Skip to Workflow Atlas
Playbook AtlasWorkflow Atlas
Workflow blueprintBrowse workflows
Event-Driven AutomationIntermediate

TheHive & Slack Incident Automation

TheHive & Slack Incident Automation is a 45-node automation blueprint connecting TheHive, Slack. Inspect its trigger, execution graph, branches, and implementation requirements.

TheHiveSlack

Interactive system map

Follow the runtime. Inspect what supports it.

Solid horizontal paths show main-channel execution. Violet dependencies sit beneath the exact step they configure or empower.

45

Nodes

48

Links

3

Run groups

Connected tools

2 integrations

  • TheHive
  • Slack

Canvas controls

Fit wide systems, then zoom into any run group.

TheHive & Slack Incident Automation execution lanes3 run groups containing 32 workflow nodes and 25 visible links. Solid horizontal lines are main-channel runtime links. Violet dashed lines connect typed dependencies beneath the runtime step they support. Focus any node to inspect its immediate path.TheHive Trigger. trigger node, theHiveProjectTrigger. 0 incoming and 1 outgoing connections.STARTTheHive TriggerTRIGGERTHEHIVEPROJECTTRIGGER0 IN / 1 OUTFormatting Dictionaries. transform node, set. 1 incoming and 1 outgoing connections.STEP 02Formatting DictionariesTRANSFORMSET1 IN / 1 OUTHTTP Request. integration node, httpRequest. 1 incoming and 1 outgoing connections.STEP 03HTTP RequestINTEGRATIONHTTPREQUEST1 IN / 1 OUTPrep Fields For Slack. Slack node, set. 1 incoming and 1 outgoing connections.STEP 04Prep Fields For SlackSLACKSET1 IN / 1 OUTPost New Case To Slack. Slack node, slack. 1 incoming and 0 outgoing connections.OUTCOMEPost New Case To SlackSLACKSLACK1 IN / 0 OUTPrep Fields For Slack - Assign. Slack node, set. 0 incoming and 0 outgoing connections.CORE RUNTIMEPrep Fields For Slack - A…SLACKSET0 IN / 0 OUTEdit Fields. transform node, set. 0 incoming and 0 outgoing connections.CORE RUNTIMEEdit FieldsTRANSFORMSET0 IN / 0 OUTTask Modal. integration node, httpRequest. 0 incoming and 0 outgoing connections.CORE RUNTIMETask ModalINTEGRATIONHTTPREQUEST0 IN / 0 OUTCheck if Case Options. decision node, if. 0 incoming and 0 outgoing connections.CORE RUNTIMECheck if Case OptionsDECISIONIF0 IN / 0 OUTNo Action Needed. integration node, noOp. 0 incoming and 0 outgoing connections.CORE RUNTIMENo Action NeededINTEGRATIONNOOP0 IN / 0 OUTCase Slack Block Rebuild. Slack node, set. 0 incoming and 1 outgoing connections.STARTCase Slack Block RebuildSLACKSET0 IN / 1 OUTAcknowledge Close Case to Slack. Slack node, respondToWebhook. 0 incoming and 1 outgoing connections.STARTAcknowledge Close Case to…SLACKRESPONDTOWEBHOOK0 IN / 1 OUTAcknowledge Severity Update to Slack. Slack node, respondToWebhook. 0 incoming and 1 outgoing connections.STARTAcknowledge Severity Upda…SLACKRESPONDTOWEBHOOK0 IN / 1 OUTAcknowledge PAP Update to Slack. Slack node, respondToWebhook. 0 incoming and 1 outgoing connections.STARTAcknowledge PAP Update to…SLACKRESPONDTOWEBHOOK0 IN / 1 OUTPrep Fields For TLP Slack. Slack node, set. 0 incoming and 1 outgoing connections.STARTPrep Fields For TLP SlackSLACKSET0 IN / 1 OUTPrep Fields For Status Slack. Slack node, set. 0 incoming and 1 outgoing connections.STARTPrep Fields For Status Sl…SLACKSET0 IN / 1 OUTPrep Fields For Slack - Close. Slack node, set. 1 incoming and 1 outgoing connections.STEP 02Prep Fields For Slack - C…SLACKSET1 IN / 1 OUTPrep Fields For Slack - Severity. Slack node, set. 1 incoming and 1 outgoing connections.STEP 02Prep Fields For Slack - S…SLACKSET1 IN / 1 OUTPrep Fields For PAP Slack. Slack node, set. 1 incoming and 1 outgoing connections.STEP 02Prep Fields For PAP SlackSLACKSET1 IN / 1 OUTUpdate Case TLP. integration node, theHiveProject. 1 incoming and 1 outgoing connections.STEP 02Update Case TLPINTEGRATIONTHEHIVEPROJECT1 IN / 1 OUTUpdate Status in TheHive. integration node, theHiveProject. 1 incoming and 1 outgoing connections.STEP 02Update Status in TheHiveINTEGRATIONTHEHIVEPROJECT1 IN / 1 OUTClose Case as False Positive. integration node, theHiveProject. 1 incoming and 1 outgoing connections.STEP 03Close Case as False Posit…INTEGRATIONTHEHIVEPROJECT1 IN / 1 OUTUpdate Case Severity. integration node, theHiveProject. 1 incoming and 1 outgoing connections.STEP 03Update Case SeverityINTEGRATIONTHEHIVEPROJECT1 IN / 1 OUTUpdate Case PAP. integration node, theHiveProject. 1 incoming and 1 outgoing connections.STEP 03Update Case PAPINTEGRATIONTHEHIVEPROJECT1 IN / 1 OUTTLP Case Block Rebuild. transform node, set. 1 incoming and 1 outgoing connections.STEP 03TLP Case Block RebuildTRANSFORMSET1 IN / 1 OUTStatus Case Block Rebuild. transform node, set. 1 incoming and 1 outgoing connections.STEP 03Status Case Block RebuildTRANSFORMSET1 IN / 1 OUTClose Case Block Rebuild. transform node, set. 1 incoming and 1 outgoing connections.STEP 04Close Case Block RebuildTRANSFORMSET1 IN / 1 OUTSeverity Case Block Rebuild1. transform node, set. 1 incoming and 1 outgoing connections.STEP 04Severity Case Block Rebui…TRANSFORMSET1 IN / 1 OUTPAP Case Block Rebuild. transform node, set. 1 incoming and 1 outgoing connections.STEP 04PAP Case Block RebuildTRANSFORMSET1 IN / 1 OUTMap Actions. transform node, set. 6 incoming and 1 outgoing connections.STEP 05Map ActionsTRANSFORMSET6 IN / 1 OUTBuild Final Block. transform node, set. 1 incoming and 1 outgoing connections.STEP 06Build Final BlockTRANSFORMSET1 IN / 1 OUTUpdate Message with new Assignee. integration node, httpRequest. 1 incoming and 0 outgoing connections.OUTCOMEUpdate Message with new A…INTEGRATIONHTTPREQUEST1 IN / 0 OUT

