "string",
"value": "=*Severity:* {{ $('TheHive Trigger').item.json[\"body\"][\"context\"][\"severityLabel\"] }}"
},
{
"id": "1c210cfb-2a03-4e81-a8c5-2db739d98226",
"name": "tlp",
"type": "string",
"value": "=*Traffic Light Protocol(TLP):* {{ $('TheHive Trigger').item.json[\"body\"][\"context\"][\"tlpLabel\"] }}"
},
{
"id": "53e1d1a9-055a-48c2-80de-b694871c6620",
"name": "pap",
"type": "string",
"value": "=*Permissible Actions Protocol(PAP):* {{ $('TheHive Trigger').item.json[\"body\"][\"context\"][\"papLabel\"] }}"
},
{
"id": "ee630583-a6ad-4bab-ad78-7846df3ac093",
"name": "description",
"type": "string",
"value": "=:spiral_note_pad: *Case Description:*\\n{{ $('TheHive Trigger').item.json[\"body\"][\"context\"][\"description\"] }}"
},
{
"id": "48ac7d92-5177-46be-b01e-83493f18ee09",
"name": "assignee",
"type": "string",
"value": "={{ $json.user.profile.real_name }}"
},
{
"id": "f9c06ecf-d3d5-490c-a848-02c88fbd3ab4",
"name": "profilepic",
"type": "string",
"value": "={{ $json.user.profile.image_32 }}"
},
{
"id": "bb4ec29d-fac2-4eb9-a177-fca9d2798514",
"name": "caseid",
"type": "string",
"value": "={{ $('TheHive Trigger').item.json[\"body\"][\"objectId\"] }}"
},
{
"id": "7a485f44-b855-4633-ba51-82e7490d7166",
"name": "tags",
"type": "string",
"value": "=:label: *Tags:*\\n{{ $('TheHive Trigger').item.json[\"body\"][\"context\"][\"tags\"].join(', ') }}"
},
{
"id": "a99d49b4-af10-4e04-a9c6-2b17a14643ff",
"name": "status_emoji",
"type": "string",
"value": "={{ $(`Formatting Dictionaries`).item.json.dictionary.STATUS[$('TheHive Trigger').item.json[\"body\"][\"context\"][\"status\"].toUpperCase()] }}"
},
{
"id": "a4884fc5-2d92-4c34-af9c-61240bc564d5",
"name": "status",
"type": "string",
"value": "={{ $('TheHive Trigger').item.json[\"body\"][\"context\"][\"status\"] }}"
},
{
"id": "7efb073b-1f1a-4d11-97a2-d61a9baeb52f",
"name": "tlp_emoji",
"type": "string",
"value": "={{ $(`Formatting Dictionaries`).item.json.dictionary.TLP[$('TheHive Trigger').item.json[\"body\"][\"context\"][\"tlpLabel\"].toUpperCase()] }}"
},
{
"id": "19f5bc67-97c3-47bc-8210-738057f30c1f",
"name": "pap_emoji",
"type": "string",
"value": "={{ $(`Formatting Dictionaries`).item.json.dictionary.PAP[$('TheHive Trigger').item.json[\"body\"][\"context\"][\"papLabel\"].toUpperCase()] }}"
},
{
"id": "d31504be-e4ef-4704-8b1b-cb1a8072298d",
"name": "severity_emoji",
"type": "string",
"value": "={{ $(`Formatting Dictionaries`).item.json.dictionary.Severity[$('TheHive Trigger').item.json[\"body\"][\"context\"][\"severityLabel\"].toUpperCase()] }}"
}
]
}
},
"typeVersion": 3.3
},
{
"id": "b7747c0c-52ec-415b-aa55-ce399b53054b",
"name": "Update Message with new Assignee",
"type": "n8n-nodes-base.httpRequest",
"position": [
3200,
1160
],
"parameters": {
"url": "https://slack.com/api/chat.update",
"method": "POST",
"options": {},
"sendBody": true,
"sendQuery": true,
"authentication": "predefinedCredentialType",
"bodyParameters": {
"parameters": [
{
"name": "channel",
"value": "={{ $('Edit Fields').item.json.response.channel.id }}"
},
{
"name": "ts",
"value": "={{ $('Edit Fields').item.json.response.container.message_ts }}"
},
{
"name": "blocks",
"value": "={{ JSON.stringify($json.blocks) }}"
}
]
},
"queryParameters": {
"parameters": [
{
"name": "Content-Type",
"value": "application/json"
}
]
},
"nodeCredentialType": "slackApi"
},
"credentials": {
"slackApi": {
"name": "<your credential>"
}
},
"typeVersion": 4.2
},
{
"id": "b548c331-1612-40a9-806c-8136c1eb6dbe",
"name": "Sticky Note4",
"type": "n8n-nodes-base.stickyNote",
"position": [
1140,
385.7161688656365
],
"parameters": {
"color": 7,
"width": 706.9954015609856,
"height": 467.56934570944634,
"content": "\n## Assign Case to Others\nSince slack does not send the slack user email, we must take the extra step \nof passing the user ID back to slack, and getting back the email address of \nthe person selecting the buttons. For this to work correctly, TheHive users \nemails and Slack user emails must be the same. "
},
"typeVersion": 1
},
{
"id": "34dc3eb9-e19a-46c1-947d-65c9c5be9993",
"name": "Sticky Note5",
"type": "n8n-nodes-base.stickyNote",
"position": [
1140,
860
],
"parameters": {
"color": 7,
"width": 1400.2199299541444,
"height": 1720.4067726820667,
