New TheHive case Slack notification bot
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 45 nodes and runs on TheHive 5 events (case create) (plus 1 other trigger). Along the way it connects TheHive 5 and Slack. It also calls slack.com over HTTP.
How it runs
Trigger: On TheHive 5 events (case create) (plus 1 other trigger).
- Formatting Dictionaries (Edit Fields (Set)): sets 2 fields: dictionary, theHiveUrl
- Edit Fields (Edit Fields (Set)): sets 3 fields: response, dictionary, theHiveUrl
- HTTP Request: calls slack.com
- Parse Message Type (Switch): routes items into 9 branches
- Prep Fields For Slack (Edit Fields (Set)): sets 16 fields: title, datecreated, number…
- Respond to Slack with 200 response (Respond to Webhook): sends the response back to the webhook caller
- Acknowledge Close Case to Slack (Respond to Webhook): sends the response back to the webhook caller
- Acknowledge Severity Update to Slack (Respond to Webhook): sends the response back to the webhook caller
- Acknowledge Modal Request to Slack (Respond to Webhook): sends the response back to the webhook caller
- Check if Case Options (If): checks a condition and branches into true / false
…plus 32 more steps. See the full node list below.
Services it uses
HTTP calls to: slack.com
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Rarely used nodes in this template: n8n-nodes-base.theHiveProjectTrigger
Nodes used (10)
- TheHive 5 Trigger
n8n-nodes-base.theHiveProjectTrigger - Edit Fields (Set)
n8n-nodes-base.set - HTTP Request
n8n-nodes-base.httpRequest - If
n8n-nodes-base.if - TheHive 5
n8n-nodes-base.theHiveProject - No Operation, do nothing
n8n-nodes-base.noOp - Slack
n8n-nodes-base.slack - Respond to Webhook
n8n-nodes-base.respondToWebhook - Switch
n8n-nodes-base.switch - Webhook
n8n-nodes-base.webhook
From the author
Streamline Case Management in TheHive via Slack! Our TheHive Slack Integration empowers SOC analysts by allowing them to efficiently manage and update case attributes directly within Slack, reducing the need to switch contexts and enhancing response time. Key…