first commit

packages/nodes-base/nodes/TheHiveProject/actions/alert/create.operation.ts

@@ -0,0 +1,196 @@
+import FormData from 'form-data';
+import set from 'lodash/set';
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { observableTypeOptions } from '../../descriptions';
+import { fixFieldType, prepareInputItem, splitAndTrim } from '../../helpers/utils';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		displayName: 'Fields',
+		name: 'alertFields',
+		type: 'resourceMapper',
+		default: {
+			mappingMode: 'defineBelow',
+			value: null,
+		},
+		noDataExpression: true,
+		required: true,
+		typeOptions: {
+			resourceMapper: {
+				resourceMapperMethod: 'getAlertFields',
+				mode: 'add',
+				valuesLabel: 'Fields',
+			},
+		},
+	},
+	{
+		displayName: 'Observables',
+		name: 'observableUi',
+		type: 'fixedCollection',
+		placeholder: 'Add Observable',
+		default: {},
+		typeOptions: {
+			multipleValues: true,
+		},
+		options: [
+			{
+				displayName: 'Values',
+				name: 'values',
+				values: [
+					observableTypeOptions,
+					{
+						displayName: 'Data',
+						name: 'data',
+						type: 'string',
+						displayOptions: {
+							hide: {
+								dataType: ['file'],
+							},
+						},
+						default: '',
+					},
+					{
+						displayName: 'Input Binary Field',
+						name: 'binaryProperty',
+						type: 'string',
+						hint: 'The name of the input binary field containing the file to be written',
+						displayOptions: {
+							show: {
+								dataType: ['file'],
+							},
+						},
+						default: 'data',
+					},
+					{
+						displayName: 'Message',
+						name: 'message',
+						type: 'string',
+						default: '',
+					},
+					{
+						displayName: 'Tags',
+						name: 'tags',
+						type: 'string',
+						default: '',
+					},
+				],
+			},
+		],
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['alert'],
+		operation: ['create'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(
+	this: IExecuteFunctions,
+	i: number,
+	item: INodeExecutionData,
+): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+	let inputData: IDataObject = {};
+
+	const dataMode = this.getNodeParameter('alertFields.mappingMode', i) as string;
+
+	if (dataMode === 'autoMapInputData') {
+		const schema = this.getNodeParameter('alertFields.schema', i) as IDataObject[];
+		inputData = prepareInputItem(item.json, schema, i);
+	}
+
+	if (dataMode === 'defineBelow') {
+		const alertFields = this.getNodeParameter('alertFields.value', i, []) as IDataObject;
+		inputData = alertFields;
+	}
+
+	inputData = fixFieldType(inputData);
+
+	const body: IDataObject = {};
+
+	for (const field of Object.keys(inputData)) {
+		// use set to construct the updateBody, as it allows to process customFields.fieldName
+		// if customFields provided under customFields property, it will be send as is
+		set(body, field, inputData[field]);
+	}
+
+	let multiPartRequest = false;
+	const formData = new FormData();
+
+	const observableUi = this.getNodeParameter('observableUi', i) as IDataObject;
+	if (observableUi) {
+		const values = observableUi.values as IDataObject[];
+
+		if (values) {
+			const observables = [];
+
+			for (const value of values) {
+				const observable: IDataObject = {};
+
+				observable.dataType = value.dataType as string;
+				observable.message = value.message as string;
+				observable.tags = splitAndTrim(value.tags as string);
+
+				if (value.dataType === 'file') {
+					multiPartRequest = true;
+
+					const attachmentIndex = `attachment${i}`;
+					observable.attachment = attachmentIndex;
+
+					const binaryPropertyName = value.binaryProperty as string;
+					const binaryData = this.helpers.assertBinaryData(i, binaryPropertyName);
+					const dataBuffer = await this.helpers.getBinaryDataBuffer(i, binaryPropertyName);
+
+					formData.append(attachmentIndex, dataBuffer, {
+						filename: binaryData.fileName,
+						contentType: binaryData.mimeType,
+					});
+				} else {
+					observable.data = value.data as string;
+				}
+
+				observables.push(observable);
+			}
+			body.observables = observables;
+		}
+	}
+
+	if (multiPartRequest) {
+		formData.append('_json', JSON.stringify(body));
+		responseData = await theHiveApiRequest.call(
+			this,
+			'POST',
+			'/v1/alert',
+			undefined,
+			undefined,
+			undefined,
+			{
+				Headers: {
+					'Content-Type': 'multipart/form-data',
+				},
+				formData,
+			},
+		);
+	} else {
+		responseData = await theHiveApiRequest.call(this, 'POST', '/v1/alert' as string, body);
+	}
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/alert/deleteAlert.operation.ts

@@ -0,0 +1,29 @@
+import type { IExecuteFunctions, INodeExecutionData, INodeProperties } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { alertRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [alertRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['alert'],
+		operation: ['deleteAlert'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const alertId = this.getNodeParameter('alertId', i, '', { extractValue: true }) as string;
+
+	await theHiveApiRequest.call(this, 'DELETE', `/v1/alert/${alertId}`);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData({ success: true }), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/alert/executeResponder.operation.ts

@@ -0,0 +1,78 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { alertRLC, responderOptions } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [{ ...alertRLC, name: 'id' }, responderOptions];
+
+const displayOptions = {
+	show: {
+		resource: ['alert'],
+		operation: ['executeResponder'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const alertId = this.getNodeParameter('id', i, '', { extractValue: true }) as string;
+	const responderId = this.getNodeParameter('responder', i) as string;
+	let body: IDataObject;
+	let response;
+	responseData = [];
+	body = {
+		responderId,
+		objectId: alertId,
+		objectType: 'alert',
+	};
+	response = await theHiveApiRequest.call(this, 'POST', '/connector/cortex/action' as string, body);
+	body = {
+		query: [
+			{
+				_name: 'listAction',
+			},
+			{
+				_name: 'filter',
+				_and: [
+					{
+						_field: 'cortexId',
+						_value: response.cortexId,
+					},
+					{
+						_field: 'objectId',
+						_value: response.objectId,
+					},
+					{
+						_field: 'startDate',
+						_value: response.startDate,
+					},
+				],
+			},
+		],
+	};
+
+	const qs: IDataObject = {};
+
+	qs.name = 'log-actions';
+
+	do {
+		response = await theHiveApiRequest.call(this, 'POST', '/v1/query', body, qs);
+	} while (response.status === 'Waiting' || response.status === 'InProgress');
+
+	responseData = response;
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/alert/get.operation.ts

@@ -0,0 +1,100 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { alertRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	alertRLC,
+	{
+		displayName: 'Options',
+		name: 'options',
+		type: 'collection',
+		placeholder: 'Add option',
+		default: {},
+		options: [
+			{
+				displayName: 'Include Similar Alerts',
+				name: 'includeSimilarAlerts',
+				type: 'boolean',
+				description: 'Whether to include similar cases',
+				default: false,
+			},
+			{
+				displayName: 'Include Similar Cases',
+				name: 'includeSimilarCases',
+				type: 'boolean',
+				description: 'Whether to include similar cases',
+				default: false,
+			},
+		],
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['alert'],
+		operation: ['get'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject;
+
+	const alertId = this.getNodeParameter('alertId', i, '', { extractValue: true }) as string;
+	const options = this.getNodeParameter('options', i, {});
+
+	responseData = await theHiveApiRequest.call(this, 'GET', `/v1/alert/${alertId}`);
+
+	if (responseData && options.includeSimilarAlerts) {
+		const similarAlerts = await theHiveApiRequest.call(this, 'POST', '/v1/query', {
+			query: [
+				{
+					_name: 'getAlert',
+					idOrName: alertId,
+				},
+				{
+					_name: 'similarAlerts',
+				},
+			],
+		});
+
+		responseData = {
+			...responseData,
+			similarAlerts,
+		};
+	}
+
+	if (responseData && options.includeSimilarCases) {
+		const similarCases = await theHiveApiRequest.call(this, 'POST', '/v1/query', {
+			query: [
+				{
+					_name: 'getAlert',
+					idOrName: alertId,
+				},
+				{
+					_name: 'similarCases',
+				},
+			],
+		});
+
+		responseData = {
+			...responseData,
+			similarCases,
+		};
+	}
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/alert/index.ts

@@ -0,0 +1,85 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+import * as create from './create.operation';
+import * as deleteAlert from './deleteAlert.operation';
+import * as executeResponder from './executeResponder.operation';
+import * as get from './get.operation';
+import * as merge from './merge.operation';
+import * as promote from './promote.operation';
+import * as search from './search.operation';
+import * as status from './status.operation';
+import * as update from './update.operation';
+
+export { create, executeResponder, deleteAlert, get, search, status, merge, promote, update };
+
+export const description: INodeProperties[] = [
+	{
+		displayName: 'Operation',
+		name: 'operation',
+		type: 'options',
+		noDataExpression: true,
+		required: true,
+		options: [
+			{
+				name: 'Create',
+				value: 'create',
+				action: 'Create an alert',
+			},
+			{
+				name: 'Delete',
+				value: 'deleteAlert',
+				action: 'Delete an alert',
+			},
+			{
+				name: 'Execute Responder',
+				value: 'executeResponder',
+				action: 'Execute responder on an alert',
+			},
+			{
+				name: 'Get',
+				value: 'get',
+				action: 'Get an alert',
+			},
+			{
+				name: 'Merge Into Case',
+				value: 'merge',
+				action: 'Merge an alert into a case',
+			},
+			{
+				name: 'Promote to Case',
+				value: 'promote',
+				action: 'Promote an alert to a case',
+			},
+			{
+				name: 'Search',
+				value: 'search',
+				action: 'Search alerts',
+			},
+			{
+				name: 'Update',
+				value: 'update',
+				action: 'Update an alert',
+			},
+			{
+				name: 'Update Status',
+				value: 'status',
+				action: 'Update an alert status',
+			},
+		],
+		displayOptions: {
+			show: {
+				resource: ['alert'],
+			},
+		},
+		default: 'create',
+	},
+	...create.description,
+	...deleteAlert.description,
+	...executeResponder.description,
+	...get.description,
+	...search.description,
+	...status.description,
+	...merge.description,
+	...promote.description,
+	...update.description,
+];

packages/nodes-base/nodes/TheHiveProject/actions/alert/merge.operation.ts

@@ -0,0 +1,43 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { alertRLC, caseRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [alertRLC, caseRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['alert'],
+		operation: ['merge'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const alertId = this.getNodeParameter('alertId', i, '', { extractValue: true }) as string;
+
+	const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+
+	responseData = await theHiveApiRequest.call(
+		this,
+		'POST',
+		`/alert/${alertId}/merge/${caseId}`,
+		{},
+	);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/alert/promote.operation.ts

@@ -0,0 +1,71 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { alertRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	alertRLC,
+	{
+		displayName: 'Options',
+		name: 'options',
+		placeholder: 'Add Field',
+		type: 'collection',
+		default: {},
+		options: [
+			{
+				displayName: 'Case Template Name or ID',
+				name: 'caseTemplate',
+				type: 'options',
+				description:
+					'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+				default: '',
+				typeOptions: {
+					loadOptionsMethod: 'loadCaseTemplate',
+				},
+			},
+		],
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['alert'],
+		operation: ['promote'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const alertId = this.getNodeParameter('alertId', i, '', { extractValue: true }) as string;
+	const caseTemplate = this.getNodeParameter('options.caseTemplate', i, '') as string;
+
+	const body: IDataObject = {};
+
+	// await theHiveApiRequest.call(this, 'POST', '/v1/caseTemplate', {
+	// 	name: 'test template 001',
+	// 	displayName: 'Test Template 001',
+	// 	description: 'test',
+	// });
+
+	if (caseTemplate) {
+		body.caseTemplate = caseTemplate;
+	}
+
+	responseData = await theHiveApiRequest.call(this, 'POST', `/v1/alert/${alertId}/case`, body);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/alert/search.operation.ts