"content": "\n# Streamlined Case Updates via Slack for SOC Analysts\n\n## This workflow segment is crucial for enhancing the responsiveness and efficiency of SOC operations by allowing analysts to update TheHive case attributes directly from Slack. By using form inputs and buttons embedded within Slack messages, analysts can quickly modify case details without switching to TheHive. This integration significantly speeds up case handling and improves the management of security incidents.\n\n\n**Key Operations:**\n- **Dynamic Slack Blocks**: Utilizes custom-built Slack block elements to present actionable items directly within the communication platform.\n- **Immediate Actions**: Enables actions like closing a case as a false positive, updating case severity, TLP (Traffic Light Protocol), PAP (Permissible Action Protocol), and more with simple clicks.\n- **Automated Updates**: Upon interaction, the workflow automatically updates the respective fields in TheHive, ensuring that all case information is current and accurately reflected.\n- **Feedback Loop**: After updating, a confirmation is sent back to Slack, confirming the action taken, which helps in maintaining clear communication and audit trails.\n\n\n**Benefits for SOC Analysts:**\n- **Efficiency**: Reduces the time spent switching between tools and streamlines the case update process.\n- **Accuracy**: Minimizes human error by automating data entry from Slack to TheHive.\n- **Visibility**: Keeps the entire team informed about case status updates in real-time, enhancing collaborative efforts.\n\n\n**Setup Note:**\n- Ensure that your TheHive and Slack integration permissions are configured to allow updates and that users are familiar with the operational workflow.\n- The last set of \"Set\" nodes on the far right of the workflow are designed to split the Slack block kit action into two parts. This split facilitates easier customization of the action options at the bottom of the Slack message. While customization is possible, a good understanding of JSON is desirable to modify these settings effectively.\n\n\nThis integration not only speeds up response times but also leverages the collaborative environment of Slack to keep the SOC team agile and well-informed."
},
"typeVersion": 1
},
{
"id": "233924c6-eceb-4618-90fa-2633f0e3cf84",
"name": "Sticky Note7",
"type": "n8n-nodes-base.stickyNote",
"position": [
1135,
3242
],
"parameters": {
"color": 7,
"width": 988.1220012094333,
"height": 613.5055433060886,
"content": "\n## Add a task to a Case - Process the task details\nOnce the modal window is submitted, this sections then processes the data sent in. Certain fields send data back to the server so the no operation check simply ignores certain types of inputs in the modal until the whole modal is filled out. "
},
"typeVersion": 1
},
{
"id": "c32929b9-9f57-4f70-86da-e038c786d360",
"name": "Check if Case Options",
"type": "n8n-nodes-base.if",
"position": [
1175,
3560
],
"parameters": {
"options": {},
"conditions": {
"options": {
"leftValue": "",
"caseSensitive": true,
"typeValidation": "strict"
},
"combinator": "and",
"conditions": [
{
"id": "de563083-5735-42d3-8765-5b072b10ff9c",
"operator": {
"type": "string",
"operation": "notEquals"
},
"leftValue": "={{ $json.response.actions[0].action_id }}",
"rightValue": "submit-task-option"
}
]
}
},
"typeVersion": 2
},
{
"id": "5887da0e-36eb-4bd3-8dba-6422dc8fa70a",
"name": "Case Slack Block Rebuild",
"type": "n8n-nodes-base.set",
"position": [
2340,
680
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "c1fccf83-8223-42a2-837e-11eafe5d23fd",
"name": "slackblocks",
"type": "string",
"value": "={\"type\":\"image\",\"block_id\":\"image_block\",\"image_url\":\"https://i.imgur.com/y2Yw1ZP.png\",\"alt_text\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"caseid\"]}}\"},{\"type\":\"header\",\"block_id\":\"header_case_created\",\"text\":{\"type\":\"plain_text\",\"text\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"number\"]}}\",\"emoji\":true}},{\"type\":\"divider\",\"block_id\":\"divider_1\"},{\"type\":\"section\",\"block_id\":\"section_case_details\",\"fields\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"title\"].replace(\"\\n\",\"\\\\n\")}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"datecreated\"].replace(\"\\n\",\"\\\\n\")}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"tags\"].replace(\"\\n\",\"\\\\n\")}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"description\"].replace(\"\\n\",\"\\\\n\")}}\"}]},{\"type\":\"actions\",\"block_id\":\"actions_case_options\",\"elements\":[{\"type\":\"button\",\"text\":{\"type\":\"plain_text\",\"text\":\"Close