Incident management in TheHive via AI: log creation and

This automation template integrates n8n with TheHive via an MCP server, enabling AI agents to manage security incidents. It receives AI tool calls and routes them to actions such as creating logs, retrieving incident data, or executing responders. Acts as a secure middleware layer between LLMs and SOC operations. Designed for teams aiming to automate SIEM workflows using AI.

## Who it´s for
- Cybersecurity specialists using TheHive for incident management
- SOC analysts looking to integrate AI into response workflows
- Developers building MCP-compatible AI tools for security
- DevSecOps teams automating threat response with AI

## What the automation does
- Receives AI agent requests via MCP server protocol
- Creates logs in TheHive upon detection of suspicious activity
- Retrieves incident details on demand from chat interfaces
- Triggers responders for automated actions (e.g., host isolation)
- Provides a secure middleware layer between LLMs and TheHive

## What´s included
- Ready-to-use n8n workflow
- Logic for handling AI tool calls and request routing
- Integrations with TheHive API and AI Agent Platform via LangChain and MCP Server
- Basic text guide for setup and adaptation

## Requirements for setup
- n8n instance with server access
- TheHive instance with API key
- Configured LangChain-compatible MCP server
- AI agent capable of making MCP-based tool calls

## Benefits and outcomes
- Reduced incident response time through automation
- Centralized security event management via AI interface
- Lower analyst workload via automated data retrieval
- Scalable deployment of AI assistants in SOC processes
- Improved consistency in response actions

## Important: template only
Important: you are purchasing a ready-made automation workflow template only. Rollout into your infrastructure, connecting specific accounts and services, 1:1 setup help, custom adjustments for non-standard stacks and any consulting support are provided as a separate paid service at an individual rate. To discuss custom work or 1:1 help, contact via Telegram: @gleb923.