@@ -0,0 +1,62 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import {
+	genericFiltersCollection,
+	returnAllAndLimit,
+	searchOptions,
+	sortCollection,
+} from '../../descriptions';
+import { theHiveApiQuery } from '../../transport';
+
+const properties: INodeProperties[] = [
+	...returnAllAndLimit,
+	genericFiltersCollection,
+	sortCollection,
+	searchOptions,
+];
+
+const displayOptions = {
+	show: {
+		resource: ['alert'],
+		operation: ['search'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const filtersValues = this.getNodeParameter('filters.values', i, []) as IDataObject[];
+	const sortFields = this.getNodeParameter('sort.fields', i, []) as IDataObject[];
+	const returnAll = this.getNodeParameter('returnAll', i);
+	const { returnCount, extraData } = this.getNodeParameter('options', i);
+	let limit;
+
+	if (!returnAll) {
+		limit = this.getNodeParameter('limit', i);
+	}
+
+	responseData = await theHiveApiQuery.call(
+		this,
+		{ query: 'listAlert' },
+		filtersValues,
+		sortFields,
+		limit,
+		returnCount as boolean,
+		extraData as string[],
+	);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/alert/status.operation.ts

@@ -0,0 +1,44 @@
+import type { INodeExecutionData, IExecuteFunctions, INodeProperties } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { alertRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	alertRLC,
+	{
+		displayName: 'Status Name or ID',
+		name: 'status',
+		type: 'options',
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		default: '',
+		required: true,
+		typeOptions: {
+			loadOptionsMethod: 'loadAlertStatus',
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['alert'],
+		operation: ['status'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const alertId = this.getNodeParameter('alertId', i, '', { extractValue: true }) as string;
+	const status = this.getNodeParameter('status', i) as string;
+
+	await theHiveApiRequest.call(this, 'PATCH', `/v1/alert/${alertId}`, { status });
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData({ success: true }), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/alert/update.operation.ts

@@ -0,0 +1,152 @@
+import set from 'lodash/set';
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+import { NodeOperationError } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { fixFieldType, prepareInputItem } from '../../helpers/utils';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		displayName: 'Fields',
+		name: 'alertUpdateFields',
+		type: 'resourceMapper',
+		default: {
+			mappingMode: 'defineBelow',
+			value: null,
+		},
+		noDataExpression: true,
+		required: true,
+		typeOptions: {
+			resourceMapper: {
+				resourceMapperMethod: 'getAlertUpdateFields',
+				mode: 'update',
+				valuesLabel: 'Fields',
+				addAllFields: true,
+				multiKeyMatch: true,
+			},
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['alert'],
+		operation: ['update'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(
+	this: IExecuteFunctions,
+	i: number,
+	item: INodeExecutionData,
+): Promise<INodeExecutionData[]> {
+	let body: IDataObject = {};
+	let updated = 1;
+
+	const dataMode = this.getNodeParameter('alertUpdateFields.mappingMode', i) as string;
+
+	if (dataMode === 'autoMapInputData') {
+		const schema = this.getNodeParameter('alertUpdateFields.schema', i) as IDataObject[];
+		body = prepareInputItem(item.json, schema, i);
+	}
+
+	if (dataMode === 'defineBelow') {
+		const alertUpdateFields = this.getNodeParameter(
+			'alertUpdateFields.value',
+			i,
+			[],
+		) as IDataObject;
+		body = alertUpdateFields;
+	}
+
+	body = fixFieldType(body);
+
+	const fieldsToMatchOn = this.getNodeParameter('alertUpdateFields.matchingColumns', i) as string[];
+
+	const updateBody: IDataObject = {};
+	const matchFields: IDataObject = {};
+	const { id } = body; // id would be used if matching on id, also we need to remove it from the body
+
+	for (const field of Object.keys(body)) {
+		if (field === 'customFields') {
+			//in input data customFields sent as an object, parse it extracting customFields that are used for matching
+			const customFields: IDataObject = {};
+			for (const customField of Object.keys(body.customFields || {})) {
+				const combinedPath = `customFields.${customField}`;
+				if (fieldsToMatchOn.includes(combinedPath)) {
+					matchFields[combinedPath] = (body.customFields as IDataObject)[customField];
+				} else {
+					customFields[customField] = (body.customFields as IDataObject)[customField];
+				}
+			}
+			set(updateBody, 'customFields', customFields);
+			continue;
+		}
+		if (fieldsToMatchOn.includes(field)) {
+			// if field is in fieldsToMatchOn, we need to exclude it from the updateBody, as values used for matching should not be updated
+			matchFields[field] = body[field];
+		} else {
+			// use set to construct the updateBody, as it allows to process customFields.fieldName
+			// if customFields provided under customFields property, it will be send as is
+			set(updateBody, field, body[field]);
+		}
+	}
+
+	if (fieldsToMatchOn.includes('id')) {
+		await theHiveApiRequest.call(this, 'PATCH', `/v1/alert/${id}`, updateBody);
+	} else {
+		const filter = {
+			_name: 'filter',
+			_and: fieldsToMatchOn.map((field) => ({
+				_eq: {
+					_field: field,
+					_value: matchFields[field],
+				},
+			})),
+		};
+
+		const queryBody = {
+			query: [
+				{
+					_name: 'listAlert',
+				},
+				filter,
+			],
+		};
+
+		const matches = (await theHiveApiRequest.call(
+			this,
+			'POST',
+			'/v1/query',
+			queryBody,
+		)) as IDataObject[];
+
+		if (!matches.length) {
+			throw new NodeOperationError(this.getNode(), 'No matching alerts found');
+		}
+		const ids = matches.map((match) => match._id);
+		updated = ids.length;
+
+		updateBody.ids = ids;
+
+		await theHiveApiRequest.call(this, 'PATCH', '/v1/alert/_bulk', updateBody);
+	}
+
+	const executionData = this.helpers.constructExecutionMetaData(
+		wrapData({ success: true, updatedAlerts: updated }),
+		{
+			itemData: { item: i },
+		},
+	);
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/case/addAttachment.operation.ts

@@ -0,0 +1,91 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { attachmentsUi, caseRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	caseRLC,
+	attachmentsUi,
+	{
+		displayName: 'Options',
+		name: 'options',
+		type: 'collection',
+		placeholder: 'Add option',
+		default: {},
+		options: [
+			{
+				displayName: 'Rename Files',
+				name: 'canRename',
+				type: 'boolean',
+				description: 'Whether to rename the file in case a file with the same name already exists',
+				default: false,
+			},
+		],
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['case'],
+		operation: ['addAttachment'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+	const canRename = this.getNodeParameter('options.canRename', i, false) as boolean;
+
+	const inputDataFields = (
+		this.getNodeParameter('attachmentsUi.values', i, []) as IDataObject[]
+	).map((entry) => (entry.field as string).trim());
+
+	const attachments = [];
+
+	for (const inputDataField of inputDataFields) {
+		const binaryData = this.helpers.assertBinaryData(i, inputDataField);
+		const dataBuffer = await this.helpers.getBinaryDataBuffer(i, inputDataField);
+
+		attachments.push({
+			value: dataBuffer,
+			options: {
+				contentType: binaryData.mimeType,
+				filename: binaryData.fileName,
+			},
+		});
+	}
+
+	responseData = await theHiveApiRequest.call(
+		this,
+		'POST',
+		`/v1/case/${caseId}/attachments`,
+		undefined,
+		undefined,
+		undefined,
+		{
+			Headers: {
+				'Content-Type': 'multipart/form-data',
+			},
+			formData: {
+				attachments,
+				canRename: JSON.stringify(canRename),
+			},
+		},
+	);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/case/create.operation.ts

@@ -0,0 +1,81 @@
+import set from 'lodash/set';
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { fixFieldType, prepareInputItem } from '../../helpers/utils';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		displayName: 'Fields',
+		name: 'caseFields',
+		type: 'resourceMapper',
+		default: {
+			mappingMode: 'defineBelow',
+			value: null,
+		},
+		noDataExpression: true,
+		required: true,
+		typeOptions: {
+			resourceMapper: {
+				resourceMapperMethod: 'getCaseFields',
+				mode: 'add',
+				valuesLabel: 'Fields',
+			},
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['case'],
+		operation: ['create'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(
+	this: IExecuteFunctions,
+	i: number,
+	item: INodeExecutionData,
+): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+	let inputData: IDataObject = {};
+
+	const dataMode = this.getNodeParameter('caseFields.mappingMode', i) as string;
+
+	if (dataMode === 'autoMapInputData') {
+		const schema = this.getNodeParameter('caseFields.schema', i) as IDataObject[];
+		inputData = prepareInputItem(item.json, schema, i);
+	}
+
+	if (dataMode === 'defineBelow') {
+		const caseFields = this.getNodeParameter('caseFields.value', i, []) as IDataObject;
+		inputData = caseFields;
+	}
+
+	inputData = fixFieldType(inputData);
+
+	const body: IDataObject = {};
+
+	for (const field of Object.keys(inputData)) {
+		// use set to construct the updateBody, as it allows to process customFields.fieldName
+		// if customFields provided under customFields property, it will be send as is
+		set(body, field, inputData[field]);
+	}
+
+	responseData = await theHiveApiRequest.call(this, 'POST', '/v1/case' as string, body);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/case/deleteAttachment.operation.ts

@@ -0,0 +1,44 @@
+import type { IExecuteFunctions, INodeExecutionData, INodeProperties } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { caseRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	caseRLC,
+	{
+		displayName: 'Attachment Name or ID',
+		name: 'attachmentId',
+		type: 'options',
+		default: '',
+		required: true,
+		description:
+			'ID of the attachment. Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>.',
+		typeOptions: {
+			loadOptionsMethod: 'loadCaseAttachments',
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['case'],
+		operation: ['deleteAttachment'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+	const attachmentId = this.getNodeParameter('attachmentId', i) as string;
+
+	await theHiveApiRequest.call(this, 'DELETE', `/v1/case/${caseId}/attachment/${attachmentId}`);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData({ success: true }), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/case/deleteCase.operation.ts

@@ -0,0 +1,29 @@
+import type { IExecuteFunctions, INodeExecutionData, INodeProperties } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { caseRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [caseRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['case'],
+		operation: ['deleteCase'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+
+	await theHiveApiRequest.call(this, 'DELETE', `/v1/case/${caseId}`);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData({ success: true }), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/case/executeResponder.operation.ts

@@ -0,0 +1,75 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { caseRLC, responderOptions } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [{ ...caseRLC, name: 'id' }, responderOptions];
+
+const displayOptions = {
+	show: {
+		resource: ['case'],
+		operation: ['executeResponder'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const caseId = this.getNodeParameter('id', i, '', { extractValue: true }) as string;
+	const responderId = this.getNodeParameter('responder', i) as string;
+	let body: IDataObject;
+	let response;
+	responseData = [];
+	body = {
+		responderId,
+		objectId: caseId,
+		objectType: 'case',
+	};
+	response = await theHiveApiRequest.call(this, 'POST', '/connector/cortex/action' as string, body);
+	body = {
+		query: [
+			{
+				_name: 'listAction',
+			},
+			{
+				_name: 'filter',
+				_and: [
+					{
+						_field: 'cortexId',
+						_value: response.cortexId,
+					},
+					{
+						_field: 'objectId',
+						_value: response.objectId,
+					},
+					{
+						_field: 'startDate',
+						_value: response.startDate,
+					},
+				],
+			},
+		],
+	};
+	const qs: IDataObject = {};
+	qs.name = 'log-actions';
+	do {
+		response = await theHiveApiRequest.call(this, 'POST', '/v1/query', body, qs);
+	} while (response.status === 'Waiting' || response.status === 'InProgress');
+
+	responseData = response;
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/case/get.operation.ts

@@ -0,0 +1,55 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { caseRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [caseRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['case'],
+		operation: ['get'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+
+	const qs: IDataObject = {};
+
+	const body = {
+		query: [
+			{
+				_name: 'getCase',
+				idOrName: caseId,
+			},
+			{
+				_name: 'page',
+				from: 0,
+				to: 10,
+				extraData: ['attachmentCount'],
+			},
+		],
+	};
+
+	qs.name = `get-case-${caseId}`;
+
+	responseData = await theHiveApiRequest.call(this, 'POST', '/v1/query', body, qs);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/case/getAttachment.operation.ts

