TriggerTheHiveReal-timeUpdated May 2026
How do I trigger when a TheHive case is opened?
Short answer: Drop the "TheHive → Case Created" trigger on your workflow canvas, add filters if you want them, and publish. It fires within seconds of the event in TheHive, not on a polling schedule.
Anatomy
What this trigger looks like in a workflow.
Drop it on the canvas. Configure a couple of fields. Publish.
In the builder
Trigger
Case Created
When the matching event happens
on case createdwatch for case createdcase addedwhen a new case is created in thehivenew case creatednew casewhen case created
What this trigger returns
for the curiousYou don’t need to read this. Tiny Command auto-maps every field into the visual picker so downstream nodes can pull values by clicking. We show it here for power users who want to know what’s on the wire.
{"title": "Investigation: Suspicious Login","case_id": "case_123","severity": 2}
Output shape
Fields available to downstream nodes.
Every field below can be referenced by name in any action or filter that comes after this trigger.
| Field | Type | Example |
|---|---|---|
| title | string | "Investigation: Suspicious Login" |
| case_id | string | "case_123" |
| severity | number | 2 |
Pairs with
Drop these actions after Case Created.
FAQ
Questions about Case Created.
How does the Case Created trigger work in TheHive?
Fires whenever a new case is created in TheHive. Use it to broadcast new investigations to a Slack channel or kick off a Cortex analysis pipeline.
Is the Case Created trigger real-time?
Yes. Case Created uses webhooks or push subscriptions, not polling. Your workflow fires within seconds of the event happening in TheHive.
What data does Case Created return?
The full event payload from TheHive. The output shape table on this page lists every field, its type, and an example value so you can map fields into downstream nodes.
Can I filter Case Created so only some events start a workflow?
Yes. Add a Filter node right after the trigger and match on any field, whether that's subject, sender, status, or anything else in the payload. Workflows only continue when the filter passes.
Do I need TheHive admin permissions to use Case Created?
For most TheHive accounts a standard user can authorize the trigger. Some TheHive plans require an admin to enable third-party webhooks. Check TheHive's docs if the trigger fails to register.
More triggers
Other TheHive triggers.
Build a workflow on this trigger.
One trigger. 3+ downstream actions. Zero glue.