Case as False Positive\",\"emoji\":true},\"style\":\"danger\",\"value\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"caseid\"]}}\",\"action_id\":\"close_case\"},{\"type\":\"button\",\"text\":{\"type\":\"plain_text\",\"text\":\"Add a Task\",\"emoji\":true},\"value\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"caseid\"]}}\",\"action_id\":\"add_task\"}]},{\"type\":\"divider\",\"block_id\":\"divider_2\"},{\"type\":\"header\",\"block_id\":\"header_current_assignment\",\"text\":{\"type\":\"plain_text\",\"text\":\"\ud83d\udd0d Case Details:\",\"emoji\":true}},{\"type\":\"context\",\"block_id\":\"context_status\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"status\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_severity\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"severity\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_tlp\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"tlp\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_pap\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Assign').item.json[\"pap\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_assignee\",\"elements\":[{\"type\":\"image\",\"image_url\":\"{{ $('Get Slack User\\'s Email From Slack').item.json.profile.image_32 }}\",\"alt_text\":\"Profile Pic\"},{\"type\":\"mrkdwn\",\"text\":\"Assignee: {{ $('Get Slack User\\'s Email From Slack').item.json.profile.real_name }}\"}]}"
}
]
}
},
"typeVersion": 3.3
},
{
"id": "0dc10f84-c087-45ab-8b1d-f770725f400b",
"name": "Close Case Block Rebuild",
"type": "n8n-nodes-base.set",
"position": [
2400,
1700
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "c1fccf83-8223-42a2-837e-11eafe5d23fd",
"name": "slackblocks",
"type": "string",
"value": "={\"type\":\"image\",\"block_id\":\"image_block\",\"image_url\":\"https://i.imgur.com/y2Yw1ZP.png\",\"alt_text\":\"{{ $('Prep Fields For Slack - Close').item.json[\"caseid\"]}}\"},{\"type\":\"header\",\"block_id\":\"header_case_created\",\"text\":{\"type\":\"plain_text\",\"text\":\"{{ $('Prep Fields For Slack - Close').item.json[\"number\"]}}\",\"emoji\":true}},{\"type\":\"divider\",\"block_id\":\"divider_1\"},{\"type\":\"section\",\"block_id\":\"section_case_details\",\"fields\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Close').item.json[\"title\"].replace(\"\\n\",\"\\\\n\")}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Close').item.json[\"datecreated\"].replace(\"\\n\",\"\\\\n\")}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Close').item.json[\"tags\"].replace(\"\\n\",\"\\\\n\")}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Close').item.json[\"description\"].replace(\"\\n\",\"\\\\n\")}}\"}]},{\"type\":\"actions\",\"block_id\":\"actions_case_options\",\"elements\":[{\"type\":\"button\",\"text\":{\"type\":\"plain_text\",\"text\":\"Close Case as False Positive\",\"emoji\":true},\"style\":\"danger\",\"value\":\"{{ $('Prep Fields For Slack - Close').item.json[\"caseid\"]}}\",\"action_id\":\"close_case\"},{\"type\":\"button\",\"text\":{\"type\":\"plain_text\",\"text\":\"Add a Task\",\"emoji\":true},\"value\":\"{{ $('Prep Fields For Slack - Close').item.json[\"caseid\"]}}\",\"action_id\":\"add_task\"}]},{\"type\":\"divider\",\"block_id\":\"divider_2\"},{\"type\":\"header\",\"block_id\":\"header_current_assignment\",\"text\":{\"type\":\"plain_text\",\"text\":\"\ud83d\udd0d Case Details:\",\"emoji\":true}},{\"type\":\"context\",\"block_id\":\"context_status\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Close').item.json[\"status\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_severity\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Close').item.json[\"severity\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_tlp\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Close').item.json[\"tlp\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_pap\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Close').item.json[\"pap\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_assignee\",\"elements\":[{\"type\":\"image\",\"image_url\":\"{{ $('Prep Fields For Slack - Close').item.json[\"profilepic\"]}}\",\"alt_text\":\"Profile Pic\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Close').item.json[\"assignee\"] }}\"}]}"
}
]
}
},
"typeVersion": 3.3
},
{
"id": "3b95146f-d842-4c69-b537-bad5603ba0d0",
"name": "Severity Case Block Rebuild1",
