{
  "name": "Create and Update a TheHive Case",
  "nodes": [
    {
      "name": "On clicking 'execute'",
      "type": "n8n-nodes-base.manualTrigger",
      "position": [
        270,
        340
      ],
      "parameters": {},
      "typeVersion": 1,
      "id": "create-and-update-thehive-case-0"
    },
    {
      "id": "create-and-update-thehive-case-1",
      "name": "Set case details",
      "type": "n8n-nodes-base.set",
      "typeVersion": 2,
      "parameters": {
        "values": {
          "string": [
            {
              "name": "title",
              "value": "YOUR_CASE_TITLE"
            },
            {
              "name": "description",
              "value": "YOUR_CASE_DESCRIPTION"
            },
            {
              "name": "owner",
              "value": "YOUR_THEHIVE_OWNER"
            }
          ]
        },
        "options": {}
      }
    },
    {
      "id": "create-and-update-thehive-case-2",
      "name": "Validate case details",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "parameters": {
        "mode": "runOnceForEachItem",
        "jsCode": "function input({title,description,owner}){for(const [k,v] of Object.entries({title,description,owner}))if(typeof v!=='string'||!v.trim())throw Error('Provide '+k);return {title:title.trim(),description:description.trim(),owner:owner.trim(),startDate:Date.now()};}\n\nreturn {json:input($json)};"
      }
    },
    {
      "name": "TheHive",
      "type": "n8n-nodes-base.theHive",
      "position": [
        470,
        340
      ],
      "parameters": {
        "resource": "case",
        "operation": "create",
        "title": "={{ $json.title }}",
        "description": "={{ $json.description }}",
        "owner": "={{ $json.owner }}",
        "startDate": "={{ new Date($json.startDate).toISOString() }}",
        "severity": 1,
        "flag": false,
        "tlp": 2,
        "tags": "security",
        "options": {}
      },
      "typeVersion": 1,
      "id": "create-and-update-thehive-case-3"
    },
    {
      "id": "create-and-update-thehive-case-4",
      "name": "Prepare severity update",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "parameters": {
        "mode": "runOnceForEachItem",
        "jsCode": "function update({created}){const id=created?._id??created?.id;if(typeof id!=='string'||!id||id.length>256)throw Error('TheHive did not return a case ID');return {caseId:id,endpoint:'/api/case/'+encodeURIComponent(id),body:{severity:3}};}\n\nreturn {json:update({created:$json})};"
      }
    },
    {
      "name": "TheHive1",
      "type": "n8n-nodes-base.theHive",
      "position": [
        670,
        340
      ],
      "parameters": {
        "resource": "case",
        "operation": "update",
        "id": "={{ $json.caseId }}",
        "updateFields": {
          "severity": 3
        }
      },
      "typeVersion": 1,
      "id": "create-and-update-thehive-case-5"
    },
    {
      "name": "TheHive2",
      "type": "n8n-nodes-base.theHive",
      "position": [
        870,
        340
      ],
      "parameters": {
        "resource": "case",
        "operation": "get",
        "id": "={{ $('Prepare severity update').item.json.caseId }}"
      },
      "typeVersion": 1,
      "id": "create-and-update-thehive-case-6"
    },
    {
      "id": "create-and-update-thehive-case-7",
      "name": "Verify the updated case",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "parameters": {
        "mode": "runOnceForEachItem",
        "jsCode": "function finish({caseId,updated}){const id=updated?._id??updated?.id;if(id!==caseId||updated?.severity!==3)throw Error('TheHive did not confirm the updated case');return {case:updated};}\n\nreturn {json:finish({caseId:$('Prepare severity update').item.json.caseId,updated:$json}).case};"
      }
    }
  ],
  "active": false,
  "settings": {},
  "connections": {
    "On clicking 'execute'": {
      "main": [
        [
          {
            "node": "Set case details",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set case details": {
      "main": [
        [
          {
            "node": "Validate case details",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Validate case details": {
      "main": [
        [
          {
            "node": "TheHive",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "TheHive": {
      "main": [
        [
          {
            "node": "Prepare severity update",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Prepare severity update": {
      "main": [
        [
          {
            "node": "TheHive1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "TheHive1": {
      "main": [
        [
          {
            "node": "TheHive2",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "TheHive2": {
      "main": [
        [
          {
            "node": "Verify the updated case",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "pinData": {}
}