As you handle more and more cases in TheHive, you’ll start to notice workflows you may want to automate.
What if analyzers could run automatically the moment an observable is created, with reports ready before analysts even see the alert? Or what if you’d like your team to be notified about all new high- or critical-severity cases via Microsoft Teams or Slack?
You guessed it: Notifications can give you quick, powerful automations that save time and keep everyone in the loop.
The principle behind Notifications is simple: you define a trigger for events that occur in TheHive, then choose one or more notifiers to run in response.
You can take advantage of the built-in notifiers, such as your favorite messaging apps or the Cortex connector (to trigger analyzers and responders). If one of your applications isn’t available in the list, you can still use the HTTP Request notifier to reach any third-party API, opening the door to integrations in every direction!
By using variables, you can pull any information from your TheHive objects (case, alert, observable, etc.) and include it in the notification, making it easy to craft custom, effective messages.
With the Notifications feature, TheHive empowers your incident response team with a workflow creator that anyone can use, helping simplify analysts’ day-to-day work and make a real difference when time matters most.
Have a third-party application that sends webhook notifications and want to connect it to TheHive without the hassle of developing, maintaining and hosting a custom “glue-code” script? Then the Functions feature is exactly what you’re looking for!
Functions let you integrate external applications directly into TheHive’s processing.
Security teams usually rely on feeders to integrate data from external applications into their case management platform (i.e., TheHive).
A feeder is essentially a script that runs periodically, needs to be hosted somewhere and must be maintained over time, which can quickly become cumbersome. Feeders typically work in three steps:
Let’s see how Functions can free you from these old-fashioned workflows.
The data source you want to connect to TheHive probably uses its own object format, which often doesn’t match TheHive’s objects.
Let’s take an example with an Elastic alert:
Instead of using TheHive’s traditional API routes (which expect data in TheHive’s native format), Functions let you create your own custom API endpoint and map data from any source format (like Elastic) to what TheHive can process. It works just like a translator!
Within TheHive’s Functions, you can write JavaScript code that interprets the incoming payload and calls TheHive’s APIs directly.
To help you create and monitor your Function, TheHive provides several useful modes and options:
