first commit

packages/nodes-base/nodes/TheHive/GenericFunctions.ts

@@ -0,0 +1,195 @@
+import moment from 'moment-timezone';
+import type {
+	IExecuteFunctions,
+	IHookFunctions,
+	ILoadOptionsFunctions,
+	IDataObject,
+	IHttpRequestMethods,
+	IRequestOptions,
+} from 'n8n-workflow';
+import { ApplicationError, jsonParse } from 'n8n-workflow';
+
+import { Eq } from './QueryFunctions';
+
+export async function theHiveApiRequest(
+	this: IHookFunctions | IExecuteFunctions | ILoadOptionsFunctions,
+	method: IHttpRequestMethods,
+	resource: string,
+	body: IDataObject = {},
+	query: IDataObject = {},
+	uri?: string,
+	option: IDataObject = {},
+) {
+	const credentials = await this.getCredentials('theHiveApi');
+
+	let options: IRequestOptions = {
+		method,
+		qs: query,
+		uri: uri || `${credentials.url}/api${resource}`,
+		body,
+		rejectUnauthorized: !credentials.allowUnauthorizedCerts,
+		json: true,
+	};
+
+	if (Object.keys(option).length !== 0) {
+		options = Object.assign({}, options, option);
+	}
+
+	if (Object.keys(body).length === 0) {
+		delete options.body;
+	}
+
+	if (Object.keys(query).length === 0) {
+		delete options.qs;
+	}
+	return await this.helpers.requestWithAuthentication.call(this, 'theHiveApi', options);
+}
+
+// Helpers functions
+export function mapResource(resource: string): string {
+	switch (resource) {
+		case 'alert':
+			return 'alert';
+		case 'case':
+			return 'case';
+		case 'observable':
+			return 'case_artifact';
+		case 'task':
+			return 'case_task';
+		case 'log':
+			return 'case_task_log';
+		default:
+			return '';
+	}
+}
+
+export function splitTags(tags: string): string[] {
+	return tags.split(',').filter((tag) => tag !== ' ' && tag);
+}
+
+export function prepareOptional(optionals: IDataObject): IDataObject {
+	const response: IDataObject = {};
+	for (const key in optionals) {
+		if (optionals[key] !== undefined && optionals[key] !== null && optionals[key] !== '') {
+			if (['customFieldsJson', 'customFieldsUi'].indexOf(key) > -1) {
+				continue; // Ignore customFields, they need special treatment
+			} else if (moment(optionals[key] as string, moment.ISO_8601).isValid()) {
+				response[key] = Date.parse(optionals[key] as string);
+			} else if (key === 'artifacts') {
+				try {
+					response[key] = jsonParse(optionals[key] as string);
+				} catch (error) {
+					throw new ApplicationError('Invalid JSON for artifacts', { level: 'warning' });
+				}
+			} else if (key === 'tags') {
+				response[key] = splitTags(optionals[key] as string);
+			} else {
+				response[key] = optionals[key];
+			}
+		}
+	}
+	return response;
+}
+
+export async function prepareCustomFields(
+	this: IHookFunctions | IExecuteFunctions | ILoadOptionsFunctions,
+	additionalFields: IDataObject,
+	jsonParameters = false,
+): Promise<IDataObject | undefined> {
+	// Check if the additionalFields object contains customFields
+	if (jsonParameters) {
+		let customFieldsJson = additionalFields.customFieldsJson;
+		// Delete from additionalFields as some operations (e.g. alert:update) do not run prepareOptional
+		// which would remove the extra fields
+		delete additionalFields.customFieldsJson;
+
+		if (typeof customFieldsJson === 'string') {
+			try {
+				customFieldsJson = jsonParse(customFieldsJson);
+			} catch (error) {
+				throw new ApplicationError('Invalid JSON for customFields', { level: 'warning' });
+			}
+		}
+
+		if (typeof customFieldsJson === 'object') {
+			const customFields = Object.keys(customFieldsJson as IDataObject).reduce((acc, curr) => {
+				acc[`customFields.${curr}`] = (customFieldsJson as IDataObject)[curr];
+				return acc;
+			}, {} as IDataObject);
+
+			return customFields;
+		} else if (customFieldsJson) {
+			throw new ApplicationError('customFieldsJson value is invalid', { level: 'warning' });
+		}
+	} else if (additionalFields.customFieldsUi) {
+		// Get Custom Field Types from TheHive
+		const credentials = await this.getCredentials('theHiveApi');
+		const version = credentials.apiVersion;
+		const endpoint = version === 'v1' ? '/customField' : '/list/custom_fields';
+
+		const requestResult = await theHiveApiRequest.call(this, 'GET', endpoint as string);
+
+		// Convert TheHive3 response to the same format as TheHive 4
+		// [{name, reference, type}]
+		const hiveCustomFields =
+			version === 'v1'
+				? requestResult
+				: Object.keys(requestResult as IDataObject).map((key) => requestResult[key]);
+		// Build reference to type mapping object
+		const referenceTypeMapping = hiveCustomFields.reduce(
+			(acc: IDataObject, curr: IDataObject) => ((acc[curr.reference as string] = curr.type), acc),
+			{},
+		);
+
+		// Build "fieldName": {"type": "value"} objects
+		const customFieldsUi = additionalFields.customFieldsUi as IDataObject;
+		const customFields: IDataObject = (customFieldsUi?.customFields as IDataObject[]).reduce(
+			(acc: IDataObject, curr: IDataObject) => {
+				const fieldName = curr.field as string;
+
+				// Might be able to do some type conversions here if needed, TODO
+
+				const updatedField = `customFields.${fieldName}.${[referenceTypeMapping[fieldName]]}`;
+				acc[updatedField] = curr.value;
+				return acc;
+			},
+			{} as IDataObject,
+		);
+
+		delete additionalFields.customFieldsUi;
+		return customFields;
+	}
+	return undefined;
+}
+
+export function buildCustomFieldSearch(customFields: IDataObject): IDataObject[] {
+	const searchQueries: IDataObject[] = [];
+
+	Object.keys(customFields).forEach((customFieldName) => {
+		searchQueries.push(Eq(customFieldName, customFields[customFieldName]));
+	});
+	return searchQueries;
+}
+
+export function prepareSortQuery(sort: string, body: { query: [IDataObject] }) {
+	if (sort) {
+		const field = sort.substring(1);
+		const value = sort.charAt(0) === '+' ? 'asc' : 'desc';
+		const sortOption: IDataObject = {};
+		sortOption[field] = value;
+		body.query.push({
+			_name: 'sort',
+			_fields: [sortOption],
+		});
+	}
+}
+
+export function prepareRangeQuery(range: string, body: { query: IDataObject[] }) {
+	if (range && range !== 'all') {
+		body.query.push({
+			_name: 'page',
+			from: parseInt(range.split('-')[0], 10),
+			to: parseInt(range.split('-')[1], 10),
+		});
+	}
+}

packages/nodes-base/nodes/TheHive/QueryFunctions.ts

@@ -0,0 +1,108 @@
+// Query types
+export declare type queryIndexSignature =
+	| '_field'
+	| '_gt'
+	| '_value'
+	| '_gte'
+	| '_lt'
+	| '_lte'
+	| '_and'
+	| '_or'
+	| '_not'
+	| '_in'
+	| '_contains'
+	| '_id'
+	| '_between'
+	| '_parent'
+	| '_child'
+	| '_type'
+	| '_string'
+	| '_like'
+	| '_wildcard';
+export type IQueryObject = {
+	[key in queryIndexSignature]?: IQueryObject | IQueryObject[] | string | number | object;
+};
+
+// Query Functions
+
+export function Eq(field: string, value: any): IQueryObject {
+	return { _field: field, _value: value };
+}
+
+export function Gt(_field: string, value: any): IQueryObject {
+	return { _gt: { field: value } };
+}
+
+export function Gte(_field: string, value: any): IQueryObject {
+	return { _gte: { field: value } };
+}
+
+export function Lt(_field: string, value: any): IQueryObject {
+	return { _lt: { field: value } };
+}
+
+export function Lte(_field: string, value: any): IQueryObject {
+	return { _lte: { field: value } };
+}
+export function And(...criteria: IQueryObject[]): IQueryObject {
+	return { _and: criteria };
+}
+export function Or(...criteria: IQueryObject[]): IQueryObject {
+	return { _or: criteria };
+}
+export function Not(criteria: IQueryObject[]): IQueryObject {
+	return { _not: criteria };
+}
+
+export function In(field: string, values: any[]): IQueryObject {
+	return { _in: { _field: field, _values: values } };
+}
+export function Contains(field: string): IQueryObject {
+	return { _contains: field };
+}
+export function Id(id: string | number): IQueryObject {
+	return { _id: id };
+}
+
+export function Between(field: string, fromValue: any, toValue: any): IQueryObject {
+	return { _between: { _field: field, _from: fromValue, _to: toValue } };
+}
+export function ParentId(tpe: string, id: string): IQueryObject {
+	return { _parent: { _type: tpe, _id: id } };
+}
+export function Parent(tpe: string, criterion: IQueryObject): IQueryObject {
+	return { _parent: { _type: tpe, _query: criterion } };
+}
+export function Child(tpe: string, criterion: IQueryObject): IQueryObject {
+	return { _child: { _type: tpe, _query: criterion } };
+}
+export function Type(tpe: string): IQueryObject {
+	return { _type: tpe };
+}
+export function queryString(query: string): IQueryObject {
+	return { _string: query };
+}
+export function Like(field: string, value: string): IQueryObject {
+	return { _like: { _field: field, _value: value } };
+}
+export function StartsWith(field: string, value: string) {
+	if (!value.startsWith('*')) {
+		value = value + '*';
+	}
+	return { _wildcard: { _field: field, _value: value } };
+}
+export function EndsWith(field: string, value: string) {
+	if (!value.endsWith('*')) {
+		value = '*' + value;
+	}
+	return { _wildcard: { _field: field, _value: value } };
+}
+export function ContainsString(field: string, value: string) {
+	if (!value.endsWith('*')) {
+		value = value + '*';
+	}
+	if (!value.startsWith('*')) {
+		value = '*' + value;
+	}
+	return { _wildcard: { _field: field, _value: value } };
+}

packages/nodes-base/nodes/TheHive/TheHive.node.json

@@ -0,0 +1,18 @@
+{
+	"node": "n8n-nodes-base.theHive",
+	"nodeVersion": "1.0",
+	"codexVersion": "1.0",
+	"categories": ["Development"],
+	"resources": {
+		"credentialDocumentation": [
+			{
+				"url": "https://docs.n8n.io/integrations/builtin/credentials/thehive/"
+			}
+		],
+		"primaryDocumentation": [
+			{
+				"url": "https://docs.n8n.io/integrations/builtin/app-nodes/n8n-nodes-base.thehive/"
+			}
+		]
+	}
+}

packages/nodes-base/nodes/TheHive/TheHiveTrigger.node.json

@@ -0,0 +1,13 @@
+{
+	"node": "n8n-nodes-base.theHiveTrigger",
+	"nodeVersion": "1.0",
+	"codexVersion": "1.0",
+	"categories": ["Development"],
+	"resources": {
+		"primaryDocumentation": [
+			{
+				"url": "https://docs.n8n.io/integrations/builtin/trigger-nodes/n8n-nodes-base.thehivetrigger/"
+			}
+		]
+	}
+}

packages/nodes-base/nodes/TheHive/TheHiveTrigger.node.ts

@@ -0,0 +1,91 @@
+import {
+	type IWebhookFunctions,
+	type IDataObject,
+	type IHookFunctions,
+	type INodeType,
+	type INodeTypeDescription,
+	type IWebhookResponseData,
+	NodeConnectionTypes,
+} from 'n8n-workflow';
+
+import { eventsDescription } from './descriptions/EventsDescription';
+
+export class TheHiveTrigger implements INodeType {
+	description: INodeTypeDescription = {
+		displayName: 'TheHive Trigger',
+		name: 'theHiveTrigger',
+		icon: 'file:thehive.svg',
+		group: ['trigger'],
+		version: [1, 2],
+		description: 'Starts the workflow when TheHive events occur',
+		defaults: {
+			name: 'TheHive Trigger',
+		},
+		inputs: [],
+		outputs: [NodeConnectionTypes.Main],
+		webhooks: [
+			{
+				name: 'default',
+				httpMethod: 'POST',
+				responseMode: 'onReceived',
+				path: 'webhook',
+			},
+		],
+		properties: [
+			{
+				displayName:
+					'You must set up the webhook in TheHive — instructions <a href="https://docs.n8n.io/integrations/builtin/trigger-nodes/n8n-nodes-base.thehivetrigger/#configure-a-webhook-in-thehive" target="_blank">here</a>',
+				name: 'notice',
+				type: 'notice',
+				default: '',
+			},
+			...eventsDescription,
+		],
+	};
+
+	webhookMethods = {
+		default: {
+			async checkExists(this: IHookFunctions): Promise<boolean> {
+				return true;
+			},
+			async create(this: IHookFunctions): Promise<boolean> {
+				return true;
+			},
+			async delete(this: IHookFunctions): Promise<boolean> {
+				return true;
+			},
+		},
+	};
+
+	async webhook(this: IWebhookFunctions): Promise<IWebhookResponseData> {
+		// Get the request body
+		const bodyData = this.getBodyData();
+		const events = this.getNodeParameter('events', []) as string[];
+		if (!bodyData.operation || !bodyData.objectType) {
+			// Don't start the workflow if mandatory fields are not specified
+			return {};
+		}
+
+		// Don't start the workflow if the event is not fired
+		// Replace Creation with Create for TheHive 3 support
+		const operation = (bodyData.operation as string).replace('Creation', 'Create');
+		const event = `${(bodyData.objectType as string).toLowerCase()}_${operation.toLowerCase()}`;
+
+		if (events.indexOf('*') === -1 && events.indexOf(event) === -1) {
+			return {};
+		}
+
+		// The data to return and so start the workflow with
+		const returnData: IDataObject[] = [];
+		returnData.push({
+			event,
+			body: this.getBodyData(),
+			headers: this.getHeaderData(),
+			query: this.getQueryData(),
+		});
+
+		return {
+			workflowData: [this.helpers.returnJsonArray(returnData)],
+		};
+	}
+}