@@ -0,0 +1,114 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions } from '@utils/utilities';
+
+import { caseRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	caseRLC,
+	{
+		displayName: 'Attachment Name or ID',
+		name: 'attachmentId',
+		type: 'options',
+		default: '',
+		required: true,
+		description:
+			'ID of the attachment. Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>.',
+		typeOptions: {
+			loadOptionsMethod: 'loadCaseAttachments',
+			loadOptionsDependsOn: ['caseId.value'],
+		},
+	},
+	{
+		displayName: 'Options',
+		name: 'options',
+		type: 'collection',
+		placeholder: 'Add option',
+		default: {},
+		options: [
+			{
+				displayName: 'File Name',
+				name: 'fileName',
+				type: 'string',
+				default: '',
+				description: 'Rename the file when downloading',
+			},
+			{
+				displayName: 'Data Property Name',
+				name: 'dataPropertyName',
+				type: 'string',
+				default: 'data',
+				description: 'Name of the binary property to which write the data of the attachment',
+			},
+		],
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['case'],
+		operation: ['getAttachment'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+	const options = this.getNodeParameter('options', i);
+	const attachmentId = this.getNodeParameter('attachmentId', i) as string;
+
+	const requestOptions = {
+		useStream: true,
+		resolveWithFullResponse: true,
+		encoding: null,
+		json: false,
+	};
+
+	const response = await theHiveApiRequest.call(
+		this,
+		'GET',
+		`/v1/case/${caseId}/attachment/${attachmentId}/download`,
+		undefined,
+		undefined,
+		undefined,
+		requestOptions,
+	);
+
+	const mimeType = (response.headers as IDataObject)?.['content-type'] ?? undefined;
+
+	let fileName = (options.fileName as string) || 'attachment';
+
+	if (!options.fileName && response.headers['content-disposition'] !== undefined) {
+		const contentDisposition = response.headers['content-disposition'] as string;
+		const fileNameMatch = contentDisposition.match(/filename="(.+)"/);
+		if (fileNameMatch !== null) {
+			fileName = fileNameMatch[1];
+		}
+	}
+
+	const newItem: INodeExecutionData = {
+		json: {
+			_id: attachmentId,
+			caseId,
+			fileName,
+			mimeType,
+		},
+		binary: {},
+	};
+
+	newItem.binary![(options.dataPropertyName as string) || 'data'] =
+		await this.helpers.prepareBinaryData(response.body as Buffer, fileName, mimeType as string);
+
+	const executionData = this.helpers.constructExecutionMetaData([newItem], {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/case/getTimeline.operation.ts

@@ -0,0 +1,36 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { caseRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [caseRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['case'],
+		operation: ['getTimeline'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+
+	responseData = await theHiveApiRequest.call(this, 'GET', `/v1/case/${caseId}/timeline`);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/case/index.ts

@@ -0,0 +1,103 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+import * as addAttachment from './addAttachment.operation';
+import * as create from './create.operation';
+import * as deleteAttachment from './deleteAttachment.operation';
+import * as deleteCase from './deleteCase.operation';
+import * as executeResponder from './executeResponder.operation';
+import * as get from './get.operation';
+import * as getAttachment from './getAttachment.operation';
+import * as getTimeline from './getTimeline.operation';
+import * as search from './search.operation';
+import * as update from './update.operation';
+
+export {
+	addAttachment,
+	create,
+	deleteAttachment,
+	deleteCase,
+	executeResponder,
+	get,
+	search,
+	getAttachment,
+	getTimeline,
+	update,
+};
+
+export const description: INodeProperties[] = [
+	{
+		displayName: 'Operation',
+		name: 'operation',
+		default: 'create',
+		type: 'options',
+		noDataExpression: true,
+		required: true,
+		options: [
+			{
+				name: 'Add Attachment',
+				value: 'addAttachment',
+				action: 'Add attachment to a case',
+			},
+			{
+				name: 'Create',
+				value: 'create',
+				action: 'Create a case',
+			},
+			{
+				name: 'Delete Attachment',
+				value: 'deleteAttachment',
+				action: 'Delete attachment from a case',
+			},
+			{
+				name: 'Delete Case',
+				value: 'deleteCase',
+				action: 'Delete an case',
+			},
+			{
+				name: 'Execute Responder',
+				value: 'executeResponder',
+				action: 'Execute responder on a case',
+			},
+			{
+				name: 'Get',
+				value: 'get',
+				action: 'Get a case',
+			},
+			{
+				name: 'Get Attachment',
+				value: 'getAttachment',
+				action: 'Get attachment from a case',
+			},
+			{
+				name: 'Get Timeline',
+				value: 'getTimeline',
+				action: 'Get timeline of a case',
+			},
+			{
+				name: 'Search',
+				value: 'search',
+				action: 'Search cases',
+			},
+			{
+				name: 'Update',
+				value: 'update',
+				action: 'Update a case',
+			},
+		],
+		displayOptions: {
+			show: {
+				resource: ['case'],
+			},
+		},
+	},
+	...addAttachment.description,
+	...create.description,
+	...deleteAttachment.description,
+	...deleteCase.description,
+	...executeResponder.description,
+	...get.description,
+	...getAttachment.description,
+	...search.description,
+	...getTimeline.description,
+	...update.description,
+];

packages/nodes-base/nodes/TheHiveProject/actions/case/search.operation.ts

@@ -0,0 +1,62 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import {
+	genericFiltersCollection,
+	returnAllAndLimit,
+	searchOptions,
+	sortCollection,
+} from '../../descriptions';
+import { theHiveApiQuery } from '../../transport';
+
+const properties: INodeProperties[] = [
+	...returnAllAndLimit,
+	genericFiltersCollection,
+	sortCollection,
+	searchOptions,
+];
+
+const displayOptions = {
+	show: {
+		resource: ['case'],
+		operation: ['search'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const filtersValues = this.getNodeParameter('filters.values', i, []) as IDataObject[];
+	const sortFields = this.getNodeParameter('sort.fields', i, []) as IDataObject[];
+	const returnAll = this.getNodeParameter('returnAll', i);
+	const { returnCount, extraData } = this.getNodeParameter('options', i);
+	let limit;
+
+	if (!returnAll) {
+		limit = this.getNodeParameter('limit', i);
+	}
+
+	responseData = await theHiveApiQuery.call(
+		this,
+		{ query: 'listCase' },
+		filtersValues,
+		sortFields,
+		limit,
+		returnCount as boolean,
+		extraData as string[],
+	);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/case/update.operation.ts

@@ -0,0 +1,148 @@
+import set from 'lodash/set';
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+import { NodeOperationError } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { fixFieldType, prepareInputItem } from '../../helpers/utils';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		displayName: 'Fields',
+		name: 'caseUpdateFields',
+		type: 'resourceMapper',
+		default: {
+			mappingMode: 'defineBelow',
+			value: null,
+		},
+		noDataExpression: true,
+		required: true,
+		typeOptions: {
+			resourceMapper: {
+				resourceMapperMethod: 'getCaseUpdateFields',
+				mode: 'update',
+				valuesLabel: 'Fields',
+				addAllFields: true,
+				multiKeyMatch: true,
+			},
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['case'],
+		operation: ['update'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(
+	this: IExecuteFunctions,
+	i: number,
+	item: INodeExecutionData,
+): Promise<INodeExecutionData[]> {
+	let body: IDataObject = {};
+	let updated = 1;
+
+	const dataMode = this.getNodeParameter('caseUpdateFields.mappingMode', i) as string;
+
+	if (dataMode === 'autoMapInputData') {
+		const schema = this.getNodeParameter('caseUpdateFields.schema', i) as IDataObject[];
+		body = prepareInputItem(item.json, schema, i);
+	}
+
+	if (dataMode === 'defineBelow') {
+		const caseUpdateFields = this.getNodeParameter('caseUpdateFields.value', i, []) as IDataObject;
+		body = caseUpdateFields;
+	}
+
+	body = fixFieldType(body);
+
+	const fieldsToMatchOn = this.getNodeParameter('caseUpdateFields.matchingColumns', i) as string[];
+
+	const updateBody: IDataObject = {};
+	const matchFields: IDataObject = {};
+	const { id } = body; // id would be used if matching on id, also we need to remove it from the body
+
+	for (const field of Object.keys(body)) {
+		if (field === 'customFields') {
+			//in input data customFields sent as an object, parse it extracting customFields that are used for matching
+			const customFields: IDataObject = {};
+			for (const customField of Object.keys(body.customFields || {})) {
+				const customFieldPath = `customFields.${customField}`;
+				if (fieldsToMatchOn.includes(customFieldPath)) {
+					matchFields[customFieldPath] = (body.customFields as IDataObject)[customField];
+				} else {
+					customFields[customField] = (body.customFields as IDataObject)[customField];
+				}
+			}
+			set(updateBody, 'customFields', customFields);
+			continue;
+		}
+		if (fieldsToMatchOn.includes(field)) {
+			// if field is in fieldsToMatchOn, we need to exclude it from the updateBody, as values used for matching should not be updated
+			matchFields[field] = body[field];
+		} else {
+			// use set to construct the updateBody, as it allows to process customFields.fieldName
+			// if customFields provided under customFields property, it will be send as is
+			set(updateBody, field, body[field]);
+		}
+	}
+
+	if (fieldsToMatchOn.includes('id')) {
+		await theHiveApiRequest.call(this, 'PATCH', `/v1/case/${id}`, updateBody);
+	} else {
+		const filter = {
+			_name: 'filter',
+			_and: fieldsToMatchOn.map((field) => ({
+				_eq: {
+					_field: field,
+					_value: matchFields[field],
+				},
+			})),
+		};
+
+		const queryBody = {
+			query: [
+				{
+					_name: 'listCase',
+				},
+				filter,
+			],
+		};
+
+		const matches = (await theHiveApiRequest.call(
+			this,
+			'POST',
+			'/v1/query',
+			queryBody,
+		)) as IDataObject[];
+
+		if (!matches.length) {
+			throw new NodeOperationError(this.getNode(), 'No matching alerts found');
+		}
+		const ids = matches.map((match) => match._id);
+		updated = ids.length;
+
+		updateBody.ids = ids;
+
+		await theHiveApiRequest.call(this, 'PATCH', '/v1/case/_bulk', updateBody);
+	}
+
+	const executionData = this.helpers.constructExecutionMetaData(
+		wrapData({ success: true, updated }),
+		{
+			itemData: { item: i },
+		},
+	);
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/comment/add.operation.ts

@@ -0,0 +1,88 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { alertRLC, caseRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		// eslint-disable-next-line n8n-nodes-base/node-param-display-name-miscased
+		displayName: 'Add to',
+		name: 'addTo',
+		type: 'options',
+		options: [
+			{
+				name: 'Alert',
+				value: 'alert',
+			},
+			{
+				name: 'Case',
+				value: 'case',
+			},
+		],
+		default: 'alert',
+	},
+	{
+		...caseRLC,
+		name: 'id',
+		displayOptions: {
+			show: {
+				addTo: ['case'],
+			},
+		},
+	},
+	{
+		...alertRLC,
+		name: 'id',
+		displayOptions: {
+			show: {
+				addTo: ['alert'],
+			},
+		},
+	},
+	{
+		displayName: 'Message',
+		name: 'message',
+		type: 'string',
+		default: '',
+		required: true,
+		typeOptions: {
+			rows: 2,
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['comment'],
+		operation: ['add'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const addTo = this.getNodeParameter('addTo', i) as string;
+	const id = this.getNodeParameter('id', i, '', { extractValue: true });
+	const message = this.getNodeParameter('message', i) as string;
+
+	const body: IDataObject = {
+		message,
+	};
+
+	responseData = await theHiveApiRequest.call(this, 'POST', `/v1/${addTo}/${id}/comment`, body);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/comment/deleteComment.operation.ts

