TheHive to SIGNL4 Alert Integration

Name: TheHive to SIGNL4 Alert Integration
Rating: 2.0 (1 reviews)
Author: Free N8N

Beginner

0 nodes connected

detail.loadingPreview

Free N8N Temples

15 views

0 downloads

Security Automationalertingincident responsesignl4thehivewebhook

This workflow integrates TheHive with SIGNL4 to automate alert management and notification.

🚀Ready to Deploy This Workflow?

⚡Deploy on Zeabur 🎁Get $200 Credit on DigitalOcean

About This Workflow

Overview

This workflow leverages n8n to connect TheHive, a threat intelligence platform, with SIGNL4, an alert notification service. It listens for incoming alerts from TheHive via a webhook and then creates or resolves alerts in SIGNL4 based on the alert stage.

Key Features

Receives real-time alerts from TheHive via a webhook.
Conditionally sends alerts to SIGNL4 based on the alert stage (e.g., not 'Closed').
Creates new alerts in SIGNL4 with relevant details like title and description.
Resolves alerts in SIGNL4 when the corresponding TheHive alert is marked as closed.
Includes robust error handling to manage workflow failures.

How To Use

Set up TheHive Webhook: Configure a webhook in TheHive to send alerts to the n8n webhook endpoint.
Configure SIGNL4 Credentials: Add your SIGNL4 API credentials to n8n.
Set up n8n Webhook Node: In n8n, create a new workflow. Add a 'Webhook' node and configure it with the same path as your TheHive webhook.
Add Logic: Connect the 'Webhook' node to an 'IF' node to check the alert stage. Subsequently, connect to 'SIGNL4 Send Alert' for active alerts and 'SIGNL4 Resolve Alert' for closed alerts.
Configure TheHive Nodes (Optional): You can optionally include TheHive nodes to fetch or create alerts, though this specific workflow is primarily driven by the webhook.
Configure Error Handling: Ensure the 'Stop and Error' node is connected to handle any workflow execution issues.

Apps Used

alerting

incident response

signl4

thehive

webhook

Workflow JSON

{
  "id": "b9e70f3a-595d-4db6-b731-08927df940e5",
  "name": "TheHive to SIGNL4 Alert Integration",
  "nodes": 0,
  "category": "Security Automation",
  "status": "active",
  "version": "1.0.0"
}

Note: This is a sample preview. The full workflow JSON contains node configurations, credentials placeholders, and execution logic.