{"id":3,"name":"TheHive","nodes":[{"name":"TheHive Create Alert","type":"n8n-nodes-base.theHive","position":[500,360],"parameters":{"date":"2022-04-25T08:53:18.000Z","tags":"tlp:pwhite","type":"misp","title":"TheHive Alert","source":"1311","sourceRef":"1330","description":"Security issue detected on server A2. Please check and take care.","additionalFields":{}},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"id":"node-bcf16cbb"},{"name":"TheHive Read Alerts","type":"n8n-nodes-base.theHive","position":[500,200],"parameters":{"filters":{},"options":{},"operation":"getAll"},"credentials":{"theHiveApi":{"id":"{{ $credentials.theHiveApi.id }}","name":"The Hive account"}},"typeVersion":1,"id":"node-fafa62ee"},{"name":"IF","type":"n8n-nodes-base.if","position":[280,540],"parameters":{"conditions":{"boolean":[{"value1":"={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"object\"][\"stage\"]}}","value2":"=Closed","operation":"notEqual"}]}},"typeVersion":1,"id":"node-a3945ed4"},{"name":"SIGNL4 Send Alert","type":"n8n-nodes-base.signl4","position":[500,520],"parameters":{"message":"={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"details\"][\"description\"]}}","additionalFields":{"title":"={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"details\"][\"title\"]}}","externalId":"={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"objectId\"]}}"}},"credentials":{"signl4Api":{"id":"{{ $credentials.signl4Api.id }}","name":"SIGNL4 Webhook account"}},"typeVersion":1,"id":"node-0f890388"},{"name":"TheHive Webhook Request","type":"n8n-nodes-base.webhook","position":[80,540],"webhookId":"22c76955-3f52-469e-a8ae-3f62e8e87ebe","parameters":{"path":"22c76955-3f52-469e-a8ae-3f62e8e87ebe","options":{},"httpMethod":"POST"},"typeVersion":1,"id":"node-31d7c076"},{"name":"Start (Testing)","type":"n8n-nodes-base.manualTrigger","position":[80,200],"parameters":{},"typeVersion":1,"id":"node-a4f54168"},{"name":"SIGNL4 Resolve Alert","type":"n8n-nodes-base.signl4","position":[500,720],"parameters":{"operation":"resolve","externalId":"={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"objectId\"]}}"},"credentials":{"signl4Api":{"id":"{{ $credentials.signl4Api.id }}","name":"SIGNL4 Webhook account"}},"typeVersion":1,"id":"node-7da9e42a"},{"id":"error-e3f742b1","name":"Error Handler","type":"n8n-nodes-base.stopAndError","typeVersion":1,"position":[1000,400],"parameters":{"message":"Workflow execution error","options":{}}}],"active":false,"settings":{"executionOrder":"v1","saveManualExecutions":true,"callerPolicy":"workflowsFromSameOwner","errorWorkflow":null,"timezone":"UTC","executionTimeout":3600,"maxExecutions":1000,"retryOnFail":true,"retryCount":3},"connections":{},"meta":{"instanceId":"workflow-f6a0ef04","versionId":"1.0.0","createdAt":"2025-09-29T07:08:00.949767","updatedAt":"2025-09-29T07:08:00.949781","owner":"n8n-user","license":"MIT","category":"automation","status":"active","priority":"high","environment":"production"},"description":"Production-ready workflow: TheHive. This workflow has been optimized for production use with comprehensive error handling, security, and documentation."}