Signal inspector

Focus, hover, or select a step to isolate its runtime and support links.

Main-channel runtimeTyped dependencytriggeraidecisiontransformintegration
Scroll horizontally to follow every connected flow.Showing 32 of 45 connected nodesEnter or click to lock · Escape to clear

Runtime breakdown

Read the execution spine before its dependencies.

Each run group separates main-channel steps from the models, tools, retrievers, and data services that support them. Start and outcome labels apply only to runtime nodes.

01

Run Group

TheHive Trigger

4 Execution Links

  1. Start

    TheHive Trigger

    Trigger

  2. Step 2

    Formatting Dictionaries

    Transform

  3. Step 3

    HTTP Request

    Integration

  4. Step 4

    Prep Fields For Slack

    Transform

  5. Outcome

    Post New Case To Slack

    Integration

02

Run Group

Standalone nodes

0 Execution Links

  1. Core Runtime

    Prep Fields For Slack - Assign

    Transform

    Edit Fields

    Transform

    Task Modal

    Integration

    Check if Case Options

    Decision

    No Action Needed

    Integration

03

Run Group

Acknowledge Close Case to Slack

21 Execution Links

  1. Start

    Case Slack Block Rebuild

    Transform

    Acknowledge Close Case to Slack

    Trigger

    Acknowledge Severity Update to Slack

    Trigger

    Acknowledge PAP Update to Slack

    Trigger

    Prep Fields For TLP Slack

    Transform

    Prep Fields For Status Slack

    Transform

  2. Step 2

    Prep Fields For Slack - Close

    Transform

    Prep Fields For Slack - Severity

    Transform

    Prep Fields For PAP Slack

    Transform

    Update Case TLP

    Integration

    Update Status in TheHive

    Integration

  3. Step 3

    Close Case as False Positive

    Integration

    Update Case Severity

    Integration

    Update Case PAP

    Integration

    TLP Case Block Rebuild

    Transform

    Status Case Block Rebuild

    Transform

  4. Step 4

    Close Case Block Rebuild

    Transform

    Severity Case Block Rebuild1

    Transform

    PAP Case Block Rebuild

    Transform

  5. Step 5

    Map Actions

    Transform

  6. Step 6

    Build Final Block

    Transform

  7. Outcome

    Update Message with new Assignee

    Integration

Turn the map into a plan

Adapt this blueprint to your company.

Bring the system shape into a workspace, then define the production controls, data boundaries, owners, and delivery sequence around your context.

Create a build planReturn to the atlas