TheHive 5 × AmbactiBring TheHive 5 into
the flow of work.
A little less busywork with TheHive 5.
Gather contextDo the workReview & share
Alert9 capabilities+
- Create an alert
- Delete an alert
- Execute responder on an alert
- Get an alert
- Merge an alert into a case
- Promote an alert to a case
- Search alerts
- Update an alert
- Update an alert status
Case10 capabilities+
- Add attachment to a case
- Create a case
- Delete attachment from a case
- Delete an case
- Execute responder on a case
- Get a case
- Get attachment from a case
- Get timeline of a case
- Search cases
- Update a case
Comment4 capabilities+
- Create a comment in a case or alert
- Delete a comment
- Search comments
- Update a comment
Task Log7 capabilities+
- Add attachment to a task log
- Create a task log
- Delete task log
- Delete attachment from a task log
- Execute responder on a task log
- Get a task log
- Search task logs
Observable7 capabilities+
- Create an observable
- Delete an observable
- Execute analyzer on an observable
- Execute responder on an observable
- Get an observable
- Search observables
- Update an observable
Page4 capabilities+
- Create a page
- Delete a page
- Search pages
- Update a page
Query1 capabilities+
- Execute a query
Task6 capabilities+
- Create a task
- Delete an task
- Execute responder on a task
- Get a task
- Search tasks
- Update a task
Update events21 capabilities+
- *Event
- Alert CreatedEvent
- Alert DeletedEvent
- Alert UpdatedEvent
- Case CreatedEvent
- Case DeletedEvent
- Case UpdatedEvent
- Comment CreatedEvent
- Comment DeletedEvent
- Comment UpdatedEvent
- Observable CreatedEvent
- Observable DeletedEvent
- Observable UpdatedEvent
- Page CreatedEvent
- Page DeletedEvent
- Page UpdatedEvent
- Task CreatedEvent
- Task Log CreatedEvent
- Task Log DeletedEvent
- Task Log UpdatedEvent
- Task UpdatedEvent
Frequently asked
questions.
What could an Ambacti integration do with TheHive 5?
The documented operations include Alert: Create an alert; Alert: Delete an alert; Alert: Execute responder on an alert; Alert: Get an alert.
Could I keep a workflow read-only?
For a read-only workflow, limit account permissions to reading data and exclude actions that create, update, or delete records.
Will every action run automatically?
Choose which steps could run on their own and which should pause for review. Changes should follow the permissions and approval rules you set.
Do I need to review actions in TheHive 5?
Decide which work could run on its own and which steps need your review.