packages/nodes-base/nodes/TheHive/descriptions/AlertDescription.ts

@@ -0,0 +1,913 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+import { TLPs } from '../interfaces/AlertInterface';
+
+export const alertOperations: INodeProperties[] = [
+	{
+		displayName: 'Operation Name or ID',
+		name: 'operation',
+		type: 'options',
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		noDataExpression: true,
+		required: true,
+		typeOptions: {
+			loadOptionsMethod: 'loadAlertOptions',
+		},
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+			},
+		},
+		default: 'create',
+	},
+];
+
+export const alertFields: INodeProperties[] = [
+	{
+		displayName: 'Return All',
+		name: 'returnAll',
+		type: 'boolean',
+		displayOptions: {
+			show: {
+				operation: ['getAll'],
+				resource: ['alert'],
+			},
+		},
+		default: false,
+		description: 'Whether to return all results or only up to a given limit',
+	},
+	{
+		displayName: 'Limit',
+		name: 'limit',
+		type: 'number',
+		displayOptions: {
+			show: {
+				operation: ['getAll'],
+				resource: ['alert'],
+				returnAll: [false],
+			},
+		},
+		typeOptions: {
+			minValue: 1,
+			maxValue: 500,
+		},
+		default: 100,
+		description: 'Max number of results to return',
+	},
+	// required attributs
+	{
+		displayName: 'Alert ID',
+		name: 'id',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: [
+					'promote',
+					'markAsRead',
+					'markAsUnread',
+					'merge',
+					'update',
+					'executeResponder',
+					'get',
+				],
+			},
+		},
+		description: 'Title of the alert',
+	},
+	{
+		displayName: 'Case ID',
+		name: 'caseId',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['merge'],
+			},
+		},
+	},
+	{
+		displayName: 'Title',
+		name: 'title',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		description: 'Title of the alert',
+	},
+	{
+		displayName: 'Description',
+		name: 'description',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		description: 'Description of the alert',
+	},
+	{
+		displayName: 'Severity',
+		name: 'severity',
+		type: 'options',
+		options: [
+			{
+				name: 'Low',
+				value: 1,
+			},
+			{
+				name: 'Medium',
+				value: 2,
+			},
+			{
+				name: 'High',
+				value: 3,
+			},
+		],
+		required: true,
+		default: 2,
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		description: 'Severity of the alert. Default=Medium.',
+	},
+	{
+		displayName: 'Date',
+		name: 'date',
+		type: 'dateTime',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		description: 'Date and time when the alert was raised default=now',
+	},
+	{
+		displayName: 'Tags',
+		name: 'tags',
+		type: 'string',
+		required: true,
+		default: '',
+		placeholder: 'tag,tag2,tag3...',
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		description: 'Case Tags',
+	},
+	{
+		displayName: 'TLP',
+		name: 'tlp',
+		type: 'options',
+		required: true,
+		default: 2,
+		options: [
+			{
+				name: 'White',
+				value: TLPs.white,
+			},
+			{
+				name: 'Green',
+				value: TLPs.green,
+			},
+			{
+				name: 'Amber',
+				value: TLPs.amber,
+			},
+			{
+				name: 'Red',
+				value: TLPs.red,
+			},
+		],
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		description: 'Traffict Light Protocol (TLP). Default=Amber.',
+	},
+	{
+		displayName: 'Status',
+		name: 'status',
+		type: 'options',
+		required: true,
+		options: [
+			{
+				name: 'New',
+				value: 'New',
+			},
+			{
+				name: 'Updated',
+				value: 'Updated',
+			},
+			{
+				name: 'Ignored',
+				value: 'Ignored',
+			},
+			{
+				name: 'Imported',
+				value: 'Imported',
+			},
+		],
+		default: 'New',
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		description: 'Status of the alert',
+	},
+	{
+		displayName: 'Type',
+		name: 'type',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		description: 'Type of the alert',
+	},
+	{
+		displayName: 'Source',
+		name: 'source',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		description: 'Source of the alert',
+	},
+	{
+		displayName: 'SourceRef',
+		name: 'sourceRef',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		description: 'Source reference of the alert',
+	},
+	{
+		displayName: 'Follow',
+		name: 'follow',
+		type: 'boolean',
+		required: true,
+		default: true,
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		description: 'Whether the alert becomes active when updated default=true',
+	},
+	{
+		displayName: 'Artifacts',
+		name: 'artifactUi',
+		type: 'fixedCollection',
+		placeholder: 'Add Artifact',
+		default: {},
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		typeOptions: {
+			multipleValues: true,
+		},
+		options: [
+			{
+				displayName: 'Artifact',
+				name: 'artifactValues',
+				values: [
+					{
+						displayName: 'Data Type Name or ID',
+						name: 'dataType',
+						type: 'options',
+						default: '',
+						typeOptions: {
+							loadOptionsMethod: 'loadObservableTypes',
+						},
+						description:
+							'Type of the observable. Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>.',
+					},
+					{
+						displayName: 'Data',
+						name: 'data',
+						type: 'string',
+						displayOptions: {
+							hide: {
+								dataType: ['file'],
+							},
+						},
+						default: '',
+					},
+					{
+						displayName: 'Input Binary Field',
+						name: 'binaryProperty',
+						type: 'string',
+						hint: 'The name of the input binary field containing the file to be written',
+						displayOptions: {
+							show: {
+								dataType: ['file'],
+							},
+						},
+						default: 'data',
+					},
+					{
+						displayName: 'Message',
+						name: 'message',
+						type: 'string',
+						default: '',
+					},
+					{
+						displayName: 'Case Tags',
+						name: 'tags',
+						type: 'string',
+						default: '',
+					},
+				],
+			},
+		],
+		description: 'Artifact attributes',
+	},
+	// required for responder execution
+	{
+		displayName: 'Responder Name or ID',
+		name: 'responder',
+		type: 'options',
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		required: true,
+		default: '',
+		typeOptions: {
+			loadOptionsDependsOn: ['id'],
+			loadOptionsMethod: 'loadResponders',
+		},
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['executeResponder'],
+			},
+			hide: {
+				id: [''],
+			},
+		},
+	},
+	{
+		displayName: 'JSON Parameters',
+		name: 'jsonParameters',
+		type: 'boolean',
+		default: true,
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create', 'update'],
+			},
+		},
+	},
+
+	// optional attributs (Create, Promote operations)
+	{
+		displayName: 'Additional Fields',
+		name: 'additionalFields',
+		placeholder: 'Add Field',
+		type: 'collection',
+		default: {},
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['create'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Case Template',
+				name: 'caseTemplate',
+				type: 'string',
+				default: '',
+				description: 'Case template to use when a case is created from this alert',
+			},
+			{
+				displayName: 'Custom Fields',
+				name: 'customFieldsUi',
+				type: 'fixedCollection',
+				default: {},
+				displayOptions: {
+					show: {
+						'/jsonParameters': [false],
+					},
+				},
+				typeOptions: {
+					multipleValues: true,
+				},
+				placeholder: 'Add Custom Field',
+				options: [
+					{
+						name: 'customFields',
+						displayName: 'Custom Field',
+						values: [
+							{
+								displayName: 'Field Name or ID',
+								name: 'field',
+								type: 'options',
+								description:
+									'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+								typeOptions: {
+									loadOptionsMethod: 'loadCustomFields',
+								},
+								default: 'Custom Field',
+							},
+							{
+								displayName: 'Value',
+								name: 'value',
+								type: 'string',
+								default: '',
+								description: 'Custom Field value. Use an expression if the type is not a string.',
+							},
+						],
+					},
+				],
+			},
+			{
+				displayName: 'Custom Fields (JSON)',
+				name: 'customFieldsJson',
+				type: 'string',
+				default: '',
+				displayOptions: {
+					show: {
+						'/jsonParameters': [true],
+					},
+				},
+				description: 'Custom fields in JSON format. Overrides Custom Fields UI if set.',
+			},
+		],
+	},
+	// optional attributs (Promote operation)
+
+	{
+		displayName: 'Additional Fields',
+		name: 'additionalFields',
+		placeholder: 'Add Field',
+		type: 'collection',
+		default: {},
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['promote'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Case Template',
+				name: 'caseTemplate',
+				type: 'string',
+				default: '',
+				description: 'Case template to use when a case is created from this alert',
+			},
+		],
+	},
+	// optional attributs (Update operation)
+	{
+		displayName: 'Update Fields',
+		name: 'updateFields',
+		type: 'collection',
+		placeholder: 'Add Field',
+		default: {},
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['update'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Artifacts',
+				name: 'artifactUi',
+				type: 'fixedCollection',
+				placeholder: 'Add Artifact',
+				default: {},
+				typeOptions: {
+					multipleValues: true,
+				},
+				options: [
+					{
+						displayName: 'Artifact',
+						name: 'artifactValues',
+						values: [
+							{
+								displayName: 'Data Type Name or ID',
+								name: 'dataType',
+								type: 'options',
+								default: '',
+								typeOptions: {
+									loadOptionsMethod: 'loadObservableTypes',
+								},
+								description:
+									'Type of the observable. Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>.',
+							},
+							{
+								displayName: 'Data',
+								name: 'data',
+								type: 'string',
+								displayOptions: {
+									hide: {
+										dataType: ['file'],
+									},
+								},
+								default: '',
+							},
+							{
+								displayName: 'Input Binary Field',
+								name: 'binaryProperty',
+								type: 'string',
+								hint: 'The name of the input binary field containing the file to be written',
+								displayOptions: {
+									show: {
+										dataType: ['file'],
+									},
+								},
+								default: 'data',
+							},
+							{
+								displayName: 'Message',
+								name: 'message',
+								type: 'string',
+								default: '',
+							},
+							{
+								displayName: 'Case Tags',
+								name: 'tags',
+								type: 'string',
+								default: '',
+							},
+						],
+					},
+				],
+			},
+			{
+				displayName: 'Custom Fields',
+				name: 'customFieldsUi',
+				type: 'fixedCollection',
+				default: {},
+				typeOptions: {
+					multipleValues: true,
+				},
+				displayOptions: {
+					show: {
+						'/jsonParameters': [false],
+					},
+				},
+				placeholder: 'Add Custom Field',
+				options: [
+					{
+						name: 'customFields',
+						displayName: 'Custom Field',
+						values: [
+							{
+								displayName: 'Field Name or ID',
+								name: 'field',
+								type: 'options',
+								description:
+									'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+								typeOptions: {
+									loadOptionsMethod: 'loadCustomFields',
+								},
+								default: 'Custom Field',
+							},
+							{
+								displayName: 'Value',
+								name: 'value',
+								type: 'string',
+								default: '',
+								description: 'Custom Field value. Use an expression if the type is not a string.',
+							},
+						],
+					},
+				],
+			},
+			{
+				displayName: 'Custom Fields (JSON)',
+				name: 'customFieldsJson',
+				type: 'string',
+				displayOptions: {
+					show: {
+						'/jsonParameters': [true],
+					},
+				},
+				default: '',
+				description: 'Custom fields in JSON format. Overrides Custom Fields UI if set.',
+			},
+			{
+				displayName: 'Case Template',
+				name: 'caseTemplate',
+				type: 'string',
+				default: '',
+				description: 'Case template to use when a case is created from this alert',
+			},
+			{
+				displayName: 'Description',
+				name: 'description',
+				type: 'string',
+				default: '',
+				description: 'Description of the alert',
+			},
+			{
+				displayName: 'Follow',
+				name: 'follow',
+				type: 'boolean',
+				default: true,
+				description: 'Whether the alert becomes active when updated default=true',
+			},
+			{
+				displayName: 'Severity',
+				name: 'severity',
+				type: 'options',
+				options: [
+					{
+						name: 'Low',
+						value: 1,
+					},
+					{
+						name: 'Medium',
+						value: 2,
+					},
+					{
+						name: 'High',
+						value: 3,
+					},
+				],
+				default: 2,
+				description: 'Severity of the alert. Default=Medium.',
+			},
+			{
+				displayName: 'Status',
+				name: 'status',
+				type: 'options',
+				options: [
+					{
+						name: 'New',
+						value: 'New',
+					},
+					{
+						name: 'Updated',
+						value: 'Updated',
+					},
+					{
+						name: 'Ignored',
+						value: 'Ignored',
+					},
+					{
+						name: 'Imported',
+						value: 'Imported',
+					},
+				],
+				default: 'New',
+			},
+			{
+				displayName: 'Case Tags',
+				name: 'tags',
+				type: 'string',
+				default: '',
+				placeholder: 'tag,tag2,tag3...',
+			},
+			{
+				displayName: 'Title',
+				name: 'title',
+				type: 'string',
+				default: '',
+				description: 'Title of the alert',
+			},
+			{
+				displayName: 'TLP',
+				name: 'tlp',
+				type: 'options',
+				default: 2,
+				options: [
+					{
+						name: 'White',
+						value: TLPs.white,
+					},
+					{
+						name: 'Green',
+						value: TLPs.green,
+					},
+					{
+						name: 'Amber',
+						value: TLPs.amber,
+					},
+					{
+						name: 'Red',
+						value: TLPs.red,
+					},
+				],
+				description: 'Traffict Light Protocol (TLP). Default=Amber.',
+			},
+		],
+	},
+	//Query attributs (Search operation)
+	{
+		displayName: 'Options',
+		name: 'options',
+		displayOptions: {
+			show: {
+				operation: ['getAll'],
+				resource: ['alert'],
+			},
+		},
+		type: 'collection',
+		placeholder: 'Add option',
+		default: {},
+		options: [
+			{
+				displayName: 'Sort',
+				name: 'sort',
+				type: 'string',
+				placeholder: '±Attribut, exp +status',
+				default: '',
+			},
+		],
+	},
+	{
+		displayName: 'Options',
+		name: 'options',
+		displayOptions: {
+			show: {
+				operation: ['get'],
+				resource: ['alert'],
+			},
+		},
+		type: 'collection',
+		placeholder: 'Add option',
+		default: {},
+		options: [
+			{
+				displayName: 'Include Similar Cases',
+				name: 'includeSimilar',
+				type: 'boolean',
+				description: 'Whether to include similar cases',
+				default: false,
+			},
+		],
+	},
+	{
+		displayName: 'Filters',
+		name: 'filters',
+		placeholder: 'Add Filter',
+		default: {},
+		type: 'collection',
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+				operation: ['getAll', 'count'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Custom Fields',
+				name: 'customFieldsUi',
+				type: 'fixedCollection',
+				default: {},
+				typeOptions: {
+					multipleValues: true,
+				},
+				placeholder: 'Add Custom Field',
+				options: [
+					{
+						name: 'customFields',
+						displayName: 'Custom Field',
+						values: [
+							{
+								displayName: 'Field Name or ID',
+								name: 'field',
+								type: 'options',
+								description:
+									'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+								typeOptions: {
+									loadOptionsMethod: 'loadCustomFields',
+								},
+								default: 'Custom Field',
+							},
+							{
+								displayName: 'Value',
+								name: 'value',
+								type: 'string',
+								default: '',
+								description: 'Custom Field value. Use an expression if the type is not a string.',
+							},
+						],
+					},
+				],
+			},
+			{
+				displayName: 'Description',
+				name: 'description',
+				type: 'string',
+				default: '',
+				description: 'Description of the alert',
+			},
+			{
+				displayName: 'Follow',
+				name: 'follow',
+				type: 'boolean',
+				default: false,
+				description: 'Whether the alert becomes active when updated default=true',
+			},
+			{
+				displayName: 'Severity',
+				name: 'severity',
+				type: 'options',
+				options: [
+					{
+						name: 'Low',
+						value: 1,
+					},
+					{
+						name: 'Medium',
+						value: 2,
+					},
+					{
+						name: 'High',
+						value: 3,
+					},
+				],
+				default: 2,
+				description: 'Severity of the alert. Default=Medium.',
+			},
+			{
+				displayName: 'Tags',
+				name: 'tags',
+				type: 'string',
+				default: '',
+				placeholder: 'tag,tag2,tag3...',
+			},
+			{
+				displayName: 'Title',
+				name: 'title',
+				type: 'string',
+				default: '',
+			},
+			{
+				displayName: 'TLP',
+				name: 'tlp',
+				type: 'options',
+				default: 2,
+				options: [
+					{
+						name: 'White',
+						value: TLPs.white,
+					},
+					{
+						name: 'Green',
+						value: TLPs.green,
+					},
+					{
+						name: 'Amber',
+						value: TLPs.amber,
+					},
+					{
+						name: 'Red',
+						value: TLPs.red,
+					},
+				],
+				description: 'Traffict Light Protocol (TLP). Default=Amber.',
+			},
+		],
+	},
+];

