Meet TheHive Flow: native orchestration for TheHive

Today, we’re excited to unveil TheHive Flow. It brings the power of security automation & orchestration inside our Cybersecurity Incident Response Management (CIRM) platform.

Build workflows to manage the repetitive, time-consuming parts of incident response, with transparent AI reasoning where needed, and let analysts focus on the investigations that count.

Hundreds of SOC, CERT and MSSP teams rely on TheHive for its collaborative, case-centric approach to incident response. Alerts, cases, observables and actions are centralized, so analysts always have the full context.

The problem is everything that happens before and around the investigation. The number of incidents keeps going up, and analysts still spend hours on the same predictable tasks: triaging alerts, enriching observables, creating cases, assigning them… Each of those tasks usually involves two or three other tools that are difficult to connect.

Security automation tools were supposed to take that load off analysts. But many of them still put investigation on the side: data leaves the case, gets processed elsewhere and comes back. It means one more system to maintain, constant switching between consoles and automation running outside of the analyst’s workspace, with poor visibility and adaptability.

TheHive Flow closes that gap. Workflows read and write the same alerts, cases and observables your analysts work on. No third-party security automation tool needed, no data split between systems. Automation and investigation live in the same platform, making your incident response and management more efficient and easier to scale.

Analyzers, responders, functions and notifications already let you automate a single reaction to an event. TheHive Flow goes further.

By adding and connecting nodes in a low-code, visual editor, any analyst can now chain these actions (and many more) into end-to-end enrichment, triage and escalation workflows.

Each node represents one step of the workflow: an action in TheHive, a Cortex job, a condition or a call to another tool.

A workflow can start in several ways: from an external tool through a webhook, on a schedule or right from inside an alert or a case. TheHive’s notifications can also start a workflow, so you can plug orchestration into your existing processes.

Once it starts, a workflow acts directly on TheHive data. A TheHive node handles the platform’s native entities: cases, alerts, tasks, observables… Cortex also joins the party, with Analyzers and Responders nodes to run your own jobs inside any workflow. Logic nodes such as If and For Each control how the workflow branches and loops.

We have also built a first set of out-of-the-box integration nodes to connect your stack: EDR, SIEM, identity management, threat intelligence, ticketing and messaging tools… You enter the credentials and pick the action to perform. For internal or less common tools, an HTTP Request node lets you call any REST API.

Take a SOC that receives alert signals from a SIEM. Here’s how TheHive Flow handles the triage:

1. Trigger: on a defined schedule, TheHive Flow polls new alerts from the SIEM
2. Intake: it creates each alert in TheHive, with its observables and fields.
3. Enrichment: it loops through every observable and enriches each one with the right source: Cortex analyzers, VirusTotal or your own CTI tool.
4. Analysis: the LLM of your choice reviews the enrichment results and returns a verdict.
5. Escalation: a condition checks the AI’s verdict and branch results. Likely threats are escalated to cases for further investigation. The rest go to an analyst for confirmation.

When the analyst opens the assigned case or alert, the enrichment results are already there. If something needs further action, the analyst can launch an additional workflow straight from TheHive’s interface instead of switching to another tool. The team can also be notified in their own channel at any step.

The workflow handles the lookups and the data entry, while the analyst makes the decisions.

A few other scenarios teams can automate the same way:

• CVE handling: CVEs affecting your infrastructure become alerts, with a notification to the asset owner.
• Phishing reports: when an employee reports a suspicious email, the workflow ingests and enriches it. If the email belongs to a known campaign, it’s merged into the existing case. If not, a new case is created and assigned to the analyst with the lightest workload.
• ITSM synchronization: when an alert is created in TheHive, the workflow opens a ticket in your ITSM platform, or the other way around. Updates on either side are synced to the other.
• Alert handling from your chat tool: each new alert is posted in the SOC channel, and analysts can trigger actions in TheHive based on their reaction.

Most incident response steps are predictable, a fixed workflow handles them fine. A few need judgment on messy, unstructured input. That’s where an LLM helps.

An LLM node assists the analyst by handling the groundwork, such as summarizing an alert, classifying an observable or drafting a case comment from enrichment results. It returns a JSON output for the next step to use. It works with any OpenAI-compatible provider, letting you use your own favorite language model (or the one allowed by your security policy).

You choose where AI runs, while the rest of the workflow handles the consistent steps.

Letting automation handle part of your security incidents needs trust.

TheHive Flow logs every run, with granular visibility into each node execution: input, output and status. When a workflow fails, you can see which step caused it and fix it quickly.

Even automated, your incident response stays auditable and transparent.

Alert volumes grow faster than headcount, and every analyst handles routine work differently. With TheHive Flow, routine work runs the same way every time, and your analysts spend more of their day on threats that need their expertise.

If you run multiple instances, as MSSPs and large organizations often do, you can export a workflow from one tenant as a YAML file and import it into another. A good idea from one analyst becomes a workflow the whole team runs the same way, making your security operations more consistent.

Automation built solely on custom scripts gets hard to maintain. Each script has its own logic, often relying on a few people to keep it running.

TheHive Flow replaces most of that code with ready-made nodes, so workflows are quicker to build and easier to maintain. Values that several workflows share, like URLs, are stored as global variables: change one, and every workflow using it picks up the change. The same goes for credentials: API keys and tokens can be stored as secrets, and TheHive Flow never displays their values in responses or run details.

Of course, some particular use cases can’t be covered by native nodes only and need the flexibility of custom scripts. We provide Python and JavaScript nodes to let you transform data inside a workflow. Unlike a script running on someone’s server, each code step runs in its own isolated, disposable container.

By putting together a low-code editor and custom code, TheHive Flow lets you start simple and extend your workflows when needed, without hitting a ceiling.

Our team is working hard to bring further improvements to TheHive Flow: new triggers, sub-workflows, version control, human-in-the-loop approval and a library of ready-to-use workflows. And because we think that good incident response comes with strong collaboration, we are also planning to make this library available for any user to share their own workflows with TheHive’s community.

More AI capabilities are on the way too, and we’re excited to share more details soon.

TheHive Flow is available in TheHive 6, as part of our new all-in-one plan, TheHive ONE. Automation costs stay predictable: you only pay for your license, however many workflows you run.

To learn everything you need to use TheHive Flow, discover our new learning program inside the StrangeBee Academy. You can also read the dedicated section inside the documentation.