TheHive/Cortex API

thehive-cli case create --title <t>

Manage incident response cases in TheHive with the CLI, creating cases and correlating artifacts with Cortex.

Run it when you want IR case management from the command line: thehive-cli case create registers the case (title, severity, description) in TheHive — the case management platform (with Cortex integration for artifact analysis). It's the reference IR platform (from StrangeBee): cases with artifacts, tasks, and analyses. In the SOC, TheHive is case management: the case created via CLI (or UI) and artifacts correlated with Cortex (IOC analyses).

Don't use it without the platform: thehive-cli requires the TheHive server and API key — infrastructure is the requirement. And watch out: TheHive case is built with the SOC flow (tasks, observables, alerts) — SIEM integration (alerts to TheHive) is part of the mature flow. TheHive API (v4/v5) has its schema: consult the documentation. For interactive analyst work, use TheHive UI; CLI is for programmatic operations (creation from alerts).