"type": "n8n-nodes-base.set",
"position": [
2400,
1880
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "c1fccf83-8223-42a2-837e-11eafe5d23fd",
"name": "slackblocks",
"type": "string",
"value": "={\"type\":\"image\",\"block_id\":\"image_block\",\"image_url\":\"https://i.imgur.com/y2Yw1ZP.png\",\"alt_text\":\"{{ $('Prep Fields For Slack - Severity').item.json['caseid']}}\"},{\"type\":\"header\",\"block_id\":\"header_case_created\",\"text\":{\"type\":\"plain_text\",\"text\":\"{{ $('Prep Fields For Slack - Severity').item.json['number']}}\",\"emoji\":true}},{\"type\":\"divider\",\"block_id\":\"divider_1\"},{\"type\":\"section\",\"block_id\":\"section_case_details\",\"fields\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Severity').item.json['title'].replace('\\n','\\\\n')}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Severity').item.json['datecreated'].replace('\\n','\\\\n')}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Severity').item.json['tags'].replace('\\n','\\\\n')}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Severity').item.json['description'].replace('\\n','\\\\n')}}\"}]},{\"type\":\"actions\",\"block_id\":\"actions_case_options\",\"elements\":[{\"type\":\"button\",\"text\":{\"type\":\"plain_text\",\"text\":\"Close Case as False Positive\",\"emoji\":true},\"style\":\"danger\",\"value\":\"{{ $('Prep Fields For Slack - Severity').item.json['caseid']}}\",\"action_id\":\"close_case\"},{\"type\":\"button\",\"text\":{\"type\":\"plain_text\",\"text\":\"Add a Task\",\"emoji\":true},\"value\":\"{{ $('Prep Fields For Slack - Severity').item.json['caseid']}}\",\"action_id\":\"add_task\"}]},{\"type\":\"divider\",\"block_id\":\"divider_2\"},{\"type\":\"header\",\"block_id\":\"header_current_assignment\",\"text\":{\"type\":\"plain_text\",\"text\":\"\ud83d\udd0d Case Details:\",\"emoji\":true}},{\"type\":\"context\",\"block_id\":\"context_status\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Severity').item.json['status']}}\"}]},{\"type\":\"context\",\"block_id\":\"context_severity\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Severity').item.json['severity']}}\"}]},{\"type\":\"context\",\"block_id\":\"context_tlp\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Severity').item.json['tlp']}}\"}]},{\"type\":\"context\",\"block_id\":\"context_pap\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Severity').item.json['pap']}}\"}]},{\"type\":\"context\",\"block_id\":\"context_assignee\",\"elements\":[{\"type\":\"image\",\"image_url\":\"{{ $('Prep Fields For Slack - Severity').item.json['profilepic']}}\",\"alt_text\":\"Profile Pic\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For Slack - Severity').item.json['assignee']}}\"}]}"
}
]
}
},
"typeVersion": 3.3
},
{
"id": "be1fe770-aaa2-4ed2-9ff1-5baa00423d76",
"name": "PAP Case Block Rebuild",
"type": "n8n-nodes-base.set",
"position": [
2400,
2060
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "c1fccf83-8223-42a2-837e-11eafe5d23fd",
"name": "slackblocks",
"type": "string",
"value": "={\"type\":\"image\",\"block_id\":\"image_block\",\"image_url\":\"https://i.imgur.com/y2Yw1ZP.png\",\"alt_text\":\"{{ $('Prep Fields For PAP Slack').item.json[\"caseid\"]}}\"},{\"type\":\"header\",\"block_id\":\"header_case_created\",\"text\":{\"type\":\"plain_text\",\"text\":\"{{ $('Prep Fields For PAP Slack').item.json[\"number\"]}}\",\"emoji\":true}},{\"type\":\"divider\",\"block_id\":\"divider_1\"},{\"type\":\"section\",\"block_id\":\"section_case_details\",\"fields\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For PAP Slack').item.json[\"title\"].replace(\"\\n\",\"\\\\n\")}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For PAP Slack').item.json[\"datecreated\"].replace(\"\\n\",\"\\\\n\")}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For PAP Slack').item.json[\"tags\"].replace(\"\\n\",\"\\\\n\")}}\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For PAP Slack').item.json[\"description\"].replace(\"\\n\",\"\\\\n\")}}\"}]},{\"type\":\"actions\",\"block_id\":\"actions_case_options\",\"elements\":[{\"type\":\"button\",\"text\":{\"type\":\"plain_text\",\"text\":\"Close Case as False Positive\",\"emoji\":true},\"style\":\"danger\",\"value\":\"{{ $('Prep Fields For PAP Slack').item.json[\"caseid\"]}}\",\"action_id\":\"close_case\"},{\"type\":\"button\",\"text\":{\"type\":\"plain_text\",\"text\":\"Add a Task\",\"emoji\":true},\"value\":\"{{ $('Prep