packages/nodes-base/nodes/TheHive/descriptions/CaseDescription.ts

@@ -0,0 +1,845 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+import { TLPs } from '../interfaces/AlertInterface';
+
+export const caseOperations: INodeProperties[] = [
+	{
+		// eslint-disable-next-line n8n-nodes-base/node-param-display-name-wrong-for-dynamic-options
+		displayName: 'Operation',
+		name: 'operation',
+		default: 'getAll',
+		type: 'options',
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		noDataExpression: true,
+		required: true,
+		displayOptions: {
+			show: {
+				resource: ['case'],
+			},
+		},
+		typeOptions: {
+			loadOptionsDependsOn: ['resource'],
+			loadOptionsMethod: 'loadCaseOptions',
+		},
+	},
+];
+
+export const caseFields: INodeProperties[] = [
+	{
+		displayName: 'Return All',
+		name: 'returnAll',
+		type: 'boolean',
+		displayOptions: {
+			show: {
+				operation: ['getAll'],
+				resource: ['case'],
+			},
+		},
+		default: false,
+		description: 'Whether to return all results or only up to a given limit',
+	},
+	{
+		displayName: 'Limit',
+		name: 'limit',
+		type: 'number',
+		displayOptions: {
+			show: {
+				operation: ['getAll'],
+				resource: ['case'],
+				returnAll: [false],
+			},
+		},
+		typeOptions: {
+			minValue: 1,
+			maxValue: 500,
+		},
+		default: 100,
+		description: 'Max number of results to return',
+	},
+	// Required fields
+	{
+		displayName: 'Case ID',
+		name: 'id',
+		type: 'string',
+		default: '',
+		required: true,
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['update', 'executeResponder', 'get'],
+			},
+		},
+		description: 'ID of the case',
+	},
+	{
+		displayName: 'Title',
+		name: 'title',
+		type: 'string',
+		default: '',
+		required: true,
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['create'],
+			},
+		},
+		description: 'Title of the case',
+	},
+	{
+		displayName: 'Description',
+		name: 'description',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['create'],
+			},
+		},
+		description: 'Description of the case',
+	},
+	{
+		displayName: 'Severity',
+		name: 'severity',
+		type: 'options',
+		options: [
+			{
+				name: 'Low',
+				value: 1,
+			},
+			{
+				name: 'Medium',
+				value: 2,
+			},
+			{
+				name: 'High',
+				value: 3,
+			},
+		],
+		required: true,
+		default: 2,
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['create'],
+			},
+		},
+		description: 'Severity of the alert. Default=Medium.',
+	},
+	{
+		displayName: 'Start Date',
+		name: 'startDate',
+		type: 'dateTime',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['create'],
+			},
+		},
+		description: 'Date and time of the begin of the case default=now',
+	},
+	{
+		displayName: 'Owner',
+		name: 'owner',
+		type: 'string',
+		default: '',
+		required: true,
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['create'],
+			},
+		},
+	},
+	{
+		displayName: 'Flag',
+		name: 'flag',
+		type: 'boolean',
+		required: true,
+		default: false,
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['create'],
+			},
+		},
+		// eslint-disable-next-line n8n-nodes-base/node-param-description-boolean-without-whether
+		description: 'Flag of the case default=false',
+	},
+	{
+		displayName: 'TLP',
+		name: 'tlp',
+		type: 'options',
+		required: true,
+		default: 2,
+		options: [
+			{
+				name: 'White',
+				value: TLPs.white,
+			},
+			{
+				name: 'Green',
+				value: TLPs.green,
+			},
+			{
+				name: 'Amber',
+				value: TLPs.amber,
+			},
+			{
+				name: 'Red',
+				value: TLPs.red,
+			},
+		],
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['create'],
+			},
+		},
+		description: 'Traffict Light Protocol (TLP). Default=Amber.',
+	},
+	{
+		displayName: 'Tags',
+		name: 'tags',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['create'],
+			},
+		},
+	},
+	// required for responder execution
+	{
+		displayName: 'Responder Name or ID',
+		name: 'responder',
+		type: 'options',
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		default: '',
+		required: true,
+		typeOptions: {
+			loadOptionsDependsOn: ['id'],
+			loadOptionsMethod: 'loadResponders',
+		},
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['executeResponder'],
+			},
+			hide: {
+				id: [''],
+			},
+		},
+	},
+	{
+		displayName: 'JSON Parameters',
+		name: 'jsonParameters',
+		type: 'boolean',
+		default: true,
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['create', 'update'],
+			},
+		},
+	},
+	// Optional fields (Create operation)
+	{
+		displayName: 'Options',
+		type: 'collection',
+		name: 'options',
+		placeholder: 'Add option',
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['create'],
+			},
+		},
+		default: {},
+		options: [
+			{
+				displayName: 'Custom Fields',
+				name: 'customFieldsUi',
+				type: 'fixedCollection',
+				default: {},
+				typeOptions: {
+					multipleValues: true,
+				},
+				displayOptions: {
+					show: {
+						'/jsonParameters': [false],
+					},
+				},
+				placeholder: 'Add Custom Field',
+				options: [
+					{
+						name: 'customFields',
+						displayName: 'Custom Field',
+						values: [
+							{
+								displayName: 'Field Name or ID',
+								name: 'field',
+								type: 'options',
+								description:
+									'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+								typeOptions: {
+									loadOptionsMethod: 'loadCustomFields',
+								},
+								default: 'Custom Field',
+							},
+							{
+								displayName: 'Value',
+								name: 'value',
+								type: 'string',
+								default: '',
+								description: 'Custom Field value. Use an expression if the type is not a string.',
+							},
+						],
+					},
+				],
+			},
+			{
+				displayName: 'Custom Fields (JSON)',
+				name: 'customFieldsJson',
+				type: 'string',
+				default: '',
+				displayOptions: {
+					show: {
+						'/jsonParameters': [true],
+					},
+				},
+				description: 'Custom fields in JSON format. Overrides Custom Fields UI if set.',
+			},
+			{
+				displayName: 'End Date',
+				name: 'endDate',
+				default: '',
+				type: 'dateTime',
+				description: 'Resolution date',
+			},
+			{
+				displayName: 'Summary',
+				name: 'summary',
+				type: 'string',
+				default: '',
+				description: 'Summary of the case, to be provided when closing a case',
+			},
+			{
+				displayName: 'Metrics (JSON)',
+				name: 'metrics',
+				default: '[]',
+				type: 'json',
+				displayOptions: {
+					show: {
+						'/jsonParameters': [true],
+					},
+				},
+				description: 'List of metrics',
+			},
+		],
+	},
+	// Optional fields (Update operations)
+	{
+		displayName: 'Update Fields',
+		type: 'collection',
+		name: 'updateFields',
+		placeholder: 'Add Field',
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['update'],
+			},
+		},
+		default: {},
+		options: [
+			{
+				displayName: 'Custom Fields',
+				name: 'customFieldsUi',
+				type: 'fixedCollection',
+				default: {},
+				typeOptions: {
+					multipleValues: true,
+				},
+				displayOptions: {
+					show: {
+						'/jsonParameters': [false],
+					},
+				},
+				placeholder: 'Add Custom Field',
+				options: [
+					{
+						name: 'customFields',
+						displayName: 'Custom Field',
+						values: [
+							{
+								displayName: 'Field Name or ID',
+								name: 'field',
+								type: 'options',
+								description:
+									'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+								typeOptions: {
+									loadOptionsMethod: 'loadCustomFields',
+								},
+								default: 'Custom Field',
+							},
+							{
+								displayName: 'Value',
+								name: 'value',
+								type: 'string',
+								default: '',
+								description: 'Custom Field value. Use an expression if the type is not a string.',
+							},
+						],
+					},
+				],
+			},
+			{
+				displayName: 'Custom Fields (JSON)',
+				name: 'customFieldsJson',
+				type: 'string',
+				default: '',
+				displayOptions: {
+					show: {
+						'/jsonParameters': [true],
+					},
+				},
+				description: 'Custom fields in JSON format. Overrides Custom Fields UI if set.',
+			},
+			{
+				displayName: 'Description',
+				name: 'description',
+				type: 'string',
+				default: '',
+				description: 'Description of the case',
+			},
+			{
+				displayName: 'End Date',
+				name: 'endDate',
+				type: 'dateTime',
+				default: '',
+				description: 'Resolution date',
+			},
+			{
+				displayName: 'Flag',
+				name: 'flag',
+				type: 'boolean',
+				default: false,
+				// eslint-disable-next-line n8n-nodes-base/node-param-description-boolean-without-whether
+				description: 'Flag of the case default=false',
+			},
+			{
+				displayName: 'Impact Status',
+				name: 'impactStatus',
+				type: 'options',
+				default: '',
+				options: [
+					{
+						name: 'No Impact',
+						value: 'NoImpact',
+					},
+					{
+						name: 'With Impact',
+						value: 'WithImpact',
+					},
+					{
+						name: 'Not Applicable',
+						value: 'NotApplicable',
+					},
+				],
+				description: 'Impact status of the case',
+			},
+			{
+				displayName: 'Metrics (JSON)',
+				name: 'metrics',
+				type: 'json',
+				default: '[]',
+				displayOptions: {
+					show: {
+						'/jsonParameters': [true],
+					},
+				},
+				description: 'List of metrics',
+			},
+			{
+				displayName: 'Owner',
+				name: 'owner',
+				type: 'string',
+				default: '',
+			},
+			{
+				displayName: 'Resolution Status',
+				name: 'resolutionStatus',
+				type: 'options',
+				default: '',
+				options: [
+					{
+						value: 'Duplicated',
+						name: 'Duplicated',
+					},
+					{
+						value: 'FalsePositive',
+						name: 'False Positive',
+					},
+					{
+						value: 'Indeterminate',
+						name: 'Indeterminate',
+					},
+					{
+						value: 'Other',
+						name: 'Other',
+					},
+					{
+						value: 'TruePositive',
+						name: 'True Positive',
+					},
+				],
+				description: 'Resolution status of the case',
+			},
+			{
+				displayName: 'Severity',
+				name: 'severity',
+				type: 'options',
+				options: [
+					{
+						name: 'Low',
+						value: 1,
+					},
+					{
+						name: 'Medium',
+						value: 2,
+					},
+					{
+						name: 'High',
+						value: 3,
+					},
+				],
+				default: 2,
+				description: 'Severity of the alert. Default=Medium.',
+			},
+			{
+				displayName: 'Start Date',
+				name: 'startDate',
+				type: 'dateTime',
+				default: '',
+				description: 'Date and time of the begin of the case default=now',
+			},
+			{
+				displayName: 'Status',
+				name: 'status',
+				type: 'options',
+				options: [
+					{
+						name: 'Open',
+						value: 'Open',
+					},
+					{
+						name: 'Resolved',
+						value: 'Resolved',
+					},
+					{
+						name: 'Deleted',
+						value: 'Deleted',
+					},
+				],
+				default: 'Open',
+			},
+			{
+				displayName: 'Summary',
+				name: 'summary',
+				type: 'string',
+				default: '',
+				description: 'Summary of the case, to be provided when closing a case',
+			},
+			{
+				displayName: 'Tags',
+				name: 'tags',
+				type: 'string',
+				default: '',
+			},
+			{
+				displayName: 'Title',
+				name: 'title',
+				type: 'string',
+				default: '',
+				description: 'Title of the case',
+			},
+			{
+				displayName: 'TLP',
+				name: 'tlp',
+				type: 'options',
+				default: 2,
+				options: [
+					{
+						name: 'White',
+						value: TLPs.white,
+					},
+					{
+						name: 'Green',
+						value: TLPs.green,
+					},
+					{
+						name: 'Amber',
+						value: TLPs.amber,
+					},
+					{
+						name: 'Red',
+						value: TLPs.red,
+					},
+				],
+				description: 'Traffict Light Protocol (TLP). Default=Amber.',
+			},
+		],
+	},
+	// query options
+	{
+		displayName: 'Options',
+		name: 'options',
+		displayOptions: {
+			show: {
+				operation: ['getAll'],
+				resource: ['case'],
+			},
+		},
+		type: 'collection',
+		placeholder: 'Add option',
+		default: {},
+		options: [
+			{
+				displayName: 'Sort',
+				name: 'sort',
+				type: 'string',
+				placeholder: '±Attribut, exp +status',
+				description: 'Specify the sorting attribut, + for asc, - for desc',
+				default: '',
+			},
+		],
+	},
+	// Query filters
+	{
+		displayName: 'Filters',
+		name: 'filters',
+		type: 'collection',
+		default: {},
+		placeholder: 'Add a Filter',
+		displayOptions: {
+			show: {
+				resource: ['case'],
+				operation: ['getAll', 'count'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Custom Fields',
+				name: 'customFieldsUi',
+				type: 'fixedCollection',
+				default: {},
+				typeOptions: {
+					multipleValues: true,
+				},
+				placeholder: 'Add Custom Field',
+				options: [
+					{
+						name: 'customFields',
+						displayName: 'Custom Field',
+						values: [
+							{
+								displayName: 'Field Name or ID',
+								name: 'field',
+								type: 'options',
+								description:
+									'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+								typeOptions: {
+									loadOptionsMethod: 'loadCustomFields',
+								},
+								default: 'Custom Field',
+							},
+							{
+								displayName: 'Value',
+								name: 'value',
+								type: 'string',
+								default: '',
+								description: 'Custom Field value. Use an expression if the type is not a string.',
+							},
+						],
+					},
+				],
+			},
+			{
+				displayName: 'Description',
+				name: 'description',
+				type: 'string',
+				default: '',
+				description: 'Description of the case',
+			},
+			{
+				displayName: 'End Date',
+				name: 'endDate',
+				type: 'dateTime',
+				default: '',
+				description: 'Resolution date',
+			},
+			{
+				displayName: 'Flag',
+				name: 'flag',
+				type: 'boolean',
+				default: false,
+				// eslint-disable-next-line n8n-nodes-base/node-param-description-boolean-without-whether
+				description: 'Flag of the case default=false',
+			},
+			{
+				displayName: 'Impact Status',
+				name: 'impactStatus',
+				type: 'options',
+				default: '',
+				options: [
+					{
+						name: 'No Impact',
+						value: 'NoImpact',
+					},
+					{
+						name: 'With Impact',
+						value: 'WithImpact',
+					},
+					{
+						name: 'Not Applicable',
+						value: 'NotApplicable',
+					},
+				],
+			},
+			{
+				displayName: 'Owner',
+				name: 'owner',
+				type: 'string',
+				default: '',
+			},
+			{
+				displayName: 'Resolution Status',
+				name: 'resolutionStatus',
+				type: 'options',
+				default: '',
+				options: [
+					{
+						value: 'Duplicated',
+						name: 'Duplicated',
+					},
+					{
+						value: 'False Positive',
+						name: 'FalsePositive',
+					},
+					{
+						value: 'Indeterminate',
+						name: 'Indeterminate',
+					},
+					{
+						value: 'Other',
+						name: 'Other',
+					},
+					{
+						value: 'True Positive',
+						name: 'TruePositive',
+					},
+				],
+			},
+			{
+				displayName: 'Severity',
+				name: 'severity',
+				type: 'options',
+				options: [
+					{
+						name: 'Low',
+						value: 1,
+					},
+					{
+						name: 'Medium',
+						value: 2,
+					},
+					{
+						name: 'High',
+						value: 3,
+					},
+				],
+				default: 2,
+				description: 'Severity of the alert. Default=Medium.',
+			},
+			{
+				displayName: 'Start Date',
+				name: 'startDate',
+				type: 'dateTime',
+				default: '',
+				description: 'Date and time of the begin of the case default=now',
+			},
+			{
+				displayName: 'Status',
+				name: 'status',
+				type: 'options',
+				options: [
+					{
+						name: 'Open',
+						value: 'Open',
+					},
+					{
+						name: 'Resolved',
+						value: 'Resolved',
+					},
+					{
+						name: 'Deleted',
+						value: 'Deleted',
+					},
+				],
+				default: 'Open',
+			},
+			{
+				displayName: 'Summary',
+				name: 'summary',
+				type: 'string',
+				default: '',
+				description: 'Summary of the case, to be provided when closing a case',
+			},
+			{
+				displayName: 'Tags',
+				name: 'tags',
+				type: 'string',
+				default: '',
+			},
+			{
+				displayName: 'Title',
+				name: 'title',
+				type: 'string',
+				default: '',
+				description: 'Title of the case',
+			},
+			{
+				displayName: 'TLP',
+				name: 'tlp',
+				type: 'options',
+				default: 2,
+				options: [
+					{
+						name: 'White',
+						value: TLPs.white,
+					},
+					{
+						name: 'Green',
+						value: TLPs.green,
+					},
+					{
+						name: 'Amber',
+						value: TLPs.amber,
+					},
+					{
+						name: 'Red',
+						value: TLPs.red,
+					},
+				],
+				description: 'Traffict Light Protocol (TLP). Default=Amber.',
+			},
+		],
+	},
+];