@@ -0,0 +1,29 @@
+import type { IExecuteFunctions, INodeExecutionData, INodeProperties } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { commentRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [commentRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['comment'],
+		operation: ['deleteComment'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const commentId = this.getNodeParameter('commentId', i, '', { extractValue: true }) as string;
+
+	await theHiveApiRequest.call(this, 'DELETE', `/v1/comment/${commentId}`);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData({ success: true }), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/comment/index.ts

@@ -0,0 +1,50 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+import * as add from './add.operation';
+import * as deleteComment from './deleteComment.operation';
+import * as search from './search.operation';
+import * as update from './update.operation';
+
+export { add, deleteComment, search, update };
+
+export const description: INodeProperties[] = [
+	{
+		displayName: 'Operation',
+		name: 'operation',
+		noDataExpression: true,
+		type: 'options',
+		required: true,
+		default: 'add',
+		options: [
+			{
+				name: 'Create',
+				value: 'add',
+				action: 'Create a comment in a case or alert',
+			},
+			{
+				name: 'Delete',
+				value: 'deleteComment',
+				action: 'Delete a comment',
+			},
+			{
+				name: 'Search',
+				value: 'search',
+				action: 'Search comments',
+			},
+			{
+				name: 'Update',
+				value: 'update',
+				action: 'Update a comment',
+			},
+		],
+		displayOptions: {
+			show: {
+				resource: ['comment'],
+			},
+		},
+	},
+	...add.description,
+	...deleteComment.description,
+	...search.description,
+	...update.description,
+];

packages/nodes-base/nodes/TheHiveProject/actions/comment/search.operation.ts

@@ -0,0 +1,120 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+import { NodeOperationError } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import {
+	alertRLC,
+	caseRLC,
+	genericFiltersCollection,
+	returnAllAndLimit,
+	searchOptions,
+	sortCollection,
+} from '../../descriptions';
+import type { QueryScope } from '../../helpers/interfaces';
+import { theHiveApiQuery } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		// eslint-disable-next-line n8n-nodes-base/node-param-display-name-miscased
+		displayName: 'Search in',
+		name: 'searchIn',
+		type: 'options',
+		default: 'all',
+		description:
+			'Whether to search for comments in all alerts and cases or in a specific case or alert',
+		options: [
+			{
+				name: 'Alerts and Cases',
+				value: 'all',
+			},
+			{
+				name: 'Alert',
+				value: 'alert',
+			},
+			{
+				name: 'Case',
+				value: 'case',
+			},
+		],
+	},
+	{
+		...caseRLC,
+		displayOptions: {
+			show: {
+				searchIn: ['case'],
+			},
+		},
+	},
+	{
+		...alertRLC,
+		displayOptions: {
+			show: {
+				searchIn: ['alert'],
+			},
+		},
+	},
+	...returnAllAndLimit,
+	genericFiltersCollection,
+	sortCollection,
+	searchOptions,
+];
+
+const displayOptions = {
+	show: {
+		resource: ['comment'],
+		operation: ['search'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const searchIn = this.getNodeParameter('searchIn', i) as string;
+	const filtersValues = this.getNodeParameter('filters.values', i, []) as IDataObject[];
+	const sortFields = this.getNodeParameter('sort.fields', i, []) as IDataObject[];
+	const returnAll = this.getNodeParameter('returnAll', i);
+	const { returnCount, extraData } = this.getNodeParameter('options', i);
+
+	let limit;
+	let scope: QueryScope;
+
+	if (searchIn === 'all') {
+		scope = { query: 'listComment' };
+	} else if (searchIn === 'alert') {
+		const alertId = this.getNodeParameter('alertId', i, '', { extractValue: true }) as string;
+		scope = { query: 'getAlert', id: alertId, restrictTo: 'comments' };
+	} else if (searchIn === 'case') {
+		const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+		scope = { query: 'getCase', id: caseId, restrictTo: 'comments' };
+	} else {
+		throw new NodeOperationError(this.getNode(), `Invalid 'Search In ...' value: ${searchIn}`);
+	}
+
+	if (!returnAll) {
+		limit = this.getNodeParameter('limit', i);
+	}
+
+	responseData = await theHiveApiQuery.call(
+		this,
+		scope,
+		filtersValues,
+		sortFields,
+		limit,
+		returnCount as boolean,
+		extraData as string[],
+	);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/comment/update.operation.ts

@@ -0,0 +1,53 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { commentRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	commentRLC,
+	{
+		displayName: 'Message',
+		name: 'message',
+		type: 'string',
+		default: '',
+		required: true,
+		typeOptions: {
+			rows: 2,
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['comment'],
+		operation: ['update'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const commentId = this.getNodeParameter('commentId', i, '', { extractValue: true }) as string;
+	const message = this.getNodeParameter('message', i) as string;
+
+	const body: IDataObject = {
+		message,
+	};
+
+	responseData = await theHiveApiRequest.call(this, 'PATCH', `/v1/comment/${commentId}`, body);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/log/addAttachment.operation.ts

@@ -0,0 +1,68 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { attachmentsUi, logRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [logRLC, attachmentsUi];
+
+const displayOptions = {
+	show: {
+		resource: ['log'],
+		operation: ['addAttachment'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const logId = this.getNodeParameter('logId', i, '', { extractValue: true }) as string;
+
+	const inputDataFields = (
+		this.getNodeParameter('attachmentsUi.values', i, []) as IDataObject[]
+	).map((entry) => (entry.field as string).trim());
+
+	const attachments = [];
+
+	for (const inputDataField of inputDataFields) {
+		const binaryData = this.helpers.assertBinaryData(i, inputDataField);
+		const dataBuffer = await this.helpers.getBinaryDataBuffer(i, inputDataField);
+
+		attachments.push({
+			value: dataBuffer,
+			options: {
+				contentType: binaryData.mimeType,
+				filename: binaryData.fileName,
+			},
+		});
+	}
+
+	await theHiveApiRequest.call(
+		this,
+		'POST',
+		`/v1/log/${logId}/attachments`,
+		undefined,
+		undefined,
+		undefined,
+		{
+			Headers: {
+				'Content-Type': 'multipart/form-data',
+			},
+			formData: {
+				attachments,
+			},
+		},
+	);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData({ success: true }), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/log/create.operation.ts

@@ -0,0 +1,115 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { attachmentsUi, taskRLC } from '../../descriptions';
+import { fixFieldType, prepareInputItem } from '../../helpers/utils';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	taskRLC,
+	{
+		displayName: 'Fields',
+		name: 'logFields',
+		type: 'resourceMapper',
+		default: {
+			mappingMode: 'defineBelow',
+			value: null,
+		},
+		noDataExpression: true,
+		required: true,
+		typeOptions: {
+			resourceMapper: {
+				resourceMapperMethod: 'getLogFields',
+				mode: 'add',
+				valuesLabel: 'Fields',
+			},
+		},
+	},
+	attachmentsUi,
+];
+
+const displayOptions = {
+	show: {
+		resource: ['log'],
+		operation: ['create'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(
+	this: IExecuteFunctions,
+	i: number,
+	item: INodeExecutionData,
+): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+	let body: IDataObject = {};
+
+	const dataMode = this.getNodeParameter('logFields.mappingMode', i) as string;
+	const taskId = this.getNodeParameter('taskId', i, '', { extractValue: true }) as string;
+
+	if (dataMode === 'autoMapInputData') {
+		const schema = this.getNodeParameter('logFields.schema', i) as IDataObject[];
+		body = prepareInputItem(item.json, schema, i);
+	}
+
+	if (dataMode === 'defineBelow') {
+		const logFields = this.getNodeParameter('logFields.value', i, []) as IDataObject;
+		body = logFields;
+	}
+
+	body = fixFieldType(body);
+
+	const inputDataFields = (
+		this.getNodeParameter('attachmentsUi.values', i, []) as IDataObject[]
+	).map((entry) => (entry.field as string).trim());
+
+	if (inputDataFields.length) {
+		const binaries = [];
+
+		for (const inputDataField of inputDataFields) {
+			const binaryData = this.helpers.assertBinaryData(i, inputDataField);
+			const dataBuffer = await this.helpers.getBinaryDataBuffer(i, inputDataField);
+
+			binaries.push({
+				value: dataBuffer,
+				options: {
+					contentType: binaryData.mimeType,
+					filename: binaryData.fileName,
+				},
+			});
+		}
+
+		responseData = await theHiveApiRequest.call(
+			this,
+			'POST',
+			`/v1/task/${taskId}/log`,
+			undefined,
+			undefined,
+			undefined,
+			{
+				Headers: {
+					'Content-Type': 'multipart/form-data',
+				},
+				formData: {
+					attachments: binaries,
+					_json: JSON.stringify(body),
+				},
+			},
+		);
+	} else {
+		responseData = await theHiveApiRequest.call(this, 'POST', `/v1/task/${taskId}/log`, body);
+	}
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/log/deleteAttachment.operation.ts

@@ -0,0 +1,45 @@
+import type { IExecuteFunctions, INodeExecutionData, INodeProperties } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { logRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	logRLC,
+	{
+		displayName: 'Attachment Name or ID',
+		name: 'attachmentId',
+		type: 'options',
+		default: '',
+		required: true,
+		description:
+			'ID of the attachment. Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>.',
+		typeOptions: {
+			loadOptionsMethod: 'loadLogAttachments',
+			loadOptionsDependsOn: ['logId.value'],
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['log'],
+		operation: ['deleteAttachment'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const logId = this.getNodeParameter('logId', i, '', { extractValue: true }) as string;
+	const attachmentId = this.getNodeParameter('attachmentId', i) as string;
+
+	await theHiveApiRequest.call(this, 'DELETE', `/v1/log/${logId}/attachments/${attachmentId}`);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData({ success: true }), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/log/deleteLog.operation.ts

@@ -0,0 +1,29 @@
+import type { IExecuteFunctions, INodeExecutionData, INodeProperties } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { logRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [logRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['log'],
+		operation: ['deleteLog'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const logId = this.getNodeParameter('logId', i, '', { extractValue: true }) as string;
+
+	await theHiveApiRequest.call(this, 'DELETE', `/v1/log/${logId}`);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData({ success: true }), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/log/executeResponder.operation.ts

@@ -0,0 +1,74 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { logRLC, responderOptions } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [{ ...logRLC, name: 'id' }, responderOptions];
+
+const displayOptions = {
+	show: {
+		resource: ['log'],
+		operation: ['executeResponder'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const logId = this.getNodeParameter('id', i);
+	const responderId = this.getNodeParameter('responder', i) as string;
+	let body: IDataObject;
+	let response;
+	const qs: IDataObject = {};
+	body = {
+		responderId,
+		objectId: logId,
+		objectType: 'case_task_log',
+	};
+	response = await theHiveApiRequest.call(this, 'POST', '/connector/cortex/action' as string, body);
+	body = {
+		query: [
+			{
+				_name: 'listAction',
+			},
+			{
+				_name: 'filter',
+				_and: [
+					{
+						_field: 'cortexId',
+						_value: response.cortexId,
+					},
+					{
+						_field: 'objectId',
+						_value: response.objectId,
+					},
+					{
+						_field: 'startDate',
+						_value: response.startDate,
+					},
+				],
+			},
+		],
+	};
+	qs.name = 'log-actions';
+	do {
+		response = await theHiveApiRequest.call(this, 'POST', '/v1/query', body, qs);
+	} while (response.status === 'Waiting' || response.status === 'InProgress');
+
+	responseData = response;
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/log/get.operation.ts

@@ -0,0 +1,45 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { logRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [logRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['log'],
+		operation: ['get'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const logId = this.getNodeParameter('logId', i, '', { extractValue: true }) as string;
+
+	const body = {
+		query: [
+			{
+				_name: 'getLog',
+				idOrName: logId,
+			},
+		],
+	};
+
+	responseData = await theHiveApiRequest.call(this, 'POST', '/v1/query', body);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/log/index.ts

