{
  "kind": "open-flow-workflow",
  "version": 1,
  "name": "Create and Update a TheHive Case",
  "content": {
    "modelVersion": 14,
    "document": {
      "bindings": {},
      "graph": {
        "nodes": {
          "n_12e3b72546f94268": {
            "name": "Enter case details",
            "kind": "start",
            "inputDefs": [
              {
                "jsonSchema": {
                  "type": "string",
                  "minLength": 1
                },
                "nullable": false,
                "handle": "title"
              },
              {
                "jsonSchema": {
                  "type": "string",
                  "minLength": 1
                },
                "nullable": false,
                "handle": "description"
              },
              {
                "jsonSchema": {
                  "type": "string",
                  "minLength": 1
                },
                "nullable": false,
                "handle": "owner"
              }
            ]
          },
          "n_d379b0a1883a8e93": {
            "inputs": {
              "title": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_12e3b72546f94268",
                    "output": "title"
                  }
                ]
              },
              "description": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_12e3b72546f94268",
                    "output": "description"
                  }
                ]
              },
              "owner": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_12e3b72546f94268",
                    "output": "owner"
                  }
                ]
              }
            },
            "name": "Validate case details",
            "kind": "task",
            "task": {
              "inputs": [
                {
                  "jsonSchema": {
                    "type": "string",
                    "minLength": 1
                  },
                  "nullable": false,
                  "handle": "title"
                },
                {
                  "jsonSchema": {
                    "type": "string",
                    "minLength": 1
                  },
                  "nullable": false,
                  "handle": "description"
                },
                {
                  "jsonSchema": {
                    "type": "string",
                    "minLength": 1
                  },
                  "nullable": false,
                  "handle": "owner"
                }
              ],
              "outputs": [
                {
                  "jsonSchema": {
                    "type": "string",
                    "maxLength": 512,
                    "minLength": 1,
                    "description": "The case title."
                  },
                  "nullable": false,
                  "handle": "title"
                },
                {
                  "jsonSchema": {
                    "type": "string",
                    "description": "The case description."
                  },
                  "nullable": false,
                  "handle": "description"
                },
                {
                  "jsonSchema": {
                    "type": "string",
                    "description": "The login of the case owner."
                  },
                  "nullable": true,
                  "handle": "owner"
                },
                {
                  "jsonSchema": {
                    "type": "integer",
                    "description": "The case start timestamp in Unix milliseconds."
                  },
                  "nullable": true,
                  "handle": "startDate"
                }
              ],
              "name": "Validate case details",
              "moduleId": "n_d2091866500ca11b",
              "capabilities": [
                {
                  "kind": "connector",
                  "mode": "independent",
                  "actions": []
                }
              ]
            }
          },
          "n_cf85fab2ec6e00ad": {
            "inputs": {
              "title": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_d379b0a1883a8e93",
                    "output": "title"
                  }
                ]
              },
              "description": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_d379b0a1883a8e93",
                    "output": "description"
                  }
                ]
              },
              "owner": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_d379b0a1883a8e93",
                    "output": "owner"
                  }
                ]
              },
              "startDate": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_d379b0a1883a8e93",
                    "output": "startDate"
                  }
                ]
              },
              "severity": {
                "kind": "value",
                "value": 1
              },
              "flag": {
                "kind": "value",
                "value": false
              },
              "tlp": {
                "kind": "value",
                "value": 2
              },
              "tags": {
                "kind": "value",
                "value": [
                  "security"
                ]
              }
            },
            "name": "Create the case",
            "kind": "task",
            "task": {
              "inputs": [
                {
                  "description": "The case title.",
                  "jsonSchema": {
                    "type": "string",
                    "maxLength": 512,
                    "minLength": 1,
                    "description": "The case title."
                  },
                  "nullable": false,
                  "handle": "title"
                },
                {
                  "description": "The case description.",
                  "jsonSchema": {
                    "type": "string",
                    "description": "The case description."
                  },
                  "nullable": false,
                  "handle": "description"
                },
                {
                  "description": "The case start timestamp in Unix milliseconds.",
                  "jsonSchema": {
                    "type": "integer",
                    "description": "The case start timestamp in Unix milliseconds."
