TheHive 4: Auto-Create Case from Enriched Alert via Python REST

This Python snippet authenticates to TheHive 4 using an API key bound to an org-level user, then creates a case and attaches observables derived from a prior Cortex enrichment. Internally, TheHive stores cases in Cassandra or Elasticsearch depending on the deployment, and the POST to /api/v1/case triggers the case creation pipeline which assigns a case ID, applies the template's custom fields, and indexes the document. The observables array is processed by the analyzer registry so tagged IOCs automatically trigger re-enrichment jobs. The X-Organisation header scopes the request to the correct tenant.

Use this in a SOAR playbook after Shuffle or n8n has enriched an alert and produced a verdict of suspicious or malicious. Instead of an analyst hand-copying hashes into TheHive, the playbook calls this script with a JSON artifact from the EDR alert. It is also commonly wired into a Wazuh active-response hook that fires on high-severity rules, giving automatic case creation for every critical alert while suppressing low-confidence noise.

From a security perspective, the API key here has write scope on cases and observables, so store it in HashiCorp Vault or AWS Secrets Manager and inject at runtime, never in source control. Performance is negligible for single-case creation, but batching more than 50 observables per case can slow TheHive's indexer; split into multiple cases or use the bulk endpoint. The most common pitfall is forgetting the X-Organisation header, which causes 403 errors on multi-tenant deployments even when the API key is valid.

> System.Execute()

#!/usr/bin/env python3
import os, requests

HIVE = os.environ["THEHIVE_URL"]          # https://thehive.corp.local
KEY  = os.environ["THEHIVE_API_KEY"]
ORG  = os.environ["THEHIVE_ORG"]          # e.g. soc-tier1

headers = {
    "Authorization": f"Bearer {KEY}",
    "X-Organisation": ORG,
    "Content-Type": "application/json",
}

case = {
    "title": "Auto-case: suspicious outbound to 185.220.101.34",
    "description": "Generated by SOAR playbook pb-4421",
    "severity": 3,
    "tlp": 2,
    "tags": ["soar", "auto-enriched"],
    "observables": [
        {"dataType": "ip", "data": "185.220.101.34", "tlp": 2, "tags": ["c2"]},
        {"dataType": "hash", "data": "44d88612fea8a8f36de82e1278abb02f", "tlp": 2}
    ],
}

r = requests.post(f"{HIVE}/api/v1/case", json=case, headers=headers, timeout=15)
r.raise_for_status()
print("case_id:", r.json()["id"])

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-58C33A91E4B4