Send TheHive Alerts to SIGNL4 for Team Notifications

This n8n workflow automates the forwarding of security alerts from TheHive 5 to SIGNL4, a reliable push notification service for teams. It uses a webhook node to receive new or updated alerts from TheHive, checks if the alert is not closed via an IF node, and sends it to SIGNL4 with title, description, and external ID for tracking. When an alert is closed in TheHive, a corresponding node resolves it in SIGNL4, ensuring clean synchronization.

Two dedicated test nodes ('TheHive Read Alerts' and 'TheHive Create Alert') allow quick verification of TheHive credentials and connectivity without live data. Benefits include real-time team notifications, reduced alert fatigue through auto-resolution, and seamless integration between incident response platforms, saving hours in manual alerting during security incidents.

Ideal for Security Operations Centers (SOCs), IT teams, and DevOps handling threats. Use cases: Monitor intrusions, vulnerabilities, or MISP events; escalate to on-call teams instantly; maintain audit trails with external IDs. Setup requires TheHive webhook configuration and API credentials for both services.