ActionTheHiveUpdated June 2026

How do I open a TheHive case from a workflow?

Short answer: You can create case in TheHive by hand from its own interface, but it won’t repeat itself. On TinyCommand, add the TheHive Create Case action to a workflow, map its 3 inputs from any upstream app, and it runs automatically every time the trigger fires. No code, and a free tier to start.

Create Case in TheHive — start free All 3 TheHive actions

Create Case in TheHive — start free

Inputs

The fields this action accepts.

Every field can be mapped from an upstream trigger, AI step, table row, or hard-coded literal.

Field	Type	Required	Description
Title title	string	Required	Title
Description description	string	Required	Description
Severity severity	options	Optional	Severity. Options: Low, Medium, High, Critical

Sample request

{
  "title": "{{trigger.title}}",
  "description": "{{trigger.description}}",
  "severity": "{{trigger.severity}}"
}

Returns

{
  "id": "case_789",
  "title": "Investigation",
  "severity": 2
}

Use these fields in downstream nodes for routing, logging, or error handling.

FAQ

Questions about Create Case.

What does the Create Case action do in TheHive?

Creates a new investigation case in TheHive with title, description, severity, TLP, and assigned user. Use it to promote a manual report or external ticket into a formal case.

What inputs does Create Case require?

Required: Title, Description. Every input accepts a static value or a variable from any upstream node in your workflow.

Can I use dynamic inputs from earlier workflow nodes?

Yes. Any field on this action can pull values from upstream nodes, whether that's a form response, a trigger payload, an AI output, or a lookup result.

What happens if TheHive returns an error?

The workflow pauses on the failed node, the error message is captured in the run log, and you can retry the run with one click. Auto-retry policies are configurable per workflow with exponential backoff up to 5 attempts.

Does Create Case support batch operations?

Yes. Run Create Case inside a Loop node to process arrays. TinyCommand handles TheHive's rate limits automatically so you don't have to throttle manually.

How do I open a TheHive case from a workflow?

The fields this action accepts.

Apps that pair well as the trigger for Create Case.

Questions about Create Case.

Other TheHive actions.