N8n thehive velociraptor workflow

★ 7.0 · n8n · simple · 5 nodes

N8n thehive velociraptor workflow is an n8n automation template for SOC and incident response teams that connects TheHive (incident management platform) and Velociraptor (forensics and artifact collection tool) into a unified IR pipeline. Reach for it when a new alert in TheHive should automatically trigger forensic collection on the affected host, when analysts waste time switching manually between the ticketing system and the Velociraptor console, or when IR steps need to be documented without copy-pasting data between tools. The template is based on content from the Packt Publishing Incident Response book; it runs on a webhook trigger and integrates with TheHive. Use only on authorized systems and within the lawful scope of your IR team's mandate. Trigger: webhook. Integrations: TheHive. Direction — incident response automation with forensic collection, not threat detection or monitoring (see dedicated SIEM templates in the catalogue for that). Suitable for teams already running both TheHive and Velociraptor; not a fit if neither platform is in your stack.