TheHive 5 and Cortex integration

Make sure you have n8n installed and running:

• Install n8n on any platform using npm or Docker;
• Or let n8n host it for you on its cloud infrastructure.

In n8n, click the "Add workflow" button in the Workflows tab to create a new workflow.

Add the starting point – a trigger on when your workflow should run: on schedule, on a webhook call, when called by another workflow, or manually. In some situations, either TheHive 5 or Cortex could already be your first step. To set this up, click "On App Event", search for either TheHive 5 or Cortex, and choose a trigger to kick off your workflow.

Drag the TheHive 5 node from the nodes panel on the left to the workflow canvas. Before dragging, choose the action TheHive 5 will perform.

Click on the TheHive 5 node, then click on the "Select credential" dropdown option next to the “Credential to connect with” field. Follow the authentication process to grant n8n access to your TheHive 5. You can also share credentials you've created, and store sensitive credential information in an external vault using n8n's external secrets feature.

Drag the Cortex node from the nodes panel to the canvas. Before dragging, choose the action Cortex will perform.

Click on the Cortex node, then click on the "Select credential" dropdown option next to the “Credential to connect with” field. Follow the authentication process to grant n8n access to your Cortex.

Click on each node to configure its settings. You see the input data on the left. Manipulate the data in the middle by specifying parameters: resources, operations, etc. See the output on the right.

Connect the output of the TheHive 5 node to the input of the Cortex node or swop nodes to route the integration the other way around.

Use n8n's core nodes to transform data the way you need and extend the integration:

• Splitting: IF and Switch
• Merging: Merge, Compare Datasets
• Looping: IF and Loop Over Items
• Waiting: Wait
• Creating sub-workflows: Execute Workflow and Execute Workflow Trigger
• Error handling: Stop And Error and Error Trigger
• Code: write custom JavaScript or Python and run it as a step in your workflow.

Once you've configured TheHive 5, Cortex and/or additional nodes make sure to save your workflow and activate it. Activating a workflow means that it will run automatically every time a trigger node receives input or meets a condition. By default, all newly created workflows are deactivated.

Run the workflow to see if TheHive 5 and Cortex integration is working as expected. Based on your configuration, data should flow from TheHive 5 to Cortex or vice versa. Easily debug your workflow: you can check past executions to isolate the mistake and fix it.