packages/nodes-base/nodes/TheHive/descriptions/EventsDescription.ts

@@ -0,0 +1,189 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+export const eventsDescription: INodeProperties[] = [
+	{
+		displayName: 'Events',
+		name: 'events',
+		type: 'multiOptions',
+		default: [],
+		required: true,
+		description: 'Events types',
+		displayOptions: {
+			show: {
+				'@version': [1],
+			},
+		},
+		options: [
+			{
+				name: '*',
+				value: '*',
+				description: 'Any time any event is triggered (Wildcard Event)',
+			},
+			{
+				name: 'Alert Created',
+				value: 'alert_create',
+				description: 'Triggered when an alert is created',
+			},
+			{
+				name: 'Alert Deleted',
+				value: 'alert_delete',
+				description: 'Triggered when an alert is deleted',
+			},
+			{
+				name: 'Alert Updated',
+				value: 'alert_update',
+				description: 'Triggered when an alert is updated',
+			},
+			{
+				name: 'Case Created',
+				value: 'case_create',
+				description: 'Triggered when a case is created',
+			},
+			{
+				name: 'Case Deleted',
+				value: 'case_delete',
+				description: 'Triggered when a case is deleted',
+			},
+			{
+				name: 'Case Updated',
+				value: 'case_update',
+				description: 'Triggered when a case is updated',
+			},
+			{
+				name: 'Log Created',
+				value: 'case_task_log_create',
+				description: 'Triggered when a task log is created',
+			},
+			{
+				name: 'Log Deleted',
+				value: 'case_task_log_delete',
+				description: 'Triggered when a task log is deleted',
+			},
+			{
+				name: 'Log Updated',
+				value: 'case_task_log_update',
+				description: 'Triggered when a task log is updated',
+			},
+			{
+				name: 'Observable Created',
+				value: 'case_artifact_create',
+				description: 'Triggered when an observable is created',
+			},
+			{
+				name: 'Observable Deleted',
+				value: 'case_artifact_delete',
+				description: 'Triggered when an observable is deleted',
+			},
+			{
+				name: 'Observable Updated',
+				value: 'case_artifact_update',
+				description: 'Triggered when an observable is updated',
+			},
+			{
+				name: 'Task Created',
+				value: 'case_task_create',
+				description: 'Triggered when a task is created',
+			},
+			{
+				name: 'Task Deleted',
+				value: 'case_task_delete',
+				description: 'Triggered when a task is deleted',
+			},
+			{
+				name: 'Task Updated',
+				value: 'case_task_update',
+				description: 'Triggered when a task is updated',
+			},
+		],
+	},
+	{
+		displayName: 'Events',
+		name: 'events',
+		type: 'multiOptions',
+		default: [],
+		required: true,
+		description: 'Events types',
+		displayOptions: {
+			show: {
+				'@version': [2],
+			},
+		},
+		options: [
+			{
+				name: '*',
+				value: '*',
+				description: 'Any time any event is triggered (Wildcard Event)',
+			},
+			{
+				name: 'Alert Created',
+				value: 'alert_create',
+				description: 'Triggered when an alert is created',
+			},
+			{
+				name: 'Alert Deleted',
+				value: 'alert_delete',
+				description: 'Triggered when an alert is deleted',
+			},
+			{
+				name: 'Alert Updated',
+				value: 'alert_update',
+				description: 'Triggered when an alert is updated',
+			},
+			{
+				name: 'Case Created',
+				value: 'case_create',
+				description: 'Triggered when a case is created',
+			},
+			{
+				name: 'Case Deleted',
+				value: 'case_delete',
+				description: 'Triggered when a case is deleted',
+			},
+			{
+				name: 'Case Updated',
+				value: 'case_update',
+				description: 'Triggered when a case is updated',
+			},
+			{
+				name: 'Log Created',
+				value: 'case_task_log_create',
+				description: 'Triggered when a task log is created',
+			},
+			{
+				name: 'Log Deleted',
+				value: 'case_task_log_delete',
+				description: 'Triggered when a task log is deleted',
+			},
+			{
+				name: 'Log Updated',
+				value: 'case_task_log_update',
+				description: 'Triggered when a task log is updated',
+			},
+			{
+				name: 'Observable Created',
+				value: 'case_artifact_create',
+				description: 'Triggered when an observable is created',
+			},
+			{
+				name: 'Observable Deleted',
+				value: 'case_artifact_delete',
+				description: 'Triggered when an observable is deleted',
+			},
+			{
+				name: 'Observable Updated',
+				value: 'case_artifact_update',
+				description: 'Triggered when an observable is updated',
+			},
+			{
+				name: 'Task Created',
+				value: 'case_task_create',
+				description: 'Triggered when a task is created',
+			},
+			{
+				name: 'Task Updated',
+				value: 'case_task_update',
+				description: 'Triggered when a task is updated',
+			},
+		],
+	},
+];

