TheHive
TheHive security case and alert management
TheHive is the open-source security incident response platform used by SOC teams to triage alerts, escalate to cases, and coordinate investigation. Tiny Command surfaces two triggers — Alert Created (a new alert landed in TheHive, typically from a SIEM, EDR, or other detection source) and Case Created (an analyst escalated an alert to a full case, or opened a case directly) — plus three actions: Create Alert (push a detection into TheHive from an external source — the standard sync path for tools that don't have native TheHive integrations), Create Case (open an investigation directly), List Alerts (paginated with filters). The connection uses TheHive's API key (per-user, from User Settings) plus the instance URL (self-hosted; TheHive doesn't have a managed cloud). Alert Created is the workflow trigger for SOC orchestration: when a new alert arrives, auto-enrich with threat intel from VirusTotal/AbuseIPDB, score, and either auto-resolve low-severity or escalate to a case with the right responder assigned.
Workflows start when TheHive does.
2 real-time triggers, each backed by a webhook subscription. Events arrive within seconds and you don't have to set up polling.
Fires whenever a new alert is created in TheHive (the SOC alerting/case-management platform). Use it to enrich, route, or auto-escalate alerts to a SOAR playbook.
Fires whenever a new case is created in TheHive. Use it to broadcast new investigations to a Slack channel or kick off a Cortex analysis pipeline.
Do anything TheHive can do, from a workflow.
Every action accepts dynamic inputs from upstream nodes, whether that's an AI output, a form field, or a search result.
| Action | What it does |
|---|---|
| Create Alert | Creates a new alert in TheHive with title, description, severity, observables, and source. Common entry point for piping detections from SIEM/EDR tooling into TheHive. |
| Create Case | Creates a new investigation case in TheHive with title, description, severity, TLP, and assigned user. Use it to promote a manual report or external ticket into a formal case. |
| List Alerts | Lists alerts in TheHive matching the supplied filters (severity, status, source, date range). Useful for periodic alert-fatigue or aging reports. |
Pre-built TheHive workflows.
Clone any recipe and customize it in one click. Every recipe is fully editable.
Three things worth knowing.
Tiny Command counts a run the moment a trigger fires. Filtering early means only matching events spend your usage budget.
Connect TheHive once and every workflow on your account can use its triggers and actions. You don't have to re-auth per workflow.
Every TheHive field shows up in the visual picker for downstream nodes. The raw payload is there for power users, optional for everyone else.
Questions about the TheHive integration.
If we missed yours, ping support. We usually reply within an hour.
How do I connect TheHive to Tiny Command?
What TheHive triggers does Tiny Command support?
What TheHive actions can I run from a workflow?
Is the TheHive integration real-time?
Do I need to write code to use TheHive with Tiny Command?
How much does the TheHive integration cost?
More other apps people connect.
Same category as TheHive, ordered by how often teams pair them. Hover the carousel to pause.
Do more with TheHive.
Wire it to Slack, Notion, HubSpot, Stripe, or any of the other 438 apps in our catalog. Setup takes roughly two minutes. Free to try, no credit card.