Fields For PAP Slack').item.json[\"caseid\"]}}\",\"action_id\":\"add_task\"}]},{\"type\":\"divider\",\"block_id\":\"divider_2\"},{\"type\":\"header\",\"block_id\":\"header_current_assignment\",\"text\":{\"type\":\"plain_text\",\"text\":\"\ud83d\udd0d Case Details:\",\"emoji\":true}},{\"type\":\"context\",\"block_id\":\"context_status\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For PAP Slack').item.json[\"status\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_severity\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For PAP Slack').item.json[\"severity\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_tlp\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For PAP Slack').item.json[\"tlp\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_pap\",\"elements\":[{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For PAP Slack').item.json[\"pap\"]}}\"}]},{\"type\":\"context\",\"block_id\":\"context_assignee\",\"elements\":[{\"type\":\"image\",\"image_url\":\"{{ $('Prep Fields For PAP Slack').item.json[\"profilepic\"]}}\",\"alt_text\":\"Profile Pic\"},{\"type\":\"mrkdwn\",\"text\":\"{{ $('Prep Fields For PAP Slack').item.json[\"assignee\"] }}\"}]}"
}
]
}
},
"typeVersion": 3.3
},
{
"id": "0d9a2036-6a4c-4ffd-95a8-34b6861894b9",
"name": "Prep Fields For PAP Slack",
"type": "n8n-nodes-base.set",
"position": [
1600,
2060
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "0001aed3-a3fb-4229-8fa1-1941f0ee8a12",
"name": "title",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[0].text }}"
},
{
"id": "6f40871c-ea6f-4c61-9272-9342c99637e8",
"name": "datecreated",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[1].text }}"
},
{
"id": "2ea20d66-380f-4a0f-a1ea-c4740293f48b",
"name": "number",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[1].text.text }}"
},
{
"id": "a22dd686-ac38-4e73-a0ec-051dce57f9fa",
"name": "severity",
"type": "string",
"value": "={{ $('Edit Fields').item.json[\"response\"][\"message\"][\"blocks\"][8][\"elements\"][0][\"text\"] }}"
},
{
"id": "1c210cfb-2a03-4e81-a8c5-2db739d98226",
"name": "tlp",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[9].elements[0].text }}"
},
{
"id": "53e1d1a9-055a-48c2-80de-b694871c6620",
"name": "pap",
"type": "string",
"value": "={{ $('Edit Fields').item.json[\"dictionary\"][\"PAP\"][$('Edit Fields').item.json[\"response\"][\"state\"][\"values\"][\"actions_assignment_options\"][\"update_pap\"][\"selected_option\"][\"text\"][\"text\"].toUpperCase()] }} *Permissible Actions Protocol(PAP):* {{ $('Edit Fields').item.json[\"response\"][\"state\"][\"values\"][\"actions_assignment_options\"][\"update_pap\"][\"selected_option\"][\"text\"][\"text\"].toUpperCase() }}"
},
{
"id": "ee630583-a6ad-4bab-ad78-7846df3ac093",
"name": "description",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[3].text }}"
},
{
"id": "48ac7d92-5177-46be-b01e-83493f18ee09",
"name": "assignee",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[11].elements[1].text }}"
},
{
"id": "f9c06ecf-d3d5-490c-a848-02c88fbd3ab4",
"name": "profilepic",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[11].elements[0].image_url }}"
},
{
"id": "bb4ec29d-fac2-4eb9-a177-fca9d2798514",
"name": "caseid",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[0].alt_text }}"
},
{
"id": "7a485f44-b855-4633-ba51-82e7490d7166",
"name": "tags",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[2].text.replaceAll(\"\\n\",\"\\\\n\").replaceAll(\"**\",\"*\") }}"
},
{
"id": "a4884fc5-2d92-4c34-af9c-61240bc564d5",
"name": "status",
"type": "string",
"value": "={{ $json.response.message.blocks[7].elements[0].text }}"
},
{
"id": "449c052a-05b4-4c03-99a4-b5fe7ec0e102",
"name": "newassignee",
"type": "string",
"value": "={{ $json.response.state.values.actions_assignment_options['change-assignee'].selected_user }}"
},
{
"id": "8278ead1-85c0-4921-ac36-9abfd44f99c8",
"name": "papId",
"type": "number",
"value": "={{ $json.response.state.values.actions_assignment_options.update_pap.selected_option.value }}"
}
]
}
},
"typeVersion": 3.3
},
{
"id": "574caf88-eef7-4b06-9f04-7a468ef56325",
"name": "Map Actions",
"type": "n8n-nodes-base.set",
"position": [
2700,
1160
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "7d88f9ff-3046-491f-a31c-642839fba7b4",
"name": "actions",
"type": "string",
"value": "={{ $json.slackblocks }}"
},
{
"id": "5cde079d-1b30-41b0-948d-f3b8bacb88bf",
"name": "buttons",
"type": "string",