packages/nodes-base/nodes/TheHive/descriptions/LogDescription.ts

@@ -0,0 +1,222 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+export const logOperations: INodeProperties[] = [
+	{
+		displayName: 'Operation',
+		name: 'operation',
+		noDataExpression: true,
+		type: 'options',
+		required: true,
+		default: 'getAll',
+		displayOptions: {
+			show: {
+				resource: ['log'],
+			},
+		},
+		options: [
+			{
+				name: 'Create',
+				value: 'create',
+				description: 'Create task log',
+				action: 'Create a log',
+			},
+			{
+				name: 'Execute Responder',
+				value: 'executeResponder',
+				description: 'Execute a responder on a selected log',
+				action: 'Execute a responder',
+			},
+			{
+				name: 'Get Many',
+				value: 'getAll',
+				description: 'Get many task logs',
+				action: 'Get many logs',
+			},
+			{
+				name: 'Get',
+				value: 'get',
+				description: 'Get a single log',
+				action: 'Get a log',
+			},
+		],
+	},
+];
+
+export const logFields: INodeProperties[] = [
+	{
+		displayName: 'Task ID',
+		name: 'taskId',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['log'],
+				operation: ['create', 'getAll'],
+			},
+		},
+		description: 'ID of the task',
+	},
+	{
+		displayName: 'Return All',
+		name: 'returnAll',
+		type: 'boolean',
+		displayOptions: {
+			show: {
+				operation: ['getAll'],
+				resource: ['log'],
+			},
+		},
+		default: false,
+		description: 'Whether to return all results or only up to a given limit',
+	},
+	{
+		displayName: 'Limit',
+		name: 'limit',
+		type: 'number',
+		displayOptions: {
+			show: {
+				operation: ['getAll'],
+				resource: ['log'],
+				returnAll: [false],
+			},
+		},
+		typeOptions: {
+			minValue: 1,
+			maxValue: 500,
+		},
+		default: 100,
+		description: 'Max number of results to return',
+	},
+	// required attributs
+	{
+		displayName: 'Log ID',
+		name: 'id',
+		type: 'string',
+		default: '',
+		required: true,
+		displayOptions: {
+			show: {
+				resource: ['log'],
+				operation: ['executeResponder', 'get'],
+			},
+		},
+	},
+	{
+		displayName: 'Message',
+		name: 'message',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['log'],
+				operation: ['create'],
+			},
+		},
+		description: 'Content of the Log',
+	},
+	{
+		displayName: 'Start Date',
+		name: 'startDate',
+		type: 'dateTime',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['log'],
+				operation: ['create'],
+			},
+		},
+		description: 'Date of the log submission default=now',
+	},
+	{
+		displayName: 'Status',
+		name: 'status',
+		type: 'options',
+		options: [
+			{
+				name: 'Ok',
+				value: 'Ok',
+			},
+			{
+				name: 'Deleted',
+				value: 'Deleted',
+			},
+		],
+		default: '',
+		required: true,
+		displayOptions: {
+			show: {
+				resource: ['log'],
+				operation: ['create'],
+			},
+		},
+		description: 'Status of the log (Ok or Deleted) default=Ok',
+	},
+	// required for responder execution
+	{
+		displayName: 'Responder Name or ID',
+		name: 'responder',
+		type: 'options',
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		required: true,
+		default: '',
+		typeOptions: {
+			loadOptionsDependsOn: ['id'],
+			loadOptionsMethod: 'loadResponders',
+		},
+		displayOptions: {
+			show: {
+				resource: ['log'],
+				operation: ['executeResponder'],
+			},
+			hide: {
+				id: [''],
+			},
+		},
+	},
+	// Optional attributs
+	{
+		displayName: 'Options',
+		name: 'options',
+		type: 'collection',
+		default: {},
+		displayOptions: {
+			show: {
+				resource: ['log'],
+				operation: ['create'],
+			},
+		},
+		placeholder: 'Add option',
+		options: [
+			{
+				displayName: 'Attachment',
+				name: 'attachmentValues',
+				placeholder: 'Add Attachment',
+				type: 'fixedCollection',
+				typeOptions: {
+					multipleValues: false,
+				},
+				default: {},
+				options: [
+					{
+						displayName: 'Attachment',
+						name: 'attachmentValues',
+						values: [
+							{
+								displayName: 'Input Binary Field',
+								name: 'binaryProperty',
+								type: 'string',
+								default: 'data',
+								description: 'The name of the input binary field which holds binary data',
+							},
+						],
+					},
+				],
+				description: 'File attached to the log',
+			},
+		],
+	},
+];

packages/nodes-base/nodes/TheHive/descriptions/ObservableDescription.ts

@@ -0,0 +1,571 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+import { TLPs } from '../interfaces/AlertInterface';
+
+export const observableOperations: INodeProperties[] = [
+	{
+		displayName: 'Operation Name or ID',
+		name: 'operation',
+		type: 'options',
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		noDataExpression: true,
+		required: true,
+		default: 'getAll',
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+			},
+		},
+		typeOptions: {
+			loadOptionsDependsOn: ['resource'],
+			loadOptionsMethod: 'loadObservableOptions',
+		},
+	},
+];
+
+export const observableFields: INodeProperties[] = [
+	{
+		displayName: 'Case ID',
+		name: 'caseId',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['create', 'getAll'],
+			},
+		},
+		description: 'ID of the case',
+	},
+	{
+		displayName: 'Return All',
+		name: 'returnAll',
+		type: 'boolean',
+		displayOptions: {
+			show: {
+				operation: ['getAll', 'search'],
+				resource: ['observable'],
+			},
+		},
+		default: false,
+		description: 'Whether to return all results or only up to a given limit',
+	},
+	{
+		displayName: 'Limit',
+		name: 'limit',
+		type: 'number',
+		displayOptions: {
+			show: {
+				operation: ['getAll', 'search'],
+				resource: ['observable'],
+				returnAll: [false],
+			},
+		},
+		typeOptions: {
+			minValue: 1,
+			maxValue: 500,
+		},
+		default: 100,
+		description: 'Max number of results to return',
+	},
+	// required attributs
+	{
+		displayName: 'Observable ID',
+		name: 'id',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['update', 'executeResponder', 'executeAnalyzer', 'get'],
+			},
+		},
+		description: 'ID of the observable',
+	},
+	{
+		displayName: 'Data Type Name or ID',
+		name: 'dataType',
+		type: 'options',
+		required: true,
+		default: '',
+		typeOptions: {
+			loadOptionsMethod: 'loadObservableTypes',
+		},
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['create', 'executeAnalyzer'],
+			},
+		},
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+	},
+	{
+		displayName: 'Data',
+		name: 'data',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['create'],
+			},
+			hide: {
+				dataType: ['file'],
+			},
+		},
+	},
+	{
+		displayName: 'Input Binary Field',
+		name: 'binaryProperty',
+		type: 'string',
+		required: true,
+		default: 'data',
+		description: 'The name of the input binary field that represent the attachment file',
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['create'],
+				dataType: ['file'],
+			},
+		},
+	},
+	{
+		displayName: 'Message',
+		name: 'message',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['create'],
+			},
+		},
+		description: 'Description of the observable in the context of the case',
+	},
+	{
+		displayName: 'Start Date',
+		name: 'startDate',
+		type: 'dateTime',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['create'],
+			},
+		},
+		description: 'Date and time of the begin of the case default=now',
+	},
+	{
+		displayName: 'TLP',
+		name: 'tlp',
+		type: 'options',
+		required: true,
+		default: 2,
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['create'],
+			},
+		},
+		options: [
+			{
+				name: 'White',
+				value: TLPs.white,
+			},
+			{
+				name: 'Green',
+				value: TLPs.green,
+			},
+			{
+				name: 'Amber',
+				value: TLPs.amber,
+			},
+			{
+				name: 'Red',
+				value: TLPs.red,
+			},
+		],
+		description: 'Traffict Light Protocol (TLP). Default=Amber.',
+	},
+	{
+		displayName: 'IOC',
+		name: 'ioc',
+		type: 'boolean',
+		required: true,
+		default: false,
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['create'],
+			},
+		},
+		description: 'Whether the observable is an IOC (Indicator of compromise)',
+	},
+	{
+		displayName: 'Sighted',
+		name: 'sighted',
+		type: 'boolean',
+		required: true,
+		default: false,
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['create'],
+			},
+		},
+		description: 'Whether sighted previously',
+	},
+	{
+		displayName: 'Status',
+		name: 'status',
+		type: 'options',
+		required: true,
+		default: '',
+		options: [
+			{
+				name: 'Ok',
+				value: 'Ok',
+			},
+			{
+				name: 'Deleted',
+				value: 'Deleted',
+			},
+		],
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['create'],
+			},
+		},
+		description: 'Status of the observable. Default=Ok.',
+	},
+	// required for analyzer execution
+	{
+		displayName: 'Analyzer Names or IDs',
+		name: 'analyzers',
+		type: 'multiOptions',
+		description:
+			'Choose from the list, or specify IDs using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		required: true,
+		default: [],
+		typeOptions: {
+			loadOptionsDependsOn: ['id', 'dataType'],
+			loadOptionsMethod: 'loadAnalyzers',
+		},
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['executeAnalyzer'],
+			},
+			hide: {
+				id: [''],
+			},
+		},
+	},
+
+	// required for responder execution
+	{
+		displayName: 'Responder Name or ID',
+		name: 'responder',
+		type: 'options',
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		required: true,
+		default: '',
+		typeOptions: {
+			loadOptionsDependsOn: ['id'],
+			loadOptionsMethod: 'loadResponders',
+		},
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['executeResponder'],
+			},
+			hide: {
+				id: [''],
+			},
+		},
+	},
+	// Optional attributes (Create operation)
+	{
+		displayName: 'Options',
+		name: 'options',
+		type: 'collection',
+		placeholder: 'Add option',
+		default: {},
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['create'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Observable Tags',
+				name: 'tags',
+				type: 'string',
+				default: '',
+				placeholder: 'tag1,tag2',
+			},
+		],
+	},
+	// Optional attributes (Update operation)
+	{
+		displayName: 'Update Fields',
+		name: 'updateFields',
+		type: 'collection',
+		default: {},
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['update'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Message',
+				name: 'message',
+				type: 'string',
+				default: '',
+				description: 'Description of the observable in the context of the case',
+			},
+			{
+				displayName: 'Observable Tags',
+				name: 'tags',
+				type: 'string',
+				default: '',
+				placeholder: 'tag1,tag2',
+			},
+			{
+				displayName: 'TLP',
+				name: 'tlp',
+				type: 'options',
+				default: 2,
+				options: [
+					{
+						name: 'White',
+						value: TLPs.white,
+					},
+					{
+						name: 'Green',
+						value: TLPs.green,
+					},
+					{
+						name: 'Amber',
+						value: TLPs.amber,
+					},
+					{
+						name: 'Red',
+						value: TLPs.red,
+					},
+				],
+				description: 'Traffict Light Protocol (TLP). Default=Amber.',
+			},
+			{
+				displayName: 'IOC',
+				name: 'ioc',
+				type: 'boolean',
+				default: false,
+				description: 'Whether the observable is an IOC (Indicator of compromise)',
+			},
+			{
+				displayName: 'Sighted',
+				name: 'sighted',
+				description: 'Whether sighted previously',
+				type: 'boolean',
+				default: false,
+			},
+			{
+				displayName: 'Status',
+				name: 'status',
+				type: 'options',
+				default: '',
+				options: [
+					{
+						name: 'Ok',
+						value: 'Ok',
+					},
+					{
+						name: 'Deleted',
+						value: 'Deleted',
+					},
+				],
+				description: 'Status of the observable. Default=Ok.',
+			},
+		],
+	},
+	// query options
+	{
+		displayName: 'Options',
+		name: 'options',
+		displayOptions: {
+			show: {
+				operation: ['getAll', 'search'],
+				resource: ['observable'],
+			},
+		},
+		type: 'collection',
+		placeholder: 'Add option',
+		default: {},
+		options: [
+			{
+				displayName: 'Sort',
+				name: 'sort',
+				type: 'string',
+				placeholder: '±Attribut, exp +status',
+				description: 'Specify the sorting attribut, + for asc, - for desc',
+				default: '',
+			},
+		],
+	},
+	// query attributes
+	{
+		displayName: 'Filters',
+		name: 'filters',
+		type: 'collection',
+		default: {},
+		placeholder: 'Add Filter',
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+				operation: ['search', 'count'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Data Type Names or IDs',
+				name: 'dataType',
+				type: 'multiOptions',
+				default: [],
+				typeOptions: {
+					loadOptionsMethod: 'loadObservableTypes',
+				},
+				description:
+					'Choose from the list, or specify IDs using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+			},
+			{
+				displayName: 'Date Range',
+				type: 'fixedCollection',
+				name: 'range',
+				default: {},
+				options: [
+					{
+						displayName: 'Add Date Range Inputs',
+						name: 'dateRange',
+						values: [
+							{
+								displayName: 'From Date',
+								name: 'fromDate',
+								type: 'dateTime',
+								default: '',
+							},
+							{
+								displayName: 'To Date',
+								name: 'toDate',
+								type: 'dateTime',
+								default: '',
+							},
+						],
+					},
+				],
+			},
+			{
+				displayName: 'Description',
+				name: 'description',
+				type: 'string',
+				default: '',
+				placeholder: 'exp,freetext',
+			},
+			{
+				displayName: 'IOC',
+				name: 'ioc',
+				type: 'boolean',
+				default: false,
+				description: 'Whether the observable is an IOC (Indicator of compromise)',
+			},
+			{
+				displayName: 'Keyword',
+				name: 'keyword',
+				type: 'string',
+				default: '',
+				placeholder: 'exp,freetext',
+			},
+			{
+				displayName: 'Message',
+				name: 'message',
+				type: 'string',
+				default: '',
+				description: 'Description of the observable in the context of the case',
+			},
+			{
+				displayName: 'Observable Tags',
+				name: 'tags',
+				type: 'string',
+				default: '',
+				placeholder: 'tag1,tag2',
+			},
+			{
+				displayName: 'Sighted',
+				name: 'sighted',
+				type: 'boolean',
+				default: false,
+			},
+			{
+				displayName: 'Status',
+				name: 'Status',
+				type: 'options',
+				default: '',
+				options: [
+					{
+						name: 'Ok',
+						value: 'Ok',
+					},
+					{
+						name: 'Deleted',
+						value: 'Deleted',
+					},
+				],
+				description: 'Status of the observable. Default=Ok.',
+			},
+			{
+				displayName: 'TLP',
+				name: 'tlp',
+				type: 'options',
+				default: 2,
+				options: [
+					{
+						name: 'White',
+						value: TLPs.white,
+					},
+					{
+						name: 'Green',
+						value: TLPs.green,
+					},
+					{
+						name: 'Amber',
+						value: TLPs.amber,
+					},
+					{
+						name: 'Red',
+						value: TLPs.red,
+					},
+				],
+				description: 'Traffict Light Protocol (TLP). Default=Amber.',
+			},
+			{
+				displayName: 'Value',
+				name: 'data',
+				type: 'string',
+				default: '',
+				placeholder: 'example.com; 8.8.8.8',
+			},
+		],
+	},
+];

