Configure a Transformation Node#

6.0 manageOrchestrator/writeWorkflows One

Transformation nodes process or manipulate data within workflows in TheHive Flow. They allow you to perform custom operations that modify, extract, or format information as it moves through the workflow.

Configure a Set local variable node#

A Set local variable node creates one or more local variables during workflow execution—it does not modify existing ones. If two nodes declare a variable with the same name, both coexist and are each referenced by their node name. Variables accumulate in the workflow context as execution progresses.

To update a value, add a new Set local variable node downstream with the desired variable name, and reference the earlier value.

Global variables

To reuse the same values across multiple workflows, create global variables from the Global variables tab in the Flow view. These values are defined at the organization level and can't be modified within workflows.

Go to the Flow view from the sidebar menu.
Select a workflow from the list.
Drag the previous node connector to an empty area of the canvas.
In the What is the next step? drawer, select Transformations.
Select Set local variable.
Select in the Variables section.
In the Set local variable drawer, enter the following information:

Fields marked with * are mandatory.

- Name *

The identifier for the variable.

- Type *

The data type of the variable: string, number, boolean, array, or json.

- Value *

The value assigned to the variable.

Supported formats include:
- Static values
- References to other variables, using the $var button
- jq expressions
Variables

Insert a variable with the $var button, or type $ and select a variable from the suggestions. To access a field, select the variable to edit its jq expression, or use the + button to insert the variable and the field together.

Secret global variables

The value can't reference a secret global variable because the resolved value would appear in plain text in the execution logs.

Use an online jq playground to validate your expressions before adding them to the workflow.
Examples
- "Case $caseNumber – severity $caseSeverity"
- if $caseSeverity >= 3 then "High" else "Low" end
- {number: $caseNumber, assignee: $caseAssignee, title: $caseTitle}
You can select to add multiple variables in the same node.

Optional: Select Add options to configure the following settings.

- Timeout & retry

Configure how the node handles execution time limits and failure recovery.

If no timeout is configured, the node runs until it completes or the workflow-level timeout is reached. If the timeout is reached, the node fails.

Global timeout vs. local timeout

A timeout for the entire workflow is defined when creating the workflow. When both a node timeout and a workflow-level timeout are defined, the shortest timeout value is applied.

Field	Description
Timeout	Maximum allowed execution time for the node, in seconds, minutes, or hours. The minimum value is 30 seconds.
Retry attempts	Number of times the node is retried on failure.
Retry delay	Time to wait between retry attempts, in seconds, minutes, or hours. Always set it when retry attempts are configured: without a delay, retries are effectively never scheduled