Integration

TheHive integration

TheHive 5 incident response platform API for security case management: create and update cases, raise and triage alerts, promote an alert into a case or merge it into an existing one, attach observables and mark them as indicators of compromise, drive investigation tasks and their logs, and run structured searches through the query API. TheHive is self hosted, so the instance host is part of the credential alongside the API key.

Connect TheHive How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in TheHive.Built from the 18 TheHive tools below, on the connection you add once.

Common TheHive use cases

listing open cases assigned to an analyst
removing a case created in error by an automation
removing alerts created by a misconfigured feeder
escalating a confirmed alert into a full investigation
expanding a case into the steps of a response playbook
posting the result of an automated check onto the case
turning a detection from a SIEM into a triageable alert
attaching extracted indicators to an alert before triage
attaching follow-up alerts to the incident they belong to
checking whether a case is still open before adding to it

What you can do with TheHive

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Alert, 6 operations

create_alertCreate alertPOSTRaises a TheHive alert from an external detection, with its observables attached.
delete_alertDelete alertDELETEPermanently deletes an alert and its observables.
get_alertGet alertGETReturns a single TheHive alert with its status, severity and source reference.
merge_alert_into_caseMerge alert into casePOSTFolds an alert and its observables into a case that already exists.
promote_alert_to_casePromote alert to casePOSTTurns an alert into a new investigation case, carrying its observables across.
update_alertUpdate alertPATCHChanges the status, severity, assignee or tags of an alert.

Case, 4 operations

create_caseCreate casePOSTOpens a new investigation case in TheHive.
delete_caseDelete caseDELETEPermanently deletes a case with its tasks, observables and comments.
get_caseGet caseGETReturns a single TheHive case with its status, severity and metadata.
update_caseUpdate casePATCHChanges the status, severity, assignee, tags or summary of a case.

Observable, 4 operations

create_alert_observableCreate alert observablePOSTAttaches observables to an alert so they travel with it when it becomes a case.
create_case_observableCreate case observablePOSTAttaches observables such as addresses, domains or hashes to an investigation case.
get_observableGet observableGETReturns a single observable with its type, value and indicator flags.
update_observableUpdate observablePATCHChanges the indicator flag, sighting, tags or note of an observable.

Comment, 1 operation

create_case_commentCreate case commentPOSTPosts a comment on an investigation case.

Log, 1 operation

create_task_logCreate task logPOSTRecords a timestamped note of what was done on an investigation task.

Query, 1 operation

run_queryRun queryPOSTLists and filters cases, alerts, observables, tasks and logs through TheHive's structured query language.

Task, 1 operation

create_taskCreate taskPOSTCreates an investigation task on a case and optionally assigns it.

Use TheHive from Claude Code, Cursor or Codex

Connect TheHive in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its TheHive operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect TheHive

Create your workspace
Sign up free. Nothing to install.
Connect TheHive once
Add your TheHive connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

TheHive integration FAQ

What can you do with the TheHive integration?

LiveContext exposes 18 operations on TheHive, covering alert, case, observable and comment. Common uses include listing open cases assigned to an analyst, removing a case created in error by an automation and removing alerts created by a misconfigured feeder.