{
  "id": 3,
  "name": "TheHive",
  "nodes": [
    {
      "name": "TheHive Create Alert",
      "type": "n8n-nodes-base.theHive",
      "position": [
        500,
        360
      ],
      "parameters": {
        "date": "2022-04-25T08:53:18.000Z",
        "tags": "tlp:pwhite",
        "type": "misp",
        "title": "TheHive Alert",
        "source": "1311",
        "sourceRef": "1330",
        "description": "Security issue detected on server A2. Please check and take care.",
        "additionalFields": {}
      },
      "credentials": {
        "theHiveApi": {
          "id": "{{ $credentials.theHiveApi.id }}",
          "name": "The Hive account"
        }
      },
      "typeVersion": 1,
      "id": "node-bcf16cbb"
    },
    {
      "name": "TheHive Read Alerts",
      "type": "n8n-nodes-base.theHive",
      "position": [
        500,
        200
      ],
      "parameters": {
        "filters": {},
        "options": {},
        "operation": "getAll"
      },
      "credentials": {
        "theHiveApi": {
          "id": "{{ $credentials.theHiveApi.id }}",
          "name": "The Hive account"
        }
      },
      "typeVersion": 1,
      "id": "node-fafa62ee"
    },
    {
      "name": "IF",
      "type": "n8n-nodes-base.if",
      "position": [
        280,
        540
      ],
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"object\"][\"stage\"]}}",
              "value2": "=Closed",
              "operation": "notEqual"
            }
          ]
        }
      },
      "typeVersion": 1,
      "id": "node-a3945ed4"
    },
    {
      "name": "SIGNL4 Send Alert",
      "type": "n8n-nodes-base.signl4",
      "position": [
        500,
        520
      ],
      "parameters": {
        "message": "={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"details\"][\"description\"]}}",
        "additionalFields": {
          "title": "={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"details\"][\"title\"]}}",
          "externalId": "={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"objectId\"]}}"
        }
      },
      "credentials": {
        "signl4Api": {
          "id": "{{ $credentials.signl4Api.id }}",
          "name": "SIGNL4 Webhook account"
        }
      },
      "typeVersion": 1,
      "id": "node-0f890388"
    },
    {
      "name": "TheHive Webhook Request",
      "type": "n8n-nodes-base.webhook",
      "position": [
        80,
        540
      ],
      "webhookId": "22c76955-3f52-469e-a8ae-3f62e8e87ebe",
      "parameters": {
        "path": "22c76955-3f52-469e-a8ae-3f62e8e87ebe",
        "options": {},
        "httpMethod": "POST"
      },
      "typeVersion": 1,
      "id": "node-31d7c076"
    },
    {
      "name": "Start (Testing)",
      "type": "n8n-nodes-base.manualTrigger",
      "position": [
        80,
        200
      ],
      "parameters": {},
      "typeVersion": 1,
      "id": "node-a4f54168"
    },
    {
      "name": "SIGNL4 Resolve Alert",
      "type": "n8n-nodes-base.signl4",
      "position": [
        500,
        720
      ],
      "parameters": {
        "operation": "resolve",
        "externalId": "={{$node[\"TheHive Webhook Request\"].json[\"body\"][\"objectId\"]}}"
      },
      "credentials": {
        "signl4Api": {
          "id": "{{ $credentials.signl4Api.id }}",
          "name": "SIGNL4 Webhook account"
        }
      },
      "typeVersion": 1,
      "id": "node-7da9e42a"
    },
    {
      "id": "error-e3f742b1",
      "name": "Error Handler",
      "type": "n8n-nodes-base.stopAndError",
      "typeVersion": 1,
      "position": [
        1000,
        400
      ],
      "parameters": {
        "message": "Workflow execution error",
        "options": {}
      }
    }
  ],
  "active": false,
  "settings": {
    "executionOrder": "v1",
    "saveManualExecutions": true,
    "callerPolicy": "workflowsFromSameOwner",
    "errorWorkflow": null,
    "timezone": "UTC",
    "executionTimeout": 3600,
    "maxExecutions": 1000,
    "retryOnFail": true,
    "retryCount": 3
  },
  "connections": {},
  "meta": {
    "instanceId": "workflow-f6a0ef04",
    "versionId": "1.0.0",
    "createdAt": "2025-09-29T07:08:00.949767",
    "updatedAt": "2025-09-29T07:08:00.949781",
    "owner": "n8n-user",
    "license": "MIT",
    "category": "automation",
    "status": "active",
    "priority": "high",
    "environment": "production"
  },
  "tags": [
    "automation",
    "n8n",
    "production-ready",
    "excellent",
    "optimized"
  ],
  "description": "Production-ready workflow: TheHive. This workflow has been optimized for production use with comprehensive error handling, security, and documentation."
}