                  },
                  "nullable": true,
                  "handle": "startDate",
                  "value": null
                },
                {
                  "description": "The login of the case owner.",
                  "jsonSchema": {
                    "type": "string",
                    "description": "The login of the case owner."
                  },
                  "nullable": true,
                  "handle": "owner",
                  "value": null
                },
                {
                  "description": "Whether the case is flagged.",
                  "jsonSchema": {
                    "type": "boolean",
                    "description": "Whether the case is flagged."
                  },
                  "nullable": true,
                  "handle": "flag",
                  "value": null
                },
                {
                  "description": "The severity level from 1 through 3.",
                  "jsonSchema": {
                    "type": "integer",
                    "minimum": 1,
                    "maximum": 3,
                    "description": "The severity level from 1 through 3."
                  },
                  "nullable": true,
                  "handle": "severity",
                  "value": null
                },
                {
                  "description": "Tags assigned to the entity.",
                  "jsonSchema": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "minLength": 1,
                      "description": "A tag."
                    },
                    "description": "Tags assigned to the entity."
                  },
                  "nullable": true,
                  "handle": "tags",
                  "value": null
                },
                {
                  "description": "The Traffic Light Protocol level from 0 through 3.",
                  "jsonSchema": {
                    "type": "integer",
                    "minimum": 0,
                    "maximum": 3,
                    "description": "The Traffic Light Protocol level from 0 through 3."
                  },
                  "nullable": true,
                  "handle": "tlp",
                  "value": null
                }
              ],
              "outputs": [
                {
                  "description": "A TheHive 4 case.",
                  "jsonSchema": {
                    "type": "object",
                    "properties": {
                      "_id": {
                        "type": "string",
                        "description": "The case ID."
                      },
                      "title": {
                        "type": "string",
                        "description": "The case title."
                      },
                      "description": {
                        "type": "string",
                        "description": "The case description."
                      }
                    },
                    "additionalProperties": true,
                    "description": "A TheHive 4 case."
                  },
                  "nullable": false,
                  "handle": "case"
                }
              ],
              "name": "Create the case",
              "executor": {
                "kind": "connector",
                "action": "thehive.create_case"
              }
            }
          },
          "n_9e777beca14666ae": {
            "inputs": {
              "created": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_cf85fab2ec6e00ad",
                    "output": "case"
                  }
                ]
              }
            },
            "name": "Prepare severity update",
            "kind": "task",
            "task": {
              "inputs": [
                {
                  "jsonSchema": {
                    "type": "object",
                    "properties": {
                      "_id": {
                        "type": "string",
                        "description": "The case ID."
                      },
                      "title": {
                        "type": "string",
                        "description": "The case title."
                      },
                      "description": {
                        "type": "string",
                        "description": "The case description."
                      }
                    },
                    "additionalProperties": true,
                    "description": "A TheHive 4 case."
