Manage TheHive Security Incidents
Manage TheHive security incident response - alerts, cases, tasks, observables, and Cortex analyzers - from an AI assistant.
Why it matters
Automate and streamline your security incident response by providing standardized access to TheHive's case management, alert processing, and observable tracking capabilities. Integrate seamlessly with Cortex for enhanced analysis.
Outcomes
What it gets done
Manage TheHive cases, alerts, and observables
Automate alert processing and conversion to cases
Track and analyze observables with similarity detection
Integrate with Cortex for automated analysis
Install
Add it to your toolbox
Run in your project directory:
curl -fsSL https://spark.entire.vc/get/vb-thehive-mcp-server | bash Capabilities
Tools your agent gets
Add attachments to cases
Assign tasks to users
Delete multiple alerts at once
Delete multiple observables at once
Merge multiple alerts into a case
Update multiple alerts at once
Update multiple cases at once
Update multiple observables at once
Overview
TheHive MCP Server
TheHive MCP Server gives Claude tools to manage TheHive alerts, cases, tasks, and observables, including running Cortex analyzers and responders. Use it for conversational SOC/incident-response workflows in TheHive. Review bulk operations before running them since they can affect many records at once.
What it does
TheHive MCP Server integrates TheHive's security incident response platform with MCP clients, exposing tools to manage alerts, cases, tasks, observables, and Cortex analyzer/responder jobs.
When to use - and when NOT to
Use it to triage and manage incident response work conversationally: create or update alerts, promote/merge alerts into cases, assign and track tasks, add and analyze observables, or run Cortex analyzers and responders on indicators. It requires a running TheHive instance and API key, and operates directly on live case/alert data - since bulk operations (bulk_delete_alerts, bulk_update_cases, etc.) can affect many records at once, review bulk actions before running them.
Capabilities
- Alerts:
create_alert,get_alert(s),update_alert,delete_alert,count_alerts,follow_alert/unfollow_alert,promote_alert_to_case,merge_alert_into_case,bulk_merge_alerts_into_case,bulk_update_alerts,bulk_delete_alerts,import_alert_into_case. - Cases:
create_case,get_case(s),update_case,close_case,delete_case,merge_cases,count_cases,bulk_update_cases, plus case pages, procedures, comments, and attachments (create_case_page,create_case_procedure,add_case_attachment,download_case_attachment,delete_case_attachment). - Tasks:
create_task,get_task(s),assign_task,start_task,complete_task,update_task,delete_task,create_task_log,bulk_update_tasks,count_tasks. - Observables:
create_observable_in_alert/create_observable_in_case,get_observable(s),update_observable,delete_observable,share_observable/unshare_observable,get_alert_similar_observables/get_case_similar_observables,bulk_update_observables,bulk_delete_observables,count_observables. - Cortex integration:
list_cortex_analyzers(_by_type),get_cortex_analyzer,run_observable_analyzer(s),create_cortex_analyzer_job,get_cortex_analyzer_job,get_observable_analyzer_jobs,list_cortex_responders,create_cortex_responder_action.
How to install
uvx thehive-mcp-server
Configure Claude Desktop:
{
"mcpServers": {
"thehive-mcp-server": {
"command": "uvx",
"args": ["thehive-mcp-server"],
"env": {
"HIVE_URL": "https://your-thehive-host:9000",
"HIVE_API_KEY": "your-api-key"
}
}
}
}
Requires a running TheHive instance and API key (HIVE_URL, HIVE_API_KEY). Built on the official thehive4py client library, installed automatically as a dependency.
Who it's for
SOC analysts and incident responders using TheHive who want an AI assistant to help triage alerts, manage cases and tasks, and run Cortex analyzers on observables.
Source README
TheHive MCP Server
A Model Context Protocol (MCP) server implementation for TheHive, enabling seamless integration with MCP clients. This project provides a standardized way to interact with TheHive's security incident response platform through the Model Context Protocol.
Implemented MCP Tools
The following MCP tools are implemented and available:
- add_case_attachment
- assign_task
- bulk_delete_alerts
- bulk_delete_observables
- bulk_merge_alerts_into_case
- bulk_update_alerts
- bulk_update_cases
- bulk_update_observables
- bulk_update_tasks
- close_case
- complete_task
- count_alerts
- count_cases
- count_observables
- count_tasks
- create_alert
- create_alert_observable
- create_case
- create_case_observable
- create_case_page
- create_case_procedure
- create_case_task
- create_cortex_analyzer_job
- create_cortex_responder_action
- create_observable_in_alert
- create_observable_in_case
- create_task
- create_task_log
- delete_alert
- delete_case
- delete_case_attachment
- delete_observable
- delete_task
- download_case_attachment
- find_alert_observables
- find_case_attachments
- find_case_comments
- find_case_observables
- find_case_pages
- find_case_procedures
- find_case_tasks
- find_task_logs
- follow_alert
- get_alert
- get_alert_similar_observables
- get_alerts
- get_case
- get_case_similar_observables
- get_cases
- get_cortex_analyzer
- get_cortex_analyzer_job
- get_observable
- get_observable_analyzer_jobs
- get_observables
- get_task
- get_tasks
- import_alert_into_case
- list_cortex_analyzers
- list_cortex_analyzers_by_type
- list_cortex_responders
- merge_alert_into_case
- merge_cases
- promote_alert_to_case
- run_observable_analyzer
- run_observable_analyzers
- share_observable
- start_task
- unfollow_alert
- unshare_observable
- update_alert
- update_case
- update_observable
- update_task
Setup
Dependencies
This project depends on the official TheHive client library (thehive4py). It will be automatically installed when you install this package.
Environment Variables
Set the following environment variables:
HIVE_URL=<your-thehive-url> # Required: TheHive instance URL (e.g., https://thehive.company.com:9000)
HIVE_API_KEY=<your-thehive-api-key> # Required: API key for authenticating with TheHive instance
Usage with Claude Desktop
Add to your claude_desktop_config.json:
{
"mcpServers": {
"thehive-mcp-server": {
"command": "uvx",
"args": ["thehive-mcp-server"],
"env": {
"HIVE_URL": "https://your-thehive-host:9000",
"HIVE_API_KEY": "your-api-key"
}
}
}
}
Alternative configuration using uv:
{
"mcpServers": {
"thehive-mcp-server": {
"command": "uv",
"args": [
"--directory",
"/path/to/mcp",
"run",
"python",
"-m",
"thehive_mcp.main"
],
"env": {
"HIVE_URL": "https://your-thehive-host:9000",
"HIVE_API_KEY": "your-api-key"
}
}
}
}
Replace /path/to/mcp with the actual path to the root directory where you've cloned the repository.
Manual Execution
You can also run the server manually:
# Install dependencies
pip install .
# Set environment variables
export HIVE_URL="http://localhost:9000"
export HIVE_API_KEY="your-api-key"
# Run the server
python -m thehive_mcp
FAQ
Common questions
Discussion
Questions & comments · 0
Sign In Sign in to leave a comment.