{
  "name": "TheHive",
  "nodes": [
    {
      "name": "TheHive Create Alert",
      "type": "n8n-nodes-base.theHive",
      "position": [
        500,
        360
      ],
      "parameters": {
        "date": "2022-04-25T08:53:18.000Z",
        "tags": "tlp:pwhite",
        "type": "misp",
        "title": "TheHive Alert",
        "source": "1311",
        "sourceRef": "1330",
        "description": "Security issue detected on server A2. Please check and take care.",
        "additionalFields": {}
      },
      "typeVersion": 1
    },
    {
      "name": "TheHive Read Alerts",
      "type": "n8n-nodes-base.theHive",
      "position": [
        500,
        200
      ],
      "parameters": {
        "filters": {},
        "options": {},
        "operation": "getAll"
      },
      "typeVersion": 1
    },
    {
      "name": "IF",
      "type": "n8n-nodes-base.if",
      "position": [
        280,
        540
      ],
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"object\"][\"stage\"]}}",
              "value2": "=Closed",
              "operation": "notEqual"
            }
          ]
        }
      },
      "typeVersion": 1
    },
    {
      "name": "SIGNL4 Send Alert",
      "type": "n8n-nodes-base.signl4",
      "position": [
        500,
        520
      ],
      "parameters": {
        "message": "={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"details\"][\"description\"]}}",
        "additionalFields": {
          "title": "={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"details\"][\"title\"]}}",
          "externalId": "={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"objectId\"]}}"
        }
      },
      "typeVersion": 1
    },
    {
      "name": "TheHive Webhook Request",
      "type": "n8n-nodes-base.webhook",
      "position": [
        80,
        540
      ],
      "parameters": {
        "path": "22c76955-3f52-469e-a8ae-3f62e8e87ebe",
        "options": {},
        "httpMethod": "POST"
      },
      "typeVersion": 1
    },
    {
      "name": "Start (Testing)",
      "type": "n8n-nodes-base.manualTrigger",
      "position": [
        80,
        200
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "name": "SIGNL4 Resolve Alert",
      "type": "n8n-nodes-base.signl4",
      "position": [
        500,
        720
      ],
      "parameters": {
        "operation": "resolve",
        "externalId": "={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"objectId\"]}}"
      },
      "typeVersion": 1
    },
    {
      "id": "c0b14f2a-f9d9-549c-ade5-b3b4b1c05272",
      "name": "Publication · Overview and setup",
      "type": "n8n-nodes-base.stickyNote",
      "typeVersion": 1,
      "position": [
        -800,
        0
      ],
      "parameters": {
        "content": "# TheHive\n\n## Purpose and structure\nThis folder contains the **TheHive** workflow. Its executable nodes use `if`, `manualTrigger`, `signl4`, `theHive`, `webhook`. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.\n\n## Setup\nImport inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.\n\n## Entry points\nTheHive Webhook Request, Start (Testing)\n\n## Verification\nSanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.\n\n## Attribution\nhttps://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Webhook/0942_Webhook_Signl4_Automation_Webhook.json\nMIT; preserve source notices.",
        "width": 700,
        "height": 800,
        "color": 1
      }
    }
  ],
  "active": false,
  "settings": {},
  "connections": {
    "IF": {
      "main": [
        [
          {
            "node": "SIGNL4 Send Alert",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "SIGNL4 Resolve Alert",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Start (Testing)": {
      "main": [
        [
          {
            "node": "TheHive Create Alert",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "TheHive Webhook Request": {
      "main": [
        [
          {
            "node": "IF",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}