                  },
                  "nullable": false,
                  "handle": "created"
                }
              ],
              "outputs": [
                {
                  "jsonSchema": {
                    "type": "string",
                    "minLength": 1
                  },
                  "nullable": false,
                  "handle": "caseId"
                },
                {
                  "jsonSchema": {
                    "type": "string",
                    "minLength": 1
                  },
                  "nullable": false,
                  "handle": "endpoint"
                },
                {
                  "jsonSchema": {
                    "type": "object",
                    "additionalProperties": true
                  },
                  "nullable": false,
                  "handle": "body"
                }
              ],
              "name": "Prepare severity update",
              "moduleId": "n_856e611de9e68ebf",
              "capabilities": [
                {
                  "kind": "connector",
                  "mode": "independent",
                  "actions": []
                }
              ]
            }
          },
          "n_fb440cff8480a58a": {
            "inputs": {
              "endpoint": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_9e777beca14666ae",
                    "output": "endpoint"
                  }
                ]
              },
              "body": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_9e777beca14666ae",
                    "output": "body"
                  }
                ]
              }
            },
            "name": "Set severity to high",
            "kind": "task",
            "task": {
              "inputs": [
                {
                  "jsonSchema": {
                    "type": "string"
                  },
                  "nullable": false,
                  "handle": "endpoint"
                },
                {
                  "jsonSchema": {},
                  "nullable": true,
                  "handle": "body"
                }
              ],
              "outputs": [
                {
                  "jsonSchema": {},
                  "nullable": true,
                  "handle": "body"
                },
                {
                  "jsonSchema": {
                    "type": "integer"
                  },
                  "nullable": false,
                  "handle": "statusCode"
                },
                {
                  "jsonSchema": {
                    "type": "object",
                    "additionalProperties": {
                      "type": "string"
                    }
                  },
                  "nullable": false,
                  "handle": "headers"
                },
                {
                  "jsonSchema": {
                    "const": "base64"
                  },
                  "nullable": true,
                  "handle": "bodyEncoding"
                }
              ],
              "name": "Set severity to high",
              "executor": {
                "providerId": "thehive",
                "method": "PATCH",
                "query": {
                  "mode": "fields",
                  "names": []
                },
                "headers": {
                  "mode": "fields",
                  "names": []
                },
                "bodyFormat": "json",
                "kind": "connector-proxy"
              }
            }
          },
          "n_5c7ac14e4789f7e6": {
            "inputs": {
              "statusCode": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_fb440cff8480a58a",
                    "output": "statusCode"
                  }
                ]
              }
            },
            "name": "Check update response",
            "kind": "task",
            "task": {
              "inputs": [
                {
                  "jsonSchema": {
                    "type": "integer"
                  },
                  "nullable": false,
                  "handle": "statusCode"
                }
              ],
              "outputs": [],
              "name": "Check update response",
              "moduleId": "n_ee15d2b0f7ed10df",
              "capabilities": [
                {
                  "kind": "connector",
                  "mode": "independent",
                  "actions": []
                }
              ]
            }
          },
          "n_8acc176045b4bd98": {
            "inputs": {
              "caseId": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_9e777beca14666ae",
                    "output": "caseId"
                  }
                ]
              }
            },
            "name": "Read the updated case",
            "kind": "task",
            "task": {
              "inputs": [
                {
                  "description": "The TheHive entity ID or numeric case reference.",
                  "jsonSchema": {
                    "type": "string",
                    "minLength": 1,
                    "description": "The TheHive entity ID or numeric case reference."
                  },
                  "nullable": false,
                  "handle": "caseId"
                }
              ],
              "outputs": [
                {
                  "description": "A TheHive 4 case.",
                  "jsonSchema": {
                    "type": "object",
                    "properties": {
                      "_id": {
                        "type": "string",
                        "description": "The case ID."
                      },
                      "title": {
                        "type": "string",
                        "description": "The case title."
                      },
                      "description": {
                        "type": "string",
                        "description": "The case description."
                      }
                    },
                    "additionalProperties": true,
                    "description": "A TheHive 4 case."
                  },
                  "nullable": false,
                  "handle": "case"
                }
              ],
              "name": "Read the updated case",
              "executor": {
                "kind": "connector",
                "action": "thehive.get_case"
              }
            }
          },
          "n_c3b9504dd60967de": {
            "inputs": {
              "caseId": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_9e777beca14666ae",
                    "output": "caseId"
                  }
                ]
              },
              "updated": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_8acc176045b4bd98",
                    "output": "case"
                  }
                ]
              }
            },
            "name": "Verify the updated case",
            "kind": "task",
            "task": {
              "inputs": [
                {
                  "jsonSchema": {
                    "type": "string",
                    "minLength": 1
                  },
                  "nullable": false,
                  "handle": "caseId"
                },
                {
                  "jsonSchema": {
                    "type": "object",
                    "properties": {
                      "_id": {
                        "type": "string",
                        "description": "The case ID."
                      },
                      "title": {
                        "type": "string",
                        "description": "The case title."
                      },
                      "description": {
                        "type": "string",
                        "description": "The case description."
                      }
                    },
                    "additionalProperties": true,
                    "description": "A TheHive 4 case."
