Skip to content
FlowHubFluxonLab
Email (IMAP)
Monitoring & Incident ResponseproFluxonLab library

Email to TheHive Alert Triage

by FluxonLab Importadapted from CortexUpdated May 2026
RequiresEmail (IMAP)Email (IMAP)
Share Post Share
ERIMAP EmailTHTheHiveTHCreate CaseTHCaseTHObservableTHAnalyzer EmailCoCortexIfIFTHUpdate Case DomainUpdate Case Dom…THUpdate Case EmailUpdate Case Ema…THUpdate Case IpWaWaitTHEmail ReputationTHOTX IPTHOTX DOMAIN1234567891011121314
1/5
STEPS · 14
Execution path through the workflow

Reads incoming IMAP emails, creates TheHive alerts and runs Cortex analyzers, waiting between observable enrichment steps.

Tags

email-(imap)manualcortexthehivecomplexsupport-communication
Connects
emailimapEmail (IMAP)
CategoryMonitoring & Incident Response
Triggermanual
Complexitycomplex
Nodes15
AddedMay 9, 2026