Events Webhook Trigger

The first node receives all messages from Slack API via Subscription Events API. You can find more information about setting up the subscription events API by clicking here. The second node extracts the payload from slack into an object that n8n can understand.

TheHive Trigger

To setup TheHive 5's triggers, visit the Settings in TheHive and add a webhook using the url found TheHive node.

Post TheHive Case to Slack

The Case data is then mapped to Slack Block Kit and pushed to Slack. In Slack, it lives as a database object, mapping the Case Id to the block kit values themselves, so they can be updated in TheHive.

Assign Case to Others

Since slack does not send the slack user email, we must take the extra step of passing the user ID back to slack, and getting back the email address of the person selecting the buttons. For this to work correctly, TheHive users emails and Slack user emails must be the same.

Streamlined Case Updates via Slack for SOC Analysts

This workflow segment is crucial for enhancing the responsiveness and efficiency of SOC operations by allowing analysts to update TheHive case attributes directly from Slack. By using form inputs and buttons embedded within Slack messages, analysts can quickly modify case details without switching to TheHive. This integration significantly speeds up case handling and improves the management of security incidents.

Key Operations:

• Dynamic Slack Blocks: Utilizes custom-built Slack block elements to present actionable items directly within the communication platform.
• Immediate Actions: Enables actions like closing a case as a false positive, updating case severity, TLP (Traffic Light Protocol), PAP (Permissible Action Protocol), and more with simple clicks.
• Automated Updates: Upon interaction, the workflow automatically updates the respective fields in TheHive, ensuring that all case information is current and accurately reflected.
• Feedback Loop: After updating, a confirmation is sent back to Slack, confirming the action taken, which helps in maintaining clear communication and audit trails.

Benefits for SOC Analysts:

• Efficiency: Reduces the time spent switching between tools and streamlines the case update process.
• Accuracy: Minimizes human error by automating data entry from Slack to TheHive.
• Visibility: Keeps the entire team informed about case status updates in real-time, enhancing collaborative efforts.

Setup Note:

• Ensure that your TheHive and Slack integration permissions are configured to allow updates and that users are familiar with the operational workflow.
• The last set of "Set" nodes on the far right of the workflow are designed to split the Slack block kit action into two parts. This split facilitates easier customization of the action options at the bottom of the Slack message. While customization is possible, a good understanding of JSON is desirable to modify these settings effectively.

This integration not only speeds up response times but also leverages the collaborative environment of Slack to keep the SOC team agile and well-informed.

Add a task to a Case - Process the task details

Once the modal window is submitted, this sections then processes the data sent in. Certain fields send data back to the server so the no operation check simply ignores certain types of inputs in the modal until the whole modal is filled out.

Add a task to a Case - Display Modal Popup

This section of the workflow focuses on enhancing task management directly within Slack, allowing users to interactively add tasks to cases through a modal popup.

The workflow acknowledges the modal request using a specialized node that prepares the system for a dynamic interaction, then leverages an HTTP request node to open a modal in Slack via the https://slack.com/api/views.open API endpoint.

This modal is populated with various fields such as task title, description, due date, assignee, and options like marking the task as mandatory or flagged, which are meticulously structured in JSON format to facilitate user input.

Each element in the modal, from text inputs and date pickers to user-select dropdowns, is designed for ease of use, ensuring that task details are comprehensive and contextually relevant.

Assign Case to Others

Lastly the assignee data is passed into TheHive in the correct format. We then use the Set node to begin the process of building our updated Slack message.

Dynamic Slack Message Updates in Workflow

This section of the workflow focuses on dynamically updating Slack messages to reflect changes in TheHive case attributes directly from Slack. The process begins by mapping user actions to Slack interactive elements, which are then composed into a final message block. This updated block is sent back to Slack to modify the original message, ensuring all changes are visible in real-time.

Key Components:

• Map Actions Node: This node maps user actions from Slack, like changing assignees or case status, into JSON format. It sets the foundation for creating interactive message blocks that users can interact with.
• Build Final Block Node: Combines all interactive elements into a single JSON object, preparing it for posting back to Slack.
• Update Message with new Assignee Node: Utilizes an HTTP request to post the updated message blocks back to Slack using the chat.update API endpoint. This action modifies the original Slack message to display the new, interactive elements.