packages/nodes-base/nodes/TheHive/descriptions/TaskDescription.ts

@@ -0,0 +1,412 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+export const taskOperations: INodeProperties[] = [
+	{
+		displayName: 'Operation Name or ID',
+		name: 'operation',
+		default: 'getAll',
+		type: 'options',
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		noDataExpression: true,
+		required: true,
+		displayOptions: {
+			show: {
+				resource: ['task'],
+			},
+		},
+		typeOptions: {
+			loadOptionsDependsOn: ['operation'],
+			loadOptionsMethod: 'loadTaskOptions',
+		},
+	},
+];
+
+export const taskFields: INodeProperties[] = [
+	{
+		displayName: 'Task ID',
+		name: 'id',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['task'],
+				operation: ['update', 'executeResponder', 'get'],
+			},
+		},
+		description: 'ID of the taks',
+	},
+	{
+		displayName: 'Case ID',
+		name: 'caseId',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['task'],
+				operation: ['create', 'getAll'],
+			},
+		},
+	},
+	{
+		displayName: 'Return All',
+		name: 'returnAll',
+		type: 'boolean',
+		displayOptions: {
+			show: {
+				operation: ['search', 'getAll'],
+				resource: ['task'],
+			},
+		},
+		default: false,
+		description: 'Whether to return all results or only up to a given limit',
+	},
+	{
+		displayName: 'Limit',
+		name: 'limit',
+		type: 'number',
+		displayOptions: {
+			show: {
+				operation: ['search', 'getAll'],
+				resource: ['task'],
+				returnAll: [false],
+			},
+		},
+		typeOptions: {
+			minValue: 1,
+			maxValue: 500,
+		},
+		default: 100,
+		description: 'Max number of results to return',
+	},
+	{
+		displayName: 'Title',
+		name: 'title',
+		type: 'string',
+		required: true,
+		default: '',
+		displayOptions: {
+			show: {
+				resource: ['task'],
+				operation: ['create'],
+			},
+		},
+		description: 'Task details',
+	},
+	{
+		displayName: 'Status',
+		name: 'status',
+		type: 'options',
+		default: 'Waiting',
+		options: [
+			{
+				name: 'Cancel',
+				value: 'Cancel',
+			},
+			{
+				name: 'Completed',
+				value: 'Completed',
+			},
+			{
+				name: 'InProgress',
+				value: 'InProgress',
+			},
+			{
+				name: 'Waiting',
+				value: 'Waiting',
+			},
+		],
+		required: true,
+		displayOptions: {
+			show: {
+				resource: ['task'],
+				operation: ['create'],
+			},
+		},
+		description: 'Status of the task. Default=Waiting.',
+	},
+	{
+		displayName: 'Flag',
+		name: 'flag',
+		type: 'boolean',
+		required: true,
+		default: false,
+		displayOptions: {
+			show: {
+				resource: ['task'],
+				operation: ['create'],
+			},
+		},
+		description: 'Whether to flag the task. Default=false.',
+	},
+	// required for responder execution
+	{
+		displayName: 'Responder Name or ID',
+		name: 'responder',
+		type: 'options',
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		required: true,
+		default: '',
+		typeOptions: {
+			loadOptionsDependsOn: ['id'],
+			loadOptionsMethod: 'loadResponders',
+		},
+		displayOptions: {
+			show: {
+				resource: ['task'],
+				operation: ['executeResponder'],
+			},
+			hide: {
+				id: [''],
+			},
+		},
+	},
+	// optional attributes (Create operations)
+	{
+		displayName: 'Options',
+		type: 'collection',
+		name: 'options',
+		placeholder: 'Add option',
+		default: {},
+		displayOptions: {
+			show: {
+				resource: ['task'],
+				operation: ['create'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Description',
+				name: 'description',
+				type: 'string',
+				default: '',
+				description: 'Task details',
+			},
+			{
+				displayName: 'End Date',
+				name: 'endDate',
+				type: 'dateTime',
+				default: '',
+				description:
+					'Date of the end of the task. This is automatically set when status is set to Completed.',
+			},
+			{
+				displayName: 'Owner',
+				name: 'owner',
+				type: 'string',
+				default: '',
+				description:
+					'User who owns the task. This is automatically set to current user when status is set to InProgress.',
+			},
+			{
+				displayName: 'Start Date',
+				name: 'startDate',
+				type: 'dateTime',
+				default: '',
+				description:
+					'Date of the beginning of the task. This is automatically set when status is set to Open.',
+			},
+		],
+	},
+	// optional attributes (Update operation)
+
+	{
+		displayName: 'Update Fields',
+		type: 'collection',
+		name: 'updateFields',
+		placeholder: 'Add Field',
+		default: {},
+		displayOptions: {
+			show: {
+				resource: ['task'],
+				operation: ['update'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Description',
+				name: 'description',
+				type: 'string',
+				default: '',
+				description: 'Task details',
+			},
+			{
+				displayName: 'End Date',
+				name: 'endDate',
+				type: 'dateTime',
+				default: '',
+				description:
+					'Date of the end of the task. This is automatically set when status is set to Completed.',
+			},
+			{
+				displayName: 'Flag',
+				name: 'flag',
+				type: 'boolean',
+				default: false,
+				description: 'Whether to flag the task. Default=false.',
+			},
+			{
+				displayName: 'Owner',
+				name: 'owner',
+				type: 'string',
+				default: '',
+				description:
+					'User who owns the task. This is automatically set to current user when status is set to InProgress.',
+			},
+			{
+				displayName: 'Start Date',
+				name: 'startDate',
+				type: 'dateTime',
+				default: '',
+				description:
+					'Date of the beginning of the task. This is automatically set when status is set to Open.',
+			},
+			{
+				displayName: 'Status',
+				name: 'status',
+				type: 'options',
+				default: 'Waiting',
+				options: [
+					{
+						name: 'Cancel',
+						value: 'Cancel',
+					},
+					{
+						name: 'Completed',
+						value: 'Completed',
+					},
+					{
+						name: 'In Progress',
+						value: 'InProgress',
+					},
+					{
+						name: 'Waiting',
+						value: 'Waiting',
+					},
+				],
+				description: 'Status of the task. Default=Waiting.',
+			},
+			{
+				displayName: 'Title',
+				name: 'title',
+				type: 'string',
+				default: '',
+				description: 'Task details',
+			},
+		],
+	},
+
+	// query options
+	{
+		displayName: 'Options',
+		name: 'options',
+		placeholder: 'Add option',
+		type: 'collection',
+		default: {},
+		displayOptions: {
+			show: {
+				operation: ['getAll', 'search'],
+				resource: ['task'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Sort',
+				name: 'sort',
+				type: 'string',
+				placeholder: '±Attribut, exp +status',
+				description: 'Specify the sorting attribut, + for asc, - for desc',
+				default: '',
+			},
+		],
+	},
+	// query attributes
+	{
+		displayName: 'Filters',
+		name: 'filters',
+		type: 'collection',
+		default: {},
+		placeholder: 'Add Filter',
+		displayOptions: {
+			show: {
+				resource: ['task'],
+				operation: ['search', 'count'],
+			},
+		},
+		options: [
+			{
+				displayName: 'Description',
+				name: 'description',
+				type: 'string',
+				default: '',
+				description: 'Task details',
+			},
+			{
+				displayName: 'End Date',
+				name: 'endDate',
+				type: 'dateTime',
+				default: '',
+				description:
+					'Date of the end of the task. This is automatically set when status is set to Completed.',
+			},
+			{
+				displayName: 'Flag',
+				name: 'flag',
+				type: 'boolean',
+				default: false,
+				description: 'Whether to flag the task. Default=false.',
+			},
+			{
+				displayName: 'Owner',
+				name: 'owner',
+				type: 'string',
+				default: '',
+				description:
+					'User who owns the task. This is automatically set to current user when status is set to InProgress.',
+			},
+			{
+				displayName: 'Start Date',
+				name: 'startDate',
+				type: 'dateTime',
+				default: '',
+				description:
+					'Date of the beginning of the task. This is automatically set when status is set to Open.',
+			},
+			{
+				displayName: 'Status',
+				name: 'status',
+				type: 'options',
+				default: 'Waiting',
+				options: [
+					{
+						name: 'Cancel',
+						value: 'Cancel',
+					},
+					{
+						name: 'Completed',
+						value: 'Completed',
+					},
+					{
+						name: 'In Progress',
+						value: 'InProgress',
+					},
+					{
+						name: 'Waiting',
+						value: 'Waiting',
+					},
+				],
+				description: 'Status of the task. Default=Waiting.',
+			},
+			{
+				displayName: 'Title',
+				name: 'title',
+				type: 'string',
+				default: '',
+				description: 'Task details',
+			},
+		],
+	},
+];