                  },
                  "nullable": false,
                  "handle": "updated"
                }
              ],
              "outputs": [
                {
                  "jsonSchema": {
                    "type": "object",
                    "properties": {
                      "_id": {
                        "type": "string",
                        "description": "The case ID."
                      },
                      "title": {
                        "type": "string",
                        "description": "The case title."
                      },
                      "description": {
                        "type": "string",
                        "description": "The case description."
                      }
                    },
                    "additionalProperties": true,
                    "description": "A TheHive 4 case."
                  },
                  "nullable": false,
                  "handle": "case"
                }
              ],
              "name": "Verify the updated case",
              "moduleId": "n_20deb11d25e56609",
              "capabilities": [
                {
                  "kind": "connector",
                  "mode": "independent",
                  "actions": []
                }
              ]
            }
          },
          "n_d759185a5794c5b5": {
            "name": "Return the case",
            "kind": "outputs",
            "outputDefs": [
              {
                "jsonSchema": {
                  "type": "object",
                  "properties": {
                    "_id": {
                      "type": "string",
                      "description": "The case ID."
                    },
                    "title": {
                      "type": "string",
                      "description": "The case title."
                    },
                    "description": {
                      "type": "string",
                      "description": "The case description."
                    }
                  },
                  "additionalProperties": true,
                  "description": "A TheHive 4 case."
                },
                "nullable": false,
                "handle": "case"
              }
            ],
            "outputMappings": {
              "case": {
                "kind": "sources",
                "sources": [
                  {
                    "kind": "node",
                    "nodeId": "n_c3b9504dd60967de",
                    "output": "case"
                  }
                ]
              }
            }
          }
        },
        "edges": [
          {
            "source": "n_12e3b72546f94268",
            "target": "n_d379b0a1883a8e93"
          },
          {
            "source": "n_d379b0a1883a8e93",
            "target": "n_cf85fab2ec6e00ad"
          },
          {
            "source": "n_cf85fab2ec6e00ad",
            "target": "n_9e777beca14666ae"
          },
          {
            "source": "n_9e777beca14666ae",
            "target": "n_fb440cff8480a58a"
          },
          {
            "source": "n_fb440cff8480a58a",
            "target": "n_5c7ac14e4789f7e6"
          },
          {
            "source": "n_5c7ac14e4789f7e6",
            "target": "n_8acc176045b4bd98"
          },
          {
            "source": "n_8acc176045b4bd98",
            "target": "n_c3b9504dd60967de"
          },
          {
            "source": "n_c3b9504dd60967de",
            "target": "n_d759185a5794c5b5"
          }
        ]
      }
    },
    "modules": {
      "n_d2091866500ca11b": {
        "name": "Validate case details",
        "imports": [],
        "source": "export default function input({title,description,owner}){for(const [k,v] of Object.entries({title,description,owner}))if(typeof v!=='string'||!v.trim())throw Error('Provide '+k);return {title:title.trim(),description:description.trim(),owner:owner.trim(),startDate:Date.now()};}\n"
      },
      "n_856e611de9e68ebf": {
        "name": "Prepare severity update",
        "imports": [],
        "source": "export default function update({created}){const id=created?._id??created?.id;if(typeof id!=='string'||!id||id.length>256)throw Error('TheHive did not return a case ID');return {caseId:id,endpoint:'/api/case/'+encodeURIComponent(id),body:{severity:3}};}\n"
      },
      "n_ee15d2b0f7ed10df": {
        "name": "Check update response",
        "imports": [],
        "source": "export default function check({statusCode}) { if(statusCode<200 || statusCode>=300) throw Error(\"Case update failed\"); return {}; }"
      },
      "n_20deb11d25e56609": {
        "name": "Verify the updated case",
        "imports": [],
        "source": "export default function finish({caseId,updated}){const id=updated?._id??updated?.id;if(id!==caseId||updated?.severity!==3)throw Error('TheHive did not confirm the updated case');return {case:updated};}\n"
      }
    }
  },
  "presentation": {
    "designer": {
      "version": 1,
      "flow": {
        "direction": "vertical"
      }
    }
  }
}