@@ -0,0 +1,71 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+import * as addAttachment from './addAttachment.operation';
+import * as create from './create.operation';
+import * as deleteAttachment from './deleteAttachment.operation';
+import * as deleteLog from './deleteLog.operation';
+import * as executeResponder from './executeResponder.operation';
+import * as get from './get.operation';
+import * as search from './search.operation';
+
+export { addAttachment, create, deleteAttachment, deleteLog, executeResponder, get, search };
+
+export const description: INodeProperties[] = [
+	{
+		displayName: 'Operation',
+		name: 'operation',
+		noDataExpression: true,
+		type: 'options',
+		required: true,
+		default: 'create',
+		options: [
+			{
+				name: 'Add Attachment',
+				value: 'addAttachment',
+				action: 'Add attachment to a task log',
+			},
+			{
+				name: 'Create',
+				value: 'create',
+				action: 'Create a task log',
+			},
+			{
+				name: 'Delete',
+				value: 'deleteLog',
+				action: 'Delete task log',
+			},
+			{
+				name: 'Delete Attachment',
+				value: 'deleteAttachment',
+				action: 'Delete attachment from a task log',
+			},
+			{
+				name: 'Execute Responder',
+				value: 'executeResponder',
+				action: 'Execute responder on a task log',
+			},
+			{
+				name: 'Get',
+				value: 'get',
+				action: 'Get a task log',
+			},
+			{
+				name: 'Search',
+				value: 'search',
+				action: 'Search task logs',
+			},
+		],
+		displayOptions: {
+			show: {
+				resource: ['log'],
+			},
+		},
+	},
+	...addAttachment.description,
+	...create.description,
+	...deleteAttachment.description,
+	...deleteLog.description,
+	...executeResponder.description,
+	...get.description,
+	...search.description,
+];

packages/nodes-base/nodes/TheHiveProject/actions/log/search.operation.ts

@@ -0,0 +1,89 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import {
+	taskRLC,
+	genericFiltersCollection,
+	returnAllAndLimit,
+	sortCollection,
+	searchOptions,
+} from '../../descriptions';
+import type { QueryScope } from '../../helpers/interfaces';
+import { theHiveApiQuery } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		displayName: 'Search in All Tasks',
+		name: 'allTasks',
+		type: 'boolean',
+		default: true,
+		description: 'Whether to search in all tasks or only in selected task',
+	},
+	{
+		...taskRLC,
+		displayOptions: {
+			show: {
+				allTasks: [false],
+			},
+		},
+	},
+	...returnAllAndLimit,
+	genericFiltersCollection,
+	sortCollection,
+	searchOptions,
+];
+
+const displayOptions = {
+	show: {
+		resource: ['log'],
+		operation: ['search'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const allTasks = this.getNodeParameter('allTasks', i) as boolean;
+	const filtersValues = this.getNodeParameter('filters.values', i, []) as IDataObject[];
+	const sortFields = this.getNodeParameter('sort.fields', i, []) as IDataObject[];
+	const returnAll = this.getNodeParameter('returnAll', i);
+	const { returnCount, extraData } = this.getNodeParameter('options', i);
+
+	let limit;
+	let scope: QueryScope;
+
+	if (allTasks) {
+		scope = { query: 'listLog' };
+	} else {
+		const taskId = this.getNodeParameter('taskId', i, '', { extractValue: true }) as string;
+		scope = { query: 'getTask', id: taskId, restrictTo: 'logs' };
+	}
+
+	if (!returnAll) {
+		limit = this.getNodeParameter('limit', i);
+	}
+
+	responseData = await theHiveApiQuery.call(
+		this,
+		scope,
+		filtersValues,
+		sortFields,
+		limit,
+		returnCount as boolean,
+		extraData as string[],
+	);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/node.description.ts

@@ -0,0 +1,86 @@
+/* eslint-disable n8n-nodes-base/node-filename-against-convention */
+import { NodeConnectionTypes, type INodeTypeDescription } from 'n8n-workflow';
+
+import * as alert from './alert';
+import * as case_ from './case';
+import * as comment from './comment';
+import * as log from './log';
+import * as observable from './observable';
+import * as page from './page';
+import * as query from './query';
+import * as task from './task';
+
+export const description: INodeTypeDescription = {
+	displayName: 'TheHive 5',
+	name: 'theHiveProject',
+	icon: 'file:thehiveproject.svg',
+	group: ['transform'],
+	subtitle: '={{$parameter["operation"]}} : {{$parameter["resource"]}}',
+	version: 1,
+	description: 'Consume TheHive 5 API',
+	defaults: {
+		name: 'TheHive 5',
+	},
+	usableAsTool: true,
+	inputs: [NodeConnectionTypes.Main],
+	outputs: [NodeConnectionTypes.Main],
+	credentials: [
+		{
+			name: 'theHiveProjectApi',
+			required: true,
+		},
+	],
+	properties: [
+		{
+			displayName: 'Resource',
+			name: 'resource',
+			type: 'options',
+			noDataExpression: true,
+			required: true,
+			options: [
+				{
+					name: 'Alert',
+					value: 'alert',
+				},
+				{
+					name: 'Case',
+					value: 'case',
+				},
+				{
+					name: 'Comment',
+					value: 'comment',
+				},
+				{
+					name: 'Observable',
+					value: 'observable',
+				},
+				{
+					name: 'Page',
+					value: 'page',
+				},
+				{
+					name: 'Query',
+					value: 'query',
+				},
+				{
+					name: 'Task',
+					value: 'task',
+				},
+				{
+					name: 'Task Log',
+					value: 'log',
+				},
+			],
+			default: 'alert',
+		},
+
+		...alert.description,
+		...case_.description,
+		...comment.description,
+		...log.description,
+		...observable.description,
+		...page.description,
+		...query.description,
+		...task.description,
+	],
+};

packages/nodes-base/nodes/TheHiveProject/actions/node.type.ts

@@ -0,0 +1,47 @@
+import type { AllEntities } from 'n8n-workflow';
+
+type NodeMap = {
+	alert:
+		| 'create'
+		| 'deleteAlert'
+		| 'executeResponder'
+		| 'get'
+		| 'search'
+		| 'status'
+		| 'merge'
+		| 'promote'
+		| 'update';
+	case:
+		| 'addAttachment'
+		| 'create'
+		| 'deleteAttachment'
+		| 'deleteCase'
+		| 'executeResponder'
+		| 'get'
+		| 'search'
+		| 'getAttachment'
+		| 'getTimeline'
+		| 'update';
+	comment: 'add' | 'deleteComment' | 'search' | 'update';
+	log:
+		| 'addAttachment'
+		| 'create'
+		| 'deleteLog'
+		| 'deleteAttachment'
+		| 'executeResponder'
+		| 'get'
+		| 'search';
+	observable:
+		| 'create'
+		| 'deleteObservable'
+		| 'executeAnalyzer'
+		| 'executeResponder'
+		| 'get'
+		| 'search'
+		| 'update';
+	page: 'create' | 'deletePage' | 'search' | 'update';
+	query: 'executeQuery';
+	task: 'create' | 'deleteTask' | 'executeResponder' | 'get' | 'search' | 'update';
+};
+
+export type TheHiveType = AllEntities<NodeMap>;

packages/nodes-base/nodes/TheHiveProject/actions/observable/create.operation.ts

@@ -0,0 +1,188 @@
+import FormData from 'form-data';
+import {
+	NodeOperationError,
+	type IDataObject,
+	type IExecuteFunctions,
+	type INodeExecutionData,
+	type INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { alertRLC, attachmentsUi, caseRLC } from '../../descriptions';
+import { fixFieldType, prepareInputItem } from '../../helpers/utils';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		// eslint-disable-next-line n8n-nodes-base/node-param-display-name-miscased
+		displayName: 'Create in',
+		name: 'createIn',
+		type: 'options',
+		options: [
+			{
+				name: 'Case',
+				value: 'case',
+			},
+			{
+				name: 'Alert',
+				value: 'alert',
+			},
+		],
+		default: 'case',
+	},
+	{
+		...caseRLC,
+		name: 'id',
+		displayOptions: {
+			show: {
+				createIn: ['case'],
+			},
+		},
+	},
+	{
+		...alertRLC,
+		name: 'id',
+		displayOptions: {
+			show: {
+				createIn: ['alert'],
+			},
+		},
+	},
+	{
+		// eslint-disable-next-line n8n-nodes-base/node-param-display-name-wrong-for-dynamic-options
+		displayName: 'Data Type',
+		name: 'dataType',
+		type: 'options',
+		description:
+			'Choose from the list, or specify an ID using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		required: true,
+		default: 'file',
+		typeOptions: {
+			loadOptionsMethod: 'loadObservableTypes',
+		},
+	},
+	{
+		displayName: 'Data',
+		name: 'data',
+		type: 'string',
+		default: '',
+		required: true,
+		displayOptions: {
+			hide: {
+				dataType: ['file'],
+			},
+		},
+	},
+	{ ...attachmentsUi, required: true, displayOptions: { show: { dataType: ['file'] } } },
+	{
+		displayName: 'Fields',
+		name: 'observableFields',
+		type: 'resourceMapper',
+		default: {
+			mappingMode: 'defineBelow',
+			value: null,
+		},
+		noDataExpression: true,
+		required: true,
+		typeOptions: {
+			resourceMapper: {
+				resourceMapperMethod: 'getObservableFields',
+				mode: 'add',
+				valuesLabel: 'Fields',
+			},
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['observable'],
+		operation: ['create'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(
+	this: IExecuteFunctions,
+	i: number,
+	item: INodeExecutionData,
+): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject = {};
+	let body: IDataObject = {};
+
+	const createIn = this.getNodeParameter('createIn', i) as string;
+	const id = this.getNodeParameter('id', i, '', { extractValue: true }) as string;
+	const endpoint = `/v1/${createIn}/${id}/observable`;
+
+	const dataMode = this.getNodeParameter('observableFields.mappingMode', i) as string;
+
+	if (dataMode === 'autoMapInputData') {
+		const schema = this.getNodeParameter('observableFields.schema', i) as IDataObject[];
+		body = prepareInputItem(item.json, schema, i);
+	}
+
+	if (dataMode === 'defineBelow') {
+		const observableFields = this.getNodeParameter('observableFields.value', i, []) as IDataObject;
+		body = observableFields;
+	}
+
+	body = fixFieldType(body);
+
+	const dataType = this.getNodeParameter('dataType', i) as string;
+
+	body.dataType = dataType;
+
+	if (dataType === 'file') {
+		const inputDataFields = (
+			this.getNodeParameter('attachmentsUi.values', i, []) as IDataObject[]
+		).map((entry) => (entry.field as string).trim());
+
+		const formData = new FormData();
+
+		for (const inputDataField of inputDataFields) {
+			const binaryData = this.helpers.assertBinaryData(i, inputDataField);
+			const dataBuffer = await this.helpers.getBinaryDataBuffer(i, inputDataField);
+
+			formData.append('attachment', dataBuffer, {
+				filename: binaryData.fileName,
+				contentType: binaryData.mimeType,
+			});
+		}
+
+		formData.append('_json', JSON.stringify(body));
+
+		responseData = await theHiveApiRequest.call(
+			this,
+			'POST',
+			endpoint,
+			undefined,
+			undefined,
+			undefined,
+			{
+				Headers: {
+					'Content-Type': 'multipart/form-data',
+				},
+				formData,
+			},
+		);
+	} else {
+		const data = this.getNodeParameter('data', i) as string;
+		body.data = data;
+		responseData = await theHiveApiRequest.call(this, 'POST', endpoint, body);
+	}
+
+	if (responseData.failure) {
+		const message = (responseData.failure as IDataObject[])
+			.map((error: IDataObject) => error.message)
+			.join(', ');
+		throw new NodeOperationError(this.getNode(), message, { itemIndex: i });
+	}
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/observable/deleteObservable.operation.ts

@@ -0,0 +1,31 @@
+import type { IExecuteFunctions, INodeExecutionData, INodeProperties } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { observableRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [observableRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['observable'],
+		operation: ['deleteObservable'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const observableId = this.getNodeParameter('observableId', i, '', {
+		extractValue: true,
+	}) as string;
+
+	await theHiveApiRequest.call(this, 'DELETE', `/v1/observable/${observableId}`);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData({ success: true }), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/observable/executeAnalyzer.operation.ts