"value": "={\"type\":\"actions\",\"block_id\":\"actions_assignment_options\",\"elements\":[{\"type\":\"users_select\",\"placeholder\":{\"type\":\"plain_text\",\"text\":\"Change Assignee\",\"emoji\":true},\"action_id\":\"change-assignee\"},{\"type\":\"static_select\",\"placeholder\":{\"type\":\"plain_text\",\"text\":\"Change Status\",\"emoji\":true},\"action_id\":\"update-status\",\"options\":[{\"text\":{\"type\":\"plain_text\",\"text\":\"\ud83c\udd95 New\",\"emoji\":true},\"value\":\"1\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"\ud83d\udd04 In progress\",\"emoji\":true},\"value\":\"2\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"\ud83d\udcd1 Duplicated\",\"emoji\":true},\"value\":\"3\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"\u274e False positive\",\"emoji\":true},\"value\":\"4\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"\u2753 Indeterminate\",\"emoji\":true},\"value\":\"5\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"\ud83d\udd35 Other\",\"emoji\":true},\"value\":\"6\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"\u2705 True positive\",\"emoji\":true},\"value\":\"7\"}]},{\"type\":\"static_select\",\"placeholder\":{\"type\":\"plain_text\",\"text\":\"Change severity\",\"emoji\":true},\"action_id\":\"update_severity\",\"options\":[{\"text\":{\"type\":\"plain_text\",\"text\":\"Low\",\"emoji\":true},\"value\":\"1\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"Medium\",\"emoji\":true},\"value\":\"2\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"High\",\"emoji\":true},\"value\":\"3\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"Critical\",\"emoji\":true},\"value\":\"4\"}]},{\"type\":\"static_select\",\"placeholder\":{\"type\":\"plain_text\",\"text\":\"Change TLP\",\"emoji\":true},\"action_id\":\"update_tlp\",\"options\":[{\"text\":{\"type\":\"plain_text\",\"text\":\"White\",\"emoji\":true},\"value\":\"0\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"Green\",\"emoji\":true},\"value\":\"1\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"Amber\",\"emoji\":true},\"value\":\"2\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"Red\",\"emoji\":true},\"value\":\"3\"}]},{\"type\":\"static_select\",\"placeholder\":{\"type\":\"plain_text\",\"text\":\"Change PAP\",\"emoji\":true},\"action_id\":\"update_pap\",\"options\":[{\"text\":{\"type\":\"plain_text\",\"text\":\"White\",\"emoji\":true},\"value\":\"0\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"Green\",\"emoji\":true},\"value\":\"1\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"Amber\",\"emoji\":true},\"value\":\"2\"},{\"text\":{\"type\":\"plain_text\",\"text\":\"Red\",\"emoji\":true},\"value\":\"3\"}]}]},{\"type\":\"section\",\"text\":{\"type\":\"mrkdwn\",\"text\":\":bee: View the case in TheHive\"},\"accessory\":{\"type\":\"button\",\"style\":\"primary\",\"text\":{\"type\":\"plain_text\",\"text\":\"View Case\",\"emoji\":true},\"value\":\"click_me_123\",\"url\":\"{{ $('Edit Fields').item.json.theHiveUrl }}/cases/{{ $('Edit Fields').item.json.response.message.blocks[0].alt_text }}/details\",\"action_id\":\"viewlink\"}}"
}
]
}
},
"typeVersion": 3.3
},
{
"id": "d0e2d26f-9ab1-4f4f-a700-d686dda8dbef",
"name": "Build Final Block",
"type": "n8n-nodes-base.set",
"position": [
2920,
1160
],
"parameters": {
"mode": "raw",
"options": {},
"jsonOutput": "={\"blocks\": [{{ $json.actions }},{{ $json.buttons }}]}"
},
"typeVersion": 3.3
},
{
"id": "e189e865-664a-47c1-b877-59788967c852",
"name": "Prep Fields For TLP Slack",
"type": "n8n-nodes-base.set",
"position": [
1600,
2240
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "0001aed3-a3fb-4229-8fa1-1941f0ee8a12",
"name": "title",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[0].text }}"
},
{
"id": "6f40871c-ea6f-4c61-9272-9342c99637e8",
"name": "datecreated",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[1].text }}"
},
{
"id": "2ea20d66-380f-4a0f-a1ea-c4740293f48b",
"name": "number",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[1].text.text }}"
},
{
"id": "a22dd686-ac38-4e73-a0ec-051dce57f9fa",
"name": "severity",
"type": "string",
"value": "={{ $('Edit Fields').item.json[\"response\"][\"message\"][\"blocks\"][8][\"elements\"][0][\"text\"] }}"
},
{
"id": "1c210cfb-2a03-4e81-a8c5-2db739d98226",
"name": "tlp",
"type": "string",