packages/nodes-base/nodes/TheHive/interfaces/AlertInterface.ts

@@ -0,0 +1,48 @@
+import type { IDataObject } from 'n8n-workflow';
+
+export const AlertStatuses = {
+	NEW: 'New',
+	UPDATED: 'Updated',
+	IGNORED: 'Ignored',
+	IMPORTED: 'Imported',
+} as const;
+
+export type AlertStatus = (typeof AlertStatuses)[keyof typeof AlertStatuses];
+
+export const TLPs = {
+	white: 0,
+	green: 1,
+	amber: 2,
+	red: 3,
+} as const;
+
+export type TLP = (typeof TLPs)[keyof typeof TLPs];
+
+export interface IAlert {
+	// Required attributes
+	id?: string;
+	title?: string;
+	description?: string;
+	severity?: number;
+	date?: Date;
+	tags?: string[];
+	tlp?: TLP;
+	status?: AlertStatus;
+	type?: string;
+	source?: string;
+	sourceRef?: string;
+	artifacts?: IDataObject[];
+	follow?: boolean;
+
+	// Optional attributes
+	caseTemplate?: string;
+
+	// Backend generated attributes
+	lastSyncDate?: Date;
+	case?: string;
+
+	createdBy?: string;
+	createdAt?: Date;
+	updatedBy?: string;
+	upadtedAt?: Date;
+}

packages/nodes-base/nodes/TheHive/interfaces/CaseInterface.ts

@@ -0,0 +1,60 @@
+import type { IDataObject } from 'n8n-workflow';
+
+import type { TLP } from './AlertInterface';
+export interface ICase {
+	// Required attributes
+	id?: string;
+	title?: string;
+	description?: string;
+	severity?: number;
+	startDate?: Date;
+	owner?: string;
+	flag?: boolean;
+	tlp?: TLP;
+	tags?: string[];
+
+	// Optional attributes
+	resolutionStatus?: CaseResolutionStatus;
+	impactStatus?: CaseImpactStatus;
+	summary?: string;
+	endDate?: Date;
+	metrics?: IDataObject;
+
+	// Backend generated attributes
+	status?: CaseStatus;
+	caseId?: number; // auto-generated attribute
+	mergeInto?: string;
+	mergeFrom?: string[];
+
+	createdBy?: string;
+	createdAt?: Date;
+	updatedBy?: string;
+	upadtedAt?: Date;
+}
+
+export const CaseStatuses = {
+	OPEN: 'Open',
+	RESOLVED: 'Resolved',
+	DELETED: 'Deleted',
+} as const;
+
+export type CaseStatus = (typeof CaseStatuses)[keyof typeof CaseStatuses];
+
+export const CaseResolutionStatuses = {
+	INDETERMINATE: 'Indeterminate',
+	FALSEPOSITIVE: 'FalsePositive',
+	TRUEPOSITIVE: 'TruePositive',
+	OTHER: 'Other',
+	DUPLICATED: 'Duplicated',
+} as const;
+
+export type CaseResolutionStatus =
+	(typeof CaseResolutionStatuses)[keyof typeof CaseResolutionStatuses];
+
+export const CaseImpactStatuses = {
+	NOIMPACT: 'NoImpact',
+	WITHIMPACT: 'WithImpact',
+	NOTAPPLICABLE: 'NotApplicable',
+} as const;
+
+export type CaseImpactStatus = (typeof CaseImpactStatuses)[keyof typeof CaseImpactStatuses];

packages/nodes-base/nodes/TheHive/interfaces/LogInterface.ts

@@ -0,0 +1,26 @@
+import type { IAttachment } from './ObservableInterface';
+
+export const LogStatuses = {
+	OK: 'Ok',
+	DELETED: 'Deleted',
+} as const;
+
+export type LogStatus = (typeof LogStatuses)[keyof typeof LogStatuses];
+
+export interface ILog {
+	// Required attributes
+	id?: string;
+	message?: string;
+	startDate?: Date;
+	status?: LogStatus;
+
+	// Optional attributes
+	attachment?: IAttachment;
+
+	// Backend generated attributes
+
+	createdBy?: string;
+	createdAt?: Date;
+	updatedBy?: string;
+	upadtedAt?: Date;
+}

packages/nodes-base/nodes/TheHive/interfaces/ObservableInterface.ts

@@ -0,0 +1,55 @@
+import type { TLP } from './AlertInterface';
+
+export const ObservableStatuses = {
+	OK: 'Ok',
+	DELETED: 'Deleted',
+} as const;
+
+export type ObservableStatus = (typeof ObservableStatuses)[keyof typeof ObservableStatuses];
+
+export const ObservableDataTypes = {
+	domain: 'domain',
+	file: 'file',
+	filename: 'filename',
+	fqdn: 'fqdn',
+	hash: 'hash',
+	ip: 'ip',
+	mail: 'mail',
+	mail_subject: 'mail_subject',
+	other: 'other',
+	regexp: 'regexp',
+	registry: 'registry',
+	uri_path: 'uri_path',
+	url: 'url',
+	'user-agent': 'user-agent',
+} as const;
+
+export type ObservableDataType = (typeof ObservableDataTypes)[keyof typeof ObservableDataTypes];
+
+export interface IAttachment {
+	name?: string;
+	size?: number;
+	id?: string;
+	contentType?: string;
+	hashes: string[];
+}
+export interface IObservable {
+	// Required attributes
+	id?: string;
+	data?: string;
+	attachment?: IAttachment;
+	dataType?: ObservableDataType;
+	message?: string;
+	startDate?: Date;
+	tlp?: TLP;
+	ioc?: boolean;
+	status?: ObservableStatus;
+	// Optional attributes
+	tags: string[];
+	// Backend generated attributes
+
+	createdBy?: string;
+	createdAt?: Date;
+	updatedBy?: string;
+	upadtedAt?: Date;
+}

packages/nodes-base/nodes/TheHive/interfaces/TaskInterface.ts

@@ -0,0 +1,27 @@
+export interface ITask {
+	// Required attributes
+	id?: string;
+	title?: string;
+	status?: TaskStatus;
+	flag?: boolean;
+	// Optional attributes
+	owner?: string;
+	description?: string;
+	startDate?: Date;
+	endDate?: Date;
+	// Backend generated attributes
+
+	createdBy?: string;
+	createdAt?: Date;
+	updatedBy?: string;
+	upadtedAt?: Date;
+}
+
+export const TaskStatuses = {
+	WAITING: 'Waiting',
+	INPROGRESS: 'InProgress',
+	COMPLETED: 'Completed',
+	CANCEL: 'Cancel',
+} as const;
+
+export type TaskStatus = (typeof TaskStatuses)[keyof typeof TaskStatuses];

packages/nodes-base/nodes/TheHive/thehive.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" id="Layer_1" data-name="Layer 1" viewBox="0 0 300 300"><defs><style>.cls-2{fill:#fff}</style></defs><path fill="#f3d02f" d="M290 150A140 140 0 1 1 150 10a140 140 0 0 1 140 140"/><path d="M204.62 210.6a15.1 15.1 0 0 1-6.68 1.38 17.49 17.49 0 0 1-16.11-10.93l-4.83-11.6-7.31-18.28a5.05 5.05 0 0 0-.7-2.12l-10.1-25.31c16.15 2.86 45.93 20.16 55.68 43.72 3.48 9.49-.76 19.66-9.9 23.14m-54.87 27.21c-11.58 0-21-8.5-24.85-21.5l49.85.16c-3.9 13.33-13.41 21.38-25 21.34m-48-26.14a14.3 14.3 0 0 1-6.67-1.43c-8.76-3.89-13.29-14.09-9.4-22.85 9.91-23.85 39.81-40.95 56-43.36L131 170l-7.79 19.29-5 11.57a18.34 18.34 0 0 1-16.53 10.83m42.63-45.16 5.69-13.69 5.57 13.71zm-7.79 19.29 3.19-8.06 20.37.07 3.13 8.08zm-5 11.57 36.17.12 3.13 8.09-42.48-.15zm18.56-90.87c9.48 0 17.53 9.18 17.5 16.56 0 8.77-14.43 9.43-17.23 9.41-3.16 0-17.21-.4-17.18-9.53-.67-7.38 7.43-16.48 16.91-16.44m-13.2-.42a3.75 3.75 0 0 1-3.39-2.15l-5.81-12.34a3.74 3.74 0 1 1 6.77-3.19l5.81 12.34a3.74 3.74 0 0 1-1.79 5 3.8 3.8 0 0 1-1.59.36m26.24-.02a3.8 3.8 0 0 1-1.59-.36 3.74 3.74 0 0 1-1.79-5l5.82-12.35a3.74 3.74 0 1 1 6.77 3.2L166.51 104a3.75 3.75 0 0 1-3.39 2.15" class="cls-2"/><path d="M204.36 157.81a3.74 3.74 0 0 1-3.26-5.56l14.41-25.87-32.87-56.7h-65.28L84.54 126.3l15.66 25.83a3.74 3.74 0 0 1-6.4 3.87L77 128.28a3.72 3.72 0 0 1 0-3.81l35-60.41a3.77 3.77 0 0 1 3.24-1.87h69.6a3.75 3.75 0 0 1 3.16 1.87l35 60.41a3.73 3.73 0 0 1 0 3.7l-15.44 27.72a3.75 3.75 0 0 1-3.28 1.92" class="cls-2"/></svg>