Leina 
Wanta 
Review Security Alerts
List alerts and read a selected alert.
/oo TheHive 5: List alerts, get alert [ID] and summarize its returned investigation context.
Connect TheHive 5 to Your AI Agent
Use AI with TheHive 5 to inspect security alerts and create a case from supplied investigation details.
6 tools API key
Try a TheHive 5 Task
Copy a prompt into your agent with the oo Skill installed. Add your page links and source notes before running it.
oo Skill TheHive 5
Create an Investigation Case
Create a case with supplied title and description.
/oo TheHive 5: Create case titled [title], description [description], assignee [assignee].
Start Working with TheHive 5
-
Install OOMOL
Set up oo CLI and the oo Skill in your agent.
Install OOMOL → -
Connect TheHive 5
Provide a TheHive 5 API key and public instance URL.
Connect TheHive 5 → -
Give Your Agent a Task
Use /oo with the pages to read, the changes to make, and where to save the result.
Connection Guide →
Choose Your Agent
- Access to the target TheHive organization and alert or case resources.
- Alert creation requires type, source, sourceRef, title and description, and excludes file observables.
TheHive 5 Tools
Use AI with TheHive 5 to inspect security alerts and create a case from supplied investigation details.
Review Security Alerts
List alerts and read a selected alert.
Create an Investigation Case
Create a case with supplied title and description.
6 tools
Create Alert
Create a JSON alert without file observables in a TheHive 5 instance.
thehive5.create_alert Get Alert
Retrieve one TheHive 5 alert by ID.
thehive5.get_alert List Alerts
List alerts visible to the connected TheHive 5 user.
thehive5.list_alerts Create Case
Create a case in a TheHive 5 instance.
thehive5.create_case Get Case
Retrieve one TheHive 5 case by ID or numeric reference.
thehive5.get_case List Cases
List cases visible to the connected TheHive 5 user.
thehive5.list_cases No matching tools.
Frequently Asked Questions
Can I include file observables in JSON alert creation?
The supported JSON alert action excludes file observables.
What does a case require?
create_case requires a title and description, with optional investigation metadata.
What should I specify in my request?
Alert creation requires type, source, sourceRef, title and description, and excludes file observables.