"value": "={{ $('Edit Fields').item.json[\"dictionary\"][\"TLP\"][$('Edit Fields').item.json[\"response\"][\"state\"][\"values\"][\"actions_assignment_options\"][\"update_tlp\"][\"selected_option\"][\"text\"][\"text\"].toUpperCase()] }} *Traffic Light Protocol(TLP):* {{ $('Edit Fields').item.json[\"response\"][\"state\"][\"values\"][\"actions_assignment_options\"][\"update_tlp\"][\"selected_option\"][\"text\"][\"text\"].toUpperCase() }}"
},
{
"id": "53e1d1a9-055a-48c2-80de-b694871c6620",
"name": "pap",
"type": "string",
"value": "={{ $json.response.message.blocks[10].elements[0].text }}"
},
{
"id": "ee630583-a6ad-4bab-ad78-7846df3ac093",
"name": "description",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[3].text }}"
},
{
"id": "48ac7d92-5177-46be-b01e-83493f18ee09",
"name": "assignee",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[11].elements[1].text }}"
},
{
"id": "f9c06ecf-d3d5-490c-a848-02c88fbd3ab4",
"name": "profilepic",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[11].elements[0].image_url }}"
},
{
"id": "bb4ec29d-fac2-4eb9-a177-fca9d2798514",
"name": "caseid",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[0].alt_text }}"
},
{
"id": "7a485f44-b855-4633-ba51-82e7490d7166",
"name": "tags",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[2].text.replaceAll(\"\\n\",\"\\\\n\").replaceAll(\"**\",\"*\") }}"
},
{
"id": "a4884fc5-2d92-4c34-af9c-61240bc564d5",
"name": "status",
"type": "string",
"value": "={{ $json.response.message.blocks[7].elements[0].text }}"
},
{
"id": "449c052a-05b4-4c03-99a4-b5fe7ec0e102",
"name": "newassignee",
"type": "string",
"value": "={{ $json.response.state.values.actions_assignment_options['change-assignee'].selected_user }}"
},
{
"id": "8278ead1-85c0-4921-ac36-9abfd44f99c8",
"name": "tlpId",
"type": "number",
"value": "={{ $('Edit Fields').item.json.response.state.values.actions_assignment_options.update_tlp.selected_option.value }}"
}
]
}
},
"typeVersion": 3.3
},
{
"id": "286a5624-a546-4a7f-a416-0b4ef66a99d7",
"name": "Prep Fields For Status Slack",
"type": "n8n-nodes-base.set",
"position": [
1600,
2420
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "0001aed3-a3fb-4229-8fa1-1941f0ee8a12",
"name": "title",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[0].text }}"
},
{
"id": "6f40871c-ea6f-4c61-9272-9342c99637e8",
"name": "datecreated",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[1].text }}"
},
{
"id": "2ea20d66-380f-4a0f-a1ea-c4740293f48b",
"name": "number",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[1].text.text }}"
},
{
"id": "a22dd686-ac38-4e73-a0ec-051dce57f9fa",
"name": "severity",
"type": "string",
"value": "={{ $('Edit Fields').item.json[\"response\"][\"message\"][\"blocks\"][8][\"elements\"][0][\"text\"] }}"
},
{
"id": "1c210cfb-2a03-4e81-a8c5-2db739d98226",
"name": "tlp",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[9].elements[0].text }}"
},
{
"id": "53e1d1a9-055a-48c2-80de-b694871c6620",
"name": "pap",
"type": "string",
"value": "={{ $json.response.message.blocks[10].elements[0].text }}"
},
{
"id": "ee630583-a6ad-4bab-ad78-7846df3ac093",
"name": "description",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[3].text }}"
},
{
"id": "48ac7d92-5177-46be-b01e-83493f18ee09",
"name": "assignee",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[11].elements[1].text }}"
},
{
"id": "f9c06ecf-d3d5-490c-a848-02c88fbd3ab4",
"name": "profilepic",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[11].elements[0].image_url }}"
},
{
"id": "bb4ec29d-fac2-4eb9-a177-fca9d2798514",
"name": "caseid",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[0].alt_text }}"
},
{
"id": "7a485f44-b855-4633-ba51-82e7490d7166",
"name": "tags",
"type": "string",
"value": "={{ $('Edit Fields').item.json.response.message.blocks[3].fields[2].text.replaceAll(\"\\n\",\"\\\\n\").replaceAll(\"**\",\"*\") }}"
},
{
"id": "a4884fc5-2d92-4c34-af9c-61240bc564d5",
"name": "status",
"type": "string",
"value": "={{ $('Edit Fields').item.json[\"dictionary\"][\"STATUSEMOJI\"][$('Edit Fields').item.json[\"response\"][\"state\"][\"values\"][\"actions_assignment_options\"][\"update-status\"][\"selected_option\"][\"value\"].toUpperCase()] }} *Status:* {{ $('Edit Fields').item.json[\"dictionary\"][\"STATUS\"][$('Edit Fields').item.json[\"response\"][\"state\"][\"values\"][\"actions_assignment_options\"][\"update-status\"][\"selected_option\"][\"value\"].toUpperCase()] }}"
},
{
"id": "8278ead1-85c0-4921-ac36-9abfd44f99c8",
"name": "statusvalue",
"type": "string",