Workflow Efficiency:

• By automating the update of Slack messages, this process eliminates the need for manual updates and ensures that all stakeholders are viewing the most current case details directly within Slack.
• Isolating action elements in separate nodes allows for easier modifications and ensures that any changes in the workflow logic are consistently applied.

Setup Considerations:

• Ensure that the Slack API credentials are correctly configured to allow message updates.
• Familiarize yourself with JSON structure if you need to customize the interactive elements further, as modifications require a good understanding of JSON formatting.

This method not only enhances the interactivity of Slack communications but also ensures that updates are seamlessly integrated into the workflow, promoting efficiency and ensuring data consistency.

Add a task to a Case - Process the task details

The data is then processed in TheHive using the native n8n node.

n8n Switch Node

This node checks the messages from Slack and routes them down the appropriate route in the workflow.

It is an invaluable tool that simplifies our logic immensely.

New cases will appear in slack in this format with the ability to quickly change variables in TheHive with quick actions baked in.

🤝Responding to Slack when someone clicks a link

This section of the workflow ensures that when a user interacts with a Slack message that invokes an n8n webhook, the server promptly acknowledges this with a "200" or "204" HTTP status response. This sticky note underscores the importance of a quick and positive response to maintain seamless interactions and ensure Slack receives the necessary feedback to conclude the user's action successfully.

📧 GDPR Warning

This workflow requires additional permissions from your Slack app that may not be available in your region.

📧 Ensure the Slack users emails match those in TheHive

This assumes that your TheHive user's emails are the same as the same user's email in Slack. Please note that there is no error handling for case's assigned user, so if you assign someone that has an email in Slack that does not match the user in TheHive, it will fail.

Streamline Case Management in TheHive via Slack!

Our TheHive Slack Integration empowers SOC analysts by allowing them to efficiently manage and update case attributes directly within Slack, reducing the need to switch contexts and enhancing response time.

Key Features:

• Direct Case Management: Modify case details such as assignee, severity, status, and more through intuitive form inputs embedded within Slack messages.
• Seamless Integration: Assumes matching email addresses between TheHive and Slack users for straightforward assignee updates. Note: Ensure email consistency to avoid assignment errors.
• Instant Case Actions: Quickly close cases as false positives or adjust threat levels with minimal clicks, directly impacting case status in TheHive and reflecting updates immediately in Slack.
• Task Management: Add tasks to cases through a user-friendly modal popup, fostering better task tracking and delegation within your team.

Operational Benefits:

• Efficiency: Enables analysts to perform multiple case actions without leaving Slack, streamlining workflows and saving valuable time.
• Accuracy: Reduces the chances of human error by providing a controlled interface for case updates.
• Agility: Enhances the SOC team's agility by providing tools for rapid response and case management, crucial for effective security operations.

Setup Tips:

• Verify that all SOC team members have matching email IDs in TheHive and Slack.
• Familiarize your team with the Slack form inputs and ensure they understand the importance of accurate data entry.
• Regularly review and update the integration settings to accommodate any changes in your security operations protocols.

Need Help?

• For detailed setup instructions or troubleshooting, refer to our Integration Guide or reach out on our Support Forum.

Leverage this integration to maximize your SOC team's efficiency and responsiveness, ensuring that case management is as streamlined and effective as possible.

📧 GDPR Warning

This workflow requires additional permissions from your Slack app that may not be available in your region or organization.

Events Webhook Trigger

Purpose and structure

This folder contains the Events Webhook Trigger workflow. Its executable nodes use httpRequest, if, noOp, respondToWebhook, set, slack, switch, theHiveProject, theHiveProjectTrigger, webhook. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.

Setup

Import inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.

Entry points

TheHive Trigger, Receive Button Press

Verification

Sanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.

Attribution

https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Webhook/0644_Webhook_Slack_Create_Webhook.json MIT; preserve source notices.