@@ -0,0 +1,95 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { observableRLC, observableTypeOptions } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	observableRLC,
+	observableTypeOptions,
+	{
+		displayName: 'Analyzer Names or IDs',
+		name: 'analyzers',
+		type: 'multiOptions',
+		description:
+			'Choose from the list, or specify IDs using an <a href="https://docs.n8n.io/code/expressions/">expression</a>',
+		required: true,
+		default: [],
+		typeOptions: {
+			loadOptionsDependsOn: ['observableId.value', 'dataType'],
+			loadOptionsMethod: 'loadAnalyzers',
+		},
+		displayOptions: {
+			hide: {
+				id: [''],
+			},
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['observable'],
+		operation: ['executeAnalyzer'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject = {};
+
+	const observableId = this.getNodeParameter('observableId', i, '', {
+		extractValue: true,
+	}) as string;
+
+	const analyzers = (this.getNodeParameter('analyzers', i) as string[]).map((analyzer) => {
+		const parts = analyzer.split('::');
+		return {
+			analyzerId: parts[0],
+			cortexId: parts[1],
+		};
+	});
+	let response: any;
+	let body: IDataObject;
+
+	const qs: IDataObject = {};
+	for (const analyzer of analyzers) {
+		body = {
+			...analyzer,
+			artifactId: observableId,
+		};
+		// execute the analyzer
+		response = await theHiveApiRequest.call(
+			this,
+			'POST',
+			'/connector/cortex/job' as string,
+			body,
+			qs,
+		);
+		const jobId = response.id;
+		qs.name = 'observable-jobs';
+		// query the job result (including the report)
+		do {
+			responseData = await theHiveApiRequest.call(
+				this,
+				'GET',
+				`/connector/cortex/job/${jobId}`,
+				body,
+				qs,
+			);
+		} while (responseData.status === 'Waiting' || responseData.status === 'InProgress');
+	}
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/observable/executeResponder.operation.ts

@@ -0,0 +1,75 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { observableRLC, responderOptions } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [{ ...observableRLC, name: 'id' }, responderOptions];
+
+const displayOptions = {
+	show: {
+		resource: ['observable'],
+		operation: ['executeResponder'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const observableId = this.getNodeParameter('id', i);
+	const responderId = this.getNodeParameter('responder', i) as string;
+	let body: IDataObject;
+	let response;
+	responseData = [];
+	body = {
+		responderId,
+		objectId: observableId,
+		objectType: 'case_artifact',
+	};
+	response = await theHiveApiRequest.call(this, 'POST', '/connector/cortex/action' as string, body);
+	body = {
+		query: [
+			{
+				_name: 'listAction',
+			},
+			{
+				_name: 'filter',
+				_and: [
+					{
+						_field: 'cortexId',
+						_value: response.cortexId,
+					},
+					{
+						_field: 'objectId',
+						_value: response.objectId,
+					},
+					{
+						_field: 'startDate',
+						_value: response.startDate,
+					},
+				],
+			},
+		],
+	};
+	const qs: IDataObject = {};
+	qs.name = 'log-actions';
+	do {
+		response = await theHiveApiRequest.call(this, 'POST', '/v1/query', body, qs);
+	} while (response.status === 'Waiting' || response.status === 'InProgress');
+
+	responseData = response;
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/observable/get.operation.ts

@@ -0,0 +1,51 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { observableRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [observableRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['observable'],
+		operation: ['get'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const observableId = this.getNodeParameter('observableId', i, '', {
+		extractValue: true,
+	}) as string;
+
+	const qs: IDataObject = {};
+
+	const body = {
+		query: [
+			{
+				_name: 'getObservable',
+				idOrName: observableId,
+			},
+		],
+	};
+
+	qs.name = `get-observable-${observableId}`;
+
+	responseData = await theHiveApiRequest.call(this, 'POST', '/v1/query', body, qs);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/observable/index.ts

@@ -0,0 +1,71 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+import * as create from './create.operation';
+import * as deleteObservable from './deleteObservable.operation';
+import * as executeAnalyzer from './executeAnalyzer.operation';
+import * as executeResponder from './executeResponder.operation';
+import * as get from './get.operation';
+import * as search from './search.operation';
+import * as update from './update.operation';
+
+export { create, deleteObservable, executeAnalyzer, executeResponder, get, search, update };
+
+export const description: INodeProperties[] = [
+	{
+		displayName: 'Operation',
+		name: 'operation',
+		type: 'options',
+		noDataExpression: true,
+		required: true,
+		default: 'create',
+		options: [
+			{
+				name: 'Create',
+				value: 'create',
+				action: 'Create an observable',
+			},
+			{
+				name: 'Delete',
+				value: 'deleteObservable',
+				action: 'Delete an observable',
+			},
+			{
+				name: 'Execute Analyzer',
+				value: 'executeAnalyzer',
+				action: 'Execute analyzer on an observable',
+			},
+			{
+				name: 'Execute Responder',
+				value: 'executeResponder',
+				action: 'Execute responder on an observable',
+			},
+			{
+				name: 'Get',
+				value: 'get',
+				action: 'Get an observable',
+			},
+			{
+				name: 'Search',
+				value: 'search',
+				action: 'Search observables',
+			},
+			{
+				name: 'Update',
+				value: 'update',
+				action: 'Update an observable',
+			},
+		],
+		displayOptions: {
+			show: {
+				resource: ['observable'],
+			},
+		},
+	},
+	...create.description,
+	...deleteObservable.description,
+	...executeAnalyzer.description,
+	...executeResponder.description,
+	...get.description,
+	...search.description,
+	...update.description,
+];

packages/nodes-base/nodes/TheHiveProject/actions/observable/search.operation.ts

@@ -0,0 +1,120 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+import { NodeOperationError } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import {
+	alertRLC,
+	caseRLC,
+	genericFiltersCollection,
+	returnAllAndLimit,
+	searchOptions,
+	sortCollection,
+} from '../../descriptions';
+import type { QueryScope } from '../../helpers/interfaces';
+import { theHiveApiQuery } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		// eslint-disable-next-line n8n-nodes-base/node-param-display-name-miscased
+		displayName: 'Search in',
+		name: 'searchIn',
+		type: 'options',
+		default: 'all',
+		description:
+			'Whether to search for observables in all alerts and cases or in a specific case or alert',
+		options: [
+			{
+				name: 'Alerts and Cases',
+				value: 'all',
+			},
+			{
+				name: 'Alert',
+				value: 'alert',
+			},
+			{
+				name: 'Case',
+				value: 'case',
+			},
+		],
+	},
+	{
+		...caseRLC,
+		displayOptions: {
+			show: {
+				searchIn: ['case'],
+			},
+		},
+	},
+	{
+		...alertRLC,
+		displayOptions: {
+			show: {
+				searchIn: ['alert'],
+			},
+		},
+	},
+	...returnAllAndLimit,
+	genericFiltersCollection,
+	sortCollection,
+	searchOptions,
+];
+
+const displayOptions = {
+	show: {
+		resource: ['observable'],
+		operation: ['search'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const searchIn = this.getNodeParameter('searchIn', i) as string;
+	const filtersValues = this.getNodeParameter('filters.values', i, []) as IDataObject[];
+	const sortFields = this.getNodeParameter('sort.fields', i, []) as IDataObject[];
+	const returnAll = this.getNodeParameter('returnAll', i);
+	const { returnCount, extraData } = this.getNodeParameter('options', i);
+
+	let limit;
+	let scope: QueryScope;
+
+	if (searchIn === 'all') {
+		scope = { query: 'listObservable' };
+	} else if (searchIn === 'alert') {
+		const alertId = this.getNodeParameter('alertId', i, '', { extractValue: true }) as string;
+		scope = { query: 'getAlert', id: alertId, restrictTo: 'observables' };
+	} else if (searchIn === 'case') {
+		const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+		scope = { query: 'getCase', id: caseId, restrictTo: 'observables' };
+	} else {
+		throw new NodeOperationError(this.getNode(), `Invalid 'Search In ...' value: ${searchIn}`);
+	}
+
+	if (!returnAll) {
+		limit = this.getNodeParameter('limit', i);
+	}
+
+	responseData = await theHiveApiQuery.call(
+		this,
+		scope,
+		filtersValues,
+		sortFields,
+		limit,
+		returnCount as boolean,
+		extraData as string[],
+	);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/observable/update.operation.ts

@@ -0,0 +1,141 @@
+import set from 'lodash/set';
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+import { NodeOperationError } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { fixFieldType, prepareInputItem } from '../../helpers/utils';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		displayName: 'Fields',
+		name: 'observableUpdateFields',
+		type: 'resourceMapper',
+		default: {
+			mappingMode: 'defineBelow',
+			value: null,
+		},
+		noDataExpression: true,
+		required: true,
+		typeOptions: {
+			resourceMapper: {
+				resourceMapperMethod: 'getObservableUpdateFields',
+				mode: 'update',
+				valuesLabel: 'Fields',
+				addAllFields: true,
+				multiKeyMatch: true,
+			},
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['observable'],
+		operation: ['update'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(
+	this: IExecuteFunctions,
+	i: number,
+	item: INodeExecutionData,
+): Promise<INodeExecutionData[]> {
+	let body: IDataObject = {};
+	let updated = 1;
+
+	const dataMode = this.getNodeParameter('observableUpdateFields.mappingMode', i) as string;
+
+	if (dataMode === 'autoMapInputData') {
+		const schema = this.getNodeParameter('observableUpdateFields.schema', i) as IDataObject[];
+		body = prepareInputItem(item.json, schema, i);
+	}
+
+	if (dataMode === 'defineBelow') {
+		const observableUpdateFields = this.getNodeParameter(
+			'observableUpdateFields.value',
+			i,
+			[],
+		) as IDataObject;
+		body = observableUpdateFields;
+	}
+
+	body = fixFieldType(body);
+
+	const fieldsToMatchOn = this.getNodeParameter(
+		'observableUpdateFields.matchingColumns',
+		i,
+	) as string[];
+
+	const updateBody: IDataObject = {};
+	const matchFields: IDataObject = {};
+	const { id } = body; // id would be used if matching on id, also we need to remove it from the body
+
+	for (const field of Object.keys(body)) {
+		if (fieldsToMatchOn.includes(field)) {
+			// if field is in fieldsToMatchOn, we need to exclude it from the updateBody, as values used for matching should not be updated
+			matchFields[field] = body[field];
+		} else {
+			// use set to construct the updateBody, as it allows to process customFields.fieldName
+			// if customFields provided under customFields property, it will be send as is
+			set(updateBody, field, body[field]);
+		}
+	}
+
+	if (fieldsToMatchOn.includes('id')) {
+		await theHiveApiRequest.call(this, 'PATCH', `/v1/observable/${id}`, body);
+	} else {
+		const filter = {
+			_name: 'filter',
+			_and: fieldsToMatchOn.map((field) => ({
+				_eq: {
+					_field: field,
+					_value: matchFields[field],
+				},
+			})),
+		};
+
+		const queryBody = {
+			query: [
+				{
+					_name: 'listObservable',
+				},
+				filter,
+			],
+		};
+
+		const matches = (await theHiveApiRequest.call(
+			this,
+			'POST',
+			'/v1/query',
+			queryBody,
+		)) as IDataObject[];
+
+		if (!matches.length) {
+			throw new NodeOperationError(this.getNode(), 'No matching alerts found');
+		}
+		const ids = matches.map((match) => match._id);
+		updated = ids.length;
+
+		updateBody.ids = ids;
+
+		await theHiveApiRequest.call(this, 'PATCH', '/v1/observable/_bulk', updateBody);
+	}
+
+	const executionData = this.helpers.constructExecutionMetaData(
+		wrapData({ success: true, updated }),
+		{
+			itemData: { item: i },
+		},
+	);
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/page/create.operation.ts

@@ -0,0 +1,104 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { caseRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		// eslint-disable-next-line n8n-nodes-base/node-param-display-name-miscased
+		displayName: 'Create in',
+		name: 'location',
+		type: 'options',
+		options: [
+			{
+				name: 'Case',
+				value: 'case',
+			},
+			{
+				name: 'Knowledge Base',
+				value: 'knowledgeBase',
+			},
+		],
+		default: 'case',
+	},
+	{
+		...caseRLC,
+		displayOptions: {
+			show: {
+				location: ['case'],
+			},
+		},
+	},
+	{
+		displayName: 'Title',
+		name: 'title',
+		type: 'string',
+		default: '',
+		required: true,
+	},
+	{
+		displayName: 'Category',
+		name: 'category',
+		type: 'string',
+		default: '',
+		required: true,
+	},
+	{
+		displayName: 'Content',
+		name: 'content',
+		type: 'string',
+		default: '',
+		required: true,
+		typeOptions: {
+			rows: 2,
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['page'],
+		operation: ['create'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const location = this.getNodeParameter('location', i) as string;
+	const title = this.getNodeParameter('title', i) as string;
+	const category = this.getNodeParameter('category', i) as string;
+	const content = this.getNodeParameter('content', i) as string;
+
+	let endpoint;
+
+	if (location === 'case') {
+		const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+		endpoint = `/v1/case/${caseId}/page`;
+	} else {
+		endpoint = '/v1/page';
+	}
+
+	const body: IDataObject = {
+		title,
+		category,
+		content,
+	};
+
+	responseData = await theHiveApiRequest.call(this, 'POST', endpoint, body);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/page/deletePage.operation.ts

@@ -0,0 +1,65 @@
+import type { IExecuteFunctions, INodeExecutionData, INodeProperties } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { caseRLC, pageRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		displayName: 'Delete From ...',
+		name: 'location',
+		type: 'options',
+		options: [
+			{
+				name: 'Case',
+				value: 'case',
+			},
+			{
+				name: 'Knowledge Base',
+				value: 'knowledgeBase',
+			},
+		],
+		default: 'knowledgeBase',
+	},
+	{
+		...caseRLC,
+		displayOptions: {
+			show: {
+				location: ['case'],
+			},
+		},
+	},
+	pageRLC,
+];
+
+const displayOptions = {
+	show: {
+		resource: ['page'],
+		operation: ['deletePage'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const location = this.getNodeParameter('location', i) as string;
+	const pageId = this.getNodeParameter('pageId', i, '', { extractValue: true }) as string;
+
+	let endpoint;
+
+	if (location === 'case') {
+		const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+		endpoint = `/v1/case/${caseId}/page/${pageId}`;
+	} else {
+		endpoint = `/v1/page/${pageId}`;
+	}
+
+	await theHiveApiRequest.call(this, 'DELETE', endpoint);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData({ success: true }), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/page/index.ts

@@ -0,0 +1,50 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+import * as create from './create.operation';
+import * as deletePage from './deletePage.operation';
+import * as search from './search.operation';
+import * as update from './update.operation';
+
+export { create, deletePage, search, update };
+
+export const description: INodeProperties[] = [
+	{
+		displayName: 'Operation',
+		name: 'operation',
+		noDataExpression: true,
+		type: 'options',
+		required: true,
+		default: 'create',
+		options: [
+			{
+				name: 'Create',
+				value: 'create',
+				action: 'Create a page',
+			},
+			{
+				name: 'Delete',
+				value: 'deletePage',
+				action: 'Delete a page',
+			},
+			{
+				name: 'Search',
+				value: 'search',
+				action: 'Search pages',
+			},
+			{
+				name: 'Update',
+				value: 'update',
+				action: 'Update a page',
+			},
+		],
+		displayOptions: {
+			show: {
+				resource: ['page'],
+			},
+		},
+	},
+	...create.description,
+	...deletePage.description,
+	...search.description,
+	...update.description,
+];

packages/nodes-base/nodes/TheHiveProject/actions/page/search.operation.ts

@@ -0,0 +1,98 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import {
+	caseRLC,
+	genericFiltersCollection,
+	returnAllAndLimit,
+	sortCollection,
+	searchOptions,
+} from '../../descriptions';
+import type { QueryScope } from '../../helpers/interfaces';
+import { theHiveApiQuery } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		displayName: 'Search in Knowledge Base',
+		name: 'searchInKnowledgeBase',
+		type: 'boolean',
+		default: true,
+		description: 'Whether to search in knowledge base or only in the selected case',
+	},
+	{
+		...caseRLC,
+		displayOptions: {
+			show: {
+				searchInKnowledgeBase: [false],
+			},
+		},
+	},
+	...returnAllAndLimit,
+	genericFiltersCollection,
+	sortCollection,
+	{
+		...searchOptions,
+		displayOptions: {
+			show: {
+				returnAll: [true],
+			},
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['page'],
+		operation: ['search'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const searchInKnowledgeBase = this.getNodeParameter('searchInKnowledgeBase', i) as boolean;
+	const filtersValues = this.getNodeParameter('filters.values', i, []) as IDataObject[];
+	const sortFields = this.getNodeParameter('sort.fields', i, []) as IDataObject[];
+	const returnAll = this.getNodeParameter('returnAll', i);
+	let returnCount = false;
+	if (!returnAll) {
+		returnCount = this.getNodeParameter('options.returnCount', i, false) as boolean;
+	}
+
+	let limit;
+	let scope: QueryScope;
+
+	if (searchInKnowledgeBase) {
+		scope = { query: 'listOrganisationPage' };
+	} else {
+		const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+		scope = { query: 'getCase', id: caseId, restrictTo: 'pages' };
+	}
+
+	if (!returnAll) {
+		limit = this.getNodeParameter('limit', i);
+	}
+
+	responseData = await theHiveApiQuery.call(
+		this,
+		scope,
+		filtersValues,
+		sortFields,
+		limit,
+		returnCount,
+	);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/page/update.operation.ts

@@ -0,0 +1,120 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { caseRLC, pageRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		// eslint-disable-next-line n8n-nodes-base/node-param-display-name-miscased
+		displayName: 'Update in',
+		name: 'location',
+		type: 'options',
+		options: [
+			{
+				name: 'Case',
+				value: 'case',
+			},
+			{
+				name: 'Knowledge Base',
+				value: 'knowledgeBase',
+			},
+		],
+		default: 'case',
+	},
+	{
+		...caseRLC,
+		displayOptions: {
+			show: {
+				location: ['case'],
+			},
+		},
+	},
+	pageRLC,
+	{
+		displayName: 'Content',
+		name: 'content',
+		type: 'string',
+		default: '',
+		typeOptions: {
+			rows: 2,
+		},
+	},
+	{
+		displayName: 'Options',
+		name: 'options',
+		type: 'collection',
+		placeholder: 'Add option',
+		default: {},
+		options: [
+			{
+				displayName: 'Category',
+				name: 'category',
+				type: 'string',
+				default: '',
+			},
+			{
+				displayName: 'Title',
+				name: 'title',
+				type: 'string',
+				default: '',
+			},
+			{
+				displayName: 'Order',
+				name: 'order',
+				type: 'number',
+				default: 0,
+				typeOptions: {
+					minValue: 0,
+				},
+			},
+		],
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['page'],
+		operation: ['update'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const location = this.getNodeParameter('location', i) as string;
+	const pageId = this.getNodeParameter('pageId', i, '', { extractValue: true }) as string;
+	const content = this.getNodeParameter('content', i, '') as string;
+	const options = this.getNodeParameter('options', i, {});
+
+	let endpoint;
+
+	if (location === 'case') {
+		const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+		endpoint = `/v1/case/${caseId}/page/${pageId}`;
+	} else {
+		endpoint = `/v1/page/${pageId}`;
+	}
+
+	const body: IDataObject = options;
+
+	if (content) {
+		body.content = content;
+	}
+
+	responseData = await theHiveApiRequest.call(this, 'PATCH', endpoint, body);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/query/executeQuery.operation.ts

@@ -0,0 +1,77 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+import { NodeOperationError, jsonParse } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		displayName: 'Query',
+		name: 'queryJson',
+		type: 'json',
+		required: true,
+		default: '=[\n  {\n    "_name": "listOrganisation"\n  }\n]',
+		description: 'Search for objects with filtering and sorting capabilities',
+		hint: 'The query should be an array of operations with the required selection and optional filtering, sorting, and pagination. See <a href="https://docs.strangebee.com/thehive/api-docs/#operation/Query%20API" target="_blank">Query API</a> for more information.',
+		typeOptions: {
+			rows: 10,
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['query'],
+		operation: ['executeQuery'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const queryJson = this.getNodeParameter('queryJson', i) as string;
+
+	let query: IDataObject = {};
+	if (typeof queryJson === 'object') {
+		query = queryJson;
+	} else {
+		query = jsonParse<IDataObject>(queryJson, {
+			errorMessage: 'Query JSON must be a valid JSON object',
+		});
+	}
+
+	if (query.query) {
+		query = query.query as IDataObject;
+	}
+
+	if (!Array.isArray(query)) {
+		throw new NodeOperationError(
+			this.getNode(),
+			'The query should be an array of operations with the required selection and optional filtering, sorting, and pagination',
+		);
+	}
+
+	const body: IDataObject = {
+		query,
+	};
+
+	responseData = await theHiveApiRequest.call(this, 'POST', '/v1/query', body);
+
+	if (typeof responseData !== 'object') {
+		responseData = { queryResult: responseData };
+	}
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/query/index.ts

@@ -0,0 +1,29 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+import * as executeQuery from './executeQuery.operation';
+
+export { executeQuery };
+
+export const description: INodeProperties[] = [
+	{
+		displayName: 'Operation',
+		name: 'operation',
+		noDataExpression: true,
+		type: 'options',
+		required: true,
+		default: 'executeQuery',
+		options: [
+			{
+				name: 'Execute Query',
+				value: 'executeQuery',
+				action: 'Execute a query',
+			},
+		],
+		displayOptions: {
+			show: {
+				resource: ['query'],
+			},
+		},
+	},
+	...executeQuery.description,
+];

packages/nodes-base/nodes/TheHiveProject/actions/router.ts

@@ -0,0 +1,80 @@
+import type { IExecuteFunctions, INodeExecutionData } from 'n8n-workflow';
+import { NodeOperationError } from 'n8n-workflow';
+
+import * as alert from './alert';
+import * as case_ from './case';
+import * as comment from './comment';
+import * as log from './log';
+import type { TheHiveType } from './node.type';
+import * as observable from './observable';
+import * as page from './page';
+import * as query from './query';
+import * as task from './task';
+
+export async function router(this: IExecuteFunctions): Promise<INodeExecutionData[][]> {
+	const items = this.getInputData();
+	const returnData: INodeExecutionData[] = [];
+	const length = items.length;
+
+	const resource = this.getNodeParameter<TheHiveType>('resource', 0);
+	const operation = this.getNodeParameter('operation', 0);
+
+	let executionData: INodeExecutionData[] = [];
+
+	const theHiveNodeData = {
+		resource,
+		operation,
+	} as TheHiveType;
+
+	for (let i = 0; i < length; i++) {
+		try {
+			switch (theHiveNodeData.resource) {
+				case 'alert':
+					executionData = await alert[theHiveNodeData.operation].execute.call(this, i, items[i]);
+					break;
+				case 'case':
+					executionData = await case_[theHiveNodeData.operation].execute.call(this, i, items[i]);
+					break;
+				case 'comment':
+					executionData = await comment[theHiveNodeData.operation].execute.call(this, i);
+					break;
+				case 'log':
+					executionData = await log[theHiveNodeData.operation].execute.call(this, i, items[i]);
+					break;
+				case 'observable':
+					executionData = await observable[theHiveNodeData.operation].execute.call(
+						this,
+						i,
+						items[i],
+					);
+					break;
+				case 'page':
+					executionData = await page[theHiveNodeData.operation].execute.call(this, i);
+					break;
+				case 'query':
+					executionData = await query[theHiveNodeData.operation].execute.call(this, i);
+					break;
+				case 'task':
+					executionData = await task[theHiveNodeData.operation].execute.call(this, i, items[i]);
+					break;
+				default:
+					throw new NodeOperationError(
+						this.getNode(),
+						`The operation "${operation}" is not supported!`,
+					);
+			}
+			returnData.push(...executionData);
+		} catch (error) {
+			if (this.continueOnFail()) {
+				executionData = this.helpers.constructExecutionMetaData(
+					this.helpers.returnJsonArray({ error: error.message }),
+					{ itemData: { item: i } },
+				);
+				returnData.push(...executionData);
+				continue;
+			}
+			throw error;
+		}
+	}
+	return [returnData];
+}

packages/nodes-base/nodes/TheHiveProject/actions/task/create.operation.ts

@@ -0,0 +1,75 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { caseRLC } from '../../descriptions';
+import { fixFieldType, prepareInputItem } from '../../helpers/utils';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	caseRLC,
+	{
+		displayName: 'Fields',
+		name: 'taskFields',
+		type: 'resourceMapper',
+		default: {
+			mappingMode: 'defineBelow',
+			value: null,
+		},
+		noDataExpression: true,
+		required: true,
+		typeOptions: {
+			resourceMapper: {
+				resourceMapperMethod: 'getTaskFields',
+				mode: 'add',
+				valuesLabel: 'Fields',
+			},
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['task'],
+		operation: ['create'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(
+	this: IExecuteFunctions,
+	i: number,
+	item: INodeExecutionData,
+): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+	let body: IDataObject = {};
+
+	const dataMode = this.getNodeParameter('taskFields.mappingMode', i) as string;
+	const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+
+	if (dataMode === 'autoMapInputData') {
+		const schema = this.getNodeParameter('taskFields.schema', i) as IDataObject[];
+		body = prepareInputItem(item.json, schema, i);
+	}
+
+	if (dataMode === 'defineBelow') {
+		const taskFields = this.getNodeParameter('taskFields.value', i, []) as IDataObject;
+		body = taskFields;
+	}
+
+	body = fixFieldType(body);
+
+	responseData = await theHiveApiRequest.call(this, 'POST', `/v1/case/${caseId}/task`, body);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/task/deleteTask.operation.ts

@@ -0,0 +1,29 @@
+import type { IExecuteFunctions, INodeExecutionData, INodeProperties } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { taskRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [taskRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['task'],
+		operation: ['deleteTask'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	const taskId = this.getNodeParameter('taskId', i, '', { extractValue: true }) as string;
+
+	await theHiveApiRequest.call(this, 'DELETE', `/v1/task/${taskId}`);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData({ success: true }), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/task/executeResponder.operation.ts

@@ -0,0 +1,77 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { responderOptions, taskRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [{ ...taskRLC, name: 'id' }, responderOptions];
+
+const displayOptions = {
+	show: {
+		resource: ['task'],
+		operation: ['executeResponder'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const taskId = this.getNodeParameter('id', i);
+	const responderId = this.getNodeParameter('responder', i) as string;
+	let body: IDataObject;
+	let response;
+	responseData = [];
+
+	const qs: IDataObject = {};
+
+	body = {
+		responderId,
+		objectId: taskId,
+		objectType: 'case_task',
+	};
+	response = await theHiveApiRequest.call(this, 'POST', '/connector/cortex/action' as string, body);
+	body = {
+		query: [
+			{
+				_name: 'listAction',
+			},
+			{
+				_name: 'filter',
+				_and: [
+					{
+						_field: 'cortexId',
+						_value: response.cortexId,
+					},
+					{
+						_field: 'objectId',
+						_value: response.objectId,
+					},
+					{
+						_field: 'startDate',
+						_value: response.startDate,
+					},
+				],
+			},
+		],
+	};
+	qs.name = 'task-actions';
+	do {
+		response = await theHiveApiRequest.call(this, 'POST', '/v1/query', body, qs);
+	} while (response.status === 'Waiting' || response.status === 'InProgress');
+
+	responseData = response;
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/task/get.operation.ts

@@ -0,0 +1,49 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { taskRLC } from '../../descriptions';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [taskRLC];
+
+const displayOptions = {
+	show: {
+		resource: ['task'],
+		operation: ['get'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const taskId = this.getNodeParameter('taskId', i, '', { extractValue: true }) as string;
+
+	const qs: IDataObject = {};
+
+	const body = {
+		query: [
+			{
+				_name: 'getTask',
+				idOrName: taskId,
+			},
+		],
+	};
+
+	qs.name = `get-task-${taskId}`;
+
+	responseData = await theHiveApiRequest.call(this, 'POST', '/v1/query', body, qs);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/task/index.ts

@@ -0,0 +1,64 @@
+import type { INodeProperties } from 'n8n-workflow';
+
+import * as create from './create.operation';
+import * as deleteTask from './deleteTask.operation';
+import * as executeResponder from './executeResponder.operation';
+import * as get from './get.operation';
+import * as search from './search.operation';
+import * as update from './update.operation';
+
+export { create, deleteTask, executeResponder, get, search, update };
+
+export const description: INodeProperties[] = [
+	{
+		displayName: 'Operation',
+		name: 'operation',
+		default: 'create',
+		type: 'options',
+		noDataExpression: true,
+		required: true,
+		options: [
+			{
+				name: 'Create',
+				value: 'create',
+				action: 'Create a task',
+			},
+			{
+				name: 'Delete',
+				value: 'deleteTask',
+				action: 'Delete an task',
+			},
+			{
+				name: 'Execute Responder',
+				value: 'executeResponder',
+				action: 'Execute responder on a task',
+			},
+			{
+				name: 'Get',
+				value: 'get',
+				action: 'Get a task',
+			},
+			{
+				name: 'Search',
+				value: 'search',
+				action: 'Search tasks',
+			},
+			{
+				name: 'Update',
+				value: 'update',
+				action: 'Update a task',
+			},
+		],
+		displayOptions: {
+			show: {
+				resource: ['task'],
+			},
+		},
+	},
+	...create.description,
+	...deleteTask.description,
+	...executeResponder.description,
+	...get.description,
+	...search.description,
+	...update.description,
+];

packages/nodes-base/nodes/TheHiveProject/actions/task/search.operation.ts

@@ -0,0 +1,89 @@
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import {
+	caseRLC,
+	genericFiltersCollection,
+	returnAllAndLimit,
+	searchOptions,
+	sortCollection,
+} from '../../descriptions';
+import type { QueryScope } from '../../helpers/interfaces';
+import { theHiveApiQuery } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		displayName: 'Search in All Cases',
+		name: 'allCases',
+		type: 'boolean',
+		default: true,
+		description: 'Whether to search in all cases or only in a selected case',
+	},
+	{
+		...caseRLC,
+		displayOptions: {
+			show: {
+				allCases: [false],
+			},
+		},
+	},
+	...returnAllAndLimit,
+	genericFiltersCollection,
+	sortCollection,
+	searchOptions,
+];
+
+const displayOptions = {
+	show: {
+		resource: ['task'],
+		operation: ['search'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(this: IExecuteFunctions, i: number): Promise<INodeExecutionData[]> {
+	let responseData: IDataObject | IDataObject[] = [];
+
+	const allCases = this.getNodeParameter('allCases', i) as boolean;
+	const filtersValues = this.getNodeParameter('filters.values', i, []) as IDataObject[];
+	const sortFields = this.getNodeParameter('sort.fields', i, []) as IDataObject[];
+	const returnAll = this.getNodeParameter('returnAll', i);
+	const { returnCount, extraData } = this.getNodeParameter('options', i);
+
+	let limit;
+	let scope: QueryScope;
+
+	if (allCases) {
+		scope = { query: 'listTask' };
+	} else {
+		const caseId = this.getNodeParameter('caseId', i, '', { extractValue: true }) as string;
+		scope = { query: 'getCase', id: caseId, restrictTo: 'tasks' };
+	}
+
+	if (!returnAll) {
+		limit = this.getNodeParameter('limit', i);
+	}
+
+	responseData = await theHiveApiQuery.call(
+		this,
+		scope,
+		filtersValues,
+		sortFields,
+		limit,
+		returnCount as boolean,
+		extraData as string[],
+	);
+
+	const executionData = this.helpers.constructExecutionMetaData(wrapData(responseData), {
+		itemData: { item: i },
+	});
+
+	return executionData;
+}

packages/nodes-base/nodes/TheHiveProject/actions/task/update.operation.ts

@@ -0,0 +1,134 @@
+import set from 'lodash/set';
+import type {
+	IDataObject,
+	IExecuteFunctions,
+	INodeExecutionData,
+	INodeProperties,
+} from 'n8n-workflow';
+import { NodeOperationError } from 'n8n-workflow';
+
+import { updateDisplayOptions, wrapData } from '@utils/utilities';
+
+import { fixFieldType, prepareInputItem } from '../../helpers/utils';
+import { theHiveApiRequest } from '../../transport';
+
+const properties: INodeProperties[] = [
+	{
+		displayName: 'Fields',
+		name: 'taskUpdateFields',
+		type: 'resourceMapper',
+		default: {
+			mappingMode: 'defineBelow',
+			value: null,
+		},
+		noDataExpression: true,
+		required: true,
+		typeOptions: {
+			resourceMapper: {
+				resourceMapperMethod: 'getTaskUpdateFields',
+				mode: 'update',
+				valuesLabel: 'Fields',
+				addAllFields: true,
+				multiKeyMatch: true,
+			},
+		},
+	},
+];
+
+const displayOptions = {
+	show: {
+		resource: ['task'],
+		operation: ['update'],
+	},
+};
+
+export const description = updateDisplayOptions(displayOptions, properties);
+
+export async function execute(
+	this: IExecuteFunctions,
+	i: number,
+	item: INodeExecutionData,
+): Promise<INodeExecutionData[]> {
+	let body: IDataObject = {};
+	let updated = 1;
+
+	const dataMode = this.getNodeParameter('taskUpdateFields.mappingMode', i) as string;
+
+	if (dataMode === 'autoMapInputData') {
+		const schema = this.getNodeParameter('taskUpdateFields.schema', i) as IDataObject[];
+		body = prepareInputItem(item.json, schema, i);
+	}
+
+	if (dataMode === 'defineBelow') {
+		const taskUpdateFields = this.getNodeParameter('taskUpdateFields.value', i, []) as IDataObject;
+		body = taskUpdateFields;
+	}
+
+	body = fixFieldType(body);
+
+	const fieldsToMatchOn = this.getNodeParameter('taskUpdateFields.matchingColumns', i) as string[];
+
+	const updateBody: IDataObject = {};
+	const matchFields: IDataObject = {};
+	const { id } = body; // id would be used if matching on id, also we need to remove it from the body
+
+	for (const field of Object.keys(body)) {
+		if (fieldsToMatchOn.includes(field)) {
+			// if field is in fieldsToMatchOn, we need to exclude it from the updateBody, as values used for matching should not be updated
+			matchFields[field] = body[field];
+		} else {
+			// use set to construct the updateBody, as it allows to process customFields.fieldName
+			// if customFields provided under customFields property, it will be send as is
+			set(updateBody, field, body[field]);
+		}
+	}
+
+	if (fieldsToMatchOn.includes('id')) {
+		await theHiveApiRequest.call(this, 'PATCH', `/v1/task/${id}`, body);
+	} else {
+		const filter = {
+			_name: 'filter',
+			_and: fieldsToMatchOn.map((field) => ({
+				_eq: {
+					_field: field,
+					_value: matchFields[field],
+				},
+			})),
+		};
+
+		const queryBody = {
+			query: [
+				{
+					_name: 'listTask',
+				},
+				filter,
+			],
+		};
+
+		const matches = (await theHiveApiRequest.call(
+			this,
+			'POST',
+			'/v1/query',
+			queryBody,
+		)) as IDataObject[];
+
+		if (!matches.length) {
+			throw new NodeOperationError(this.getNode(), 'No matching alerts found');
+		}
+		const ids = matches.map((match) => match._id);
+		updated = ids.length;
+
+		updateBody.ids = ids;
+
+		await theHiveApiRequest.call(this, 'PATCH', '/v1/task/_bulk', updateBody);
+	}
+
+	const executionData = this.helpers.constructExecutionMetaData(
+		wrapData({ success: true, updated }),
+		{
+			itemData: { item: i },
+		},
+	);
+
+	return executionData;
+}