"value": "={{ $('Edit Fields').item.json[\"dictionary\"][\"STATUS\"][$('Edit Fields').item.json[\"response\"][\"state\"][\"values\"][\"actions_assignment_options\"][\"update-status\"][\"selected_option\"][\"value\"].toUpperCase()] }}"
}
]
}
},
"typeVersion": 3.3
},
{
"id": "bdaa7347-dd4f-4183-9f21-979557320603",
"name": "Update Status in TheHive",
"type": "n8n-nodes-base.theHiveProject",
"position": [
2060,
2420
],
"parameters": {
"resource": "case",
"operation": "update",
"caseUpdateFields": {
"value": {
"id": "={{ $json.caseid }}",
"flag": false,
"status": "={{ $json.statusvalue }}"
},
"schema": [
{
"id": "id",
"type": "string",
"display": true,
"removed": false,
"required": false,
"displayName": "ID",
"defaultMatch": true,
"canBeUsedToMatch": true
},
{
"id": "title",
"type": "string",
"display": true,
"removed": true,
"required": false,
"displayName": "Title",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "description",
"type": "string",
"display": true,
"removed": true,
"required": false,
"displayName": "Description",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "severity",
"type": "options",
"display": true,
"options": [
{
"name": "Low",
"value": 1
},
{
"name": "Medium",
"value": 2
},
{
"name": "High",
"value": 3
},
{
"name": "Critical",
"value": 4
}
],
"removed": true,
"required": false,
"displayName": "Severity (Severity of information)",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "startDate",
"type": "dateTime",
"display": true,
"removed": true,
"required": false,
"displayName": "Start Date",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "endDate",
"type": "dateTime",
"display": true,
"removed": true,
"required": false,
"displayName": "End Date",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "tags",
"type": "string",
"display": true,
"removed": true,
"required": false,
"displayName": "Tags",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "flag",
"type": "boolean",
"display": true,
"removed": true,
"required": false,
"displayName": "Flag",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "tlp",
"type": "options",
"display": true,
"options": [
{
"name": "White",
"value": 0
},
{
"name": "Green",
"value": 1
},
{
"name": "Amber",
"value": 2
},
{
"name": "Red",
"value": 3
}
],
"removed": true,
"required": false,
"displayName": "TLP (Confidentiality of information)",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "pap",
"type": "options",
"display": true,
"options": [
{
"name": "White",
"value": 0
},
{
"name": "Green",
"value": 1
},
{
"name": "Amber",
"value": 2
},
{
"name": "Red",
"value": 3
}
],
"removed": true,
"required": false,
"displayName": "PAP (Level of exposure of information)",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "summary",
"type": "string",
"display": true,
"removed": true,
"required": false,
"displayName": "Summary",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "status",
"type": "options",
"display": true,
"options": [
{
"name": "Duplicated",
"value": "Duplicated",
"description": "Stage: Closed"
},
{
"name": "FalsePositive",
"value": "FalsePositive",
"description": "Stage: Closed"
},
{
"name": "Indeterminate",
"value": "Indeterminate",
"description": "Stage: Closed"
},
{
"name": "InProgress",
"value": "InProgress",
"description": "Stage: InProgress"
},
{
"name": "New",
"value": "New",
"description": "Stage: New"
},
{
"name": "Other",
"value": "Other",
"description": "Stage: Closed"
},
{
"name": "TruePositive",
"value": "TruePositive",
"description": "Stage: Closed"
}
],
"removed": false,
"required": false,
"displayName": "Status",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "assignee",
"type": "options",
"display": true,
"options": [
{
"name": "Angel",
"value": "angel@n8n.io"
},
{
"name": "John Smith",
"value": "john@n8n.io"
}
],
"removed": true,
"required": false,
"displayName": "Assignee",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "impactStatus",
"type": "string",
"display": true,
"removed": true,
"required": false,
"displayName": "Impact Status",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
Credentials you'll need
Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.
slackApitheHiveProjectApi
About this workflow
Webhook Slack. Uses theHiveProjectTrigger, stickyNote, httpRequest, theHiveProject. Event-driven trigger; 63 nodes.
Source: https://github.com/Zie619/n8n-workflows — original creator credit. Request a take-down →