TriggerTheHiveReal-timeUpdated June 2026

How do I trigger when a TheHive case is opened?

Short answer: Drop the "TheHive → Case Created" trigger on your workflow canvas, add filters if you want them, and publish. It fires within seconds of the event in TheHive, not on a polling schedule.

Use this trigger All 2 TheHive triggers

Anatomy

What this trigger looks like in a workflow.

Drop it on the canvas. Configure a couple of fields. Publish.

In the builder

Trigger

Case Created

When the matching event happens

on case createdwatch for case createdcase addedwhen a new case is created in thehivenew case creatednew casewhen case created

What this trigger returns

for the curious

You don’t need to read this. Tiny Command auto-maps every field into the visual picker so downstream nodes can pull values by clicking. We show it here for power users who want to know what’s on the wire.

{
  "title": "Investigation: Suspicious Login",
  "case_id": "case_123",
  "severity": 2
}

Output shape

Fields available to downstream nodes.

Every field below can be referenced by name in any action or filter that comes after this trigger.

Field	Type	Example
title	string	"Investigation: Suspicious Login"
case_id	string	"case_123"
severity	number	2

Pairs with

Drop these actions after Case Created.

Add Labels to Message

Gmail · Email

Add Reaction

Slack · Communication

Add Sheet Tab

Google Sheets · Spreadsheets & Databases

Create Company

HubSpot · CRM & Sales

FAQ

Questions about Case Created.

How does the Case Created trigger work in TheHive?

Fires whenever a new case is created in TheHive. Use it to broadcast new investigations to a Slack channel or kick off a Cortex analysis pipeline.

Is the Case Created trigger real-time?

Yes. Case Created uses webhooks or push subscriptions, not polling. Your workflow fires within seconds of the event happening in TheHive.

What data does Case Created return?

The full event payload from TheHive. The output shape table on this page lists every field, its type, and an example value so you can map fields into downstream nodes.

Can I filter Case Created so only some events start a workflow?

Yes. Add a Filter node right after the trigger and match on any field, whether that's subject, sender, status, or anything else in the payload. Workflows only continue when the filter passes.

Do I need TheHive admin permissions to use Case Created?

For most TheHive accounts a standard user can authorize the trigger. Some TheHive plans require an admin to enable third-party webhooks. Check TheHive's docs if the trigger fails to register.