AI Agent Tool Server for TheHive Security Operations - n8n Workflow

Security Operations Center (SOC) analysts looking to automate incident response.
DevOps engineers integrating security tools into automated pipelines.
n8n Automation Specialists developing complex AI-driven security automation solutions.
Users seeking advanced n8n templates for tool calling architectures.

Modern automation often requires AI agents to perform complex, domain-specific tasks. However, these agents need clearly defined 'tools' or functions to interact with external systems. This specific n8n workflow acts as a secure server, utilizing the power of the n8n trigger for the Model Controller Platform (MCP). It packages crucial TheHive operations—a leading security incident response platform—into standardized functions that an AI model can dynamically call. By deploying this n8n workflow, you enable an AI agent to manage incident logs, execute responders, and retrieve investigation data seamlessly, moving beyond simple data processing into actionable security automation.

This specialized n8n workflow operates not in a standard linear fashion, but as a definition service for AI tooling. The flow begins with the specialized MCP n8n trigger, which registers the entire workflow and its connected nodes as available tools for the AI model.

1. AI Tool Registration: The n8n workflow starts with the 'TheHive Tool MCP Server' n8n trigger. This MCP n8n trigger exposes the webhook URL and the definitions of all connected tool nodes to the centralized AI orchestrator.


2. Tool Availability: Four distinct TheHive operation nodes are defined and connected back to the MCP n8n trigger using the specialized ai_tool connection type. These functions include creating logs, retrieving logs, and executing responders.


3. AI Execution: When an AI agent determines it needs to perform a security action within TheHive (e.g., 'create a log of analyst findings'), it calls the corresponding tool defined by this n8n workflow via the registered endpoint.


4. Action Execution: The specific TheHive Tool n8n node executes the requested operation (e.g., 'Execute a responder') using its defined parameters, returning the result back to the AI model for incorporation into its response.

To utilize this sophisticated n8n workflow and its defined n8n templates, follow these steps:

1. Import the JSON: Copy the provided JSON data and import it directly into your n8n instance via the 'Workflows' menu, selecting 'New' and then 'Import from JSON'.


2. Activate the Workflow: Ensure the workflow is active. Since it uses an MCP n8n trigger, it will automatically register its tools when activated.


3. Credential Setup: Configure the 'TheHive Tool' n8n node credentials. You will need to provide the API key and URL for your TheHive instance. Since multiple TheHive nodes are used in this n8n workflow, verify that they all inherit the correct credentials.


4. MCP Integration: This n8n workflow requires integration with the Model Controller Platform. The output endpoint from the MCP n8n trigger must be provided to your centralized AI agent configuration (such as LangChain or a custom AI service) so the agent knows which tools are available.

TheHive Tool MCP Server (mcpTrigger): This critical n8n trigger initiates the workflow and exposes the tool definitions to the AI agent. It is essential for defining the interface through which the AI interacts with the external world.
Create a log (TheHive Tool n8n node): Function allows the AI agent to log information or updates within a TheHive case or task, crucial for documenting incident response steps.
Execute a responder (TheHive Tool n8n node): Enables the AI to remotely trigger automated actions (responders) within TheHive, such as performing a file hash lookup or blocking an IP address.
Get many logs (TheHive Tool n8n node): Provides the AI with the ability to retrieve multiple logs associated with an investigation, allowing the agent to gather context and analyze incident history.

• Get a log (TheHive Tool n8n node): Specific function to retrieve details for a single log entry, used when the AI needs precise information retrieval during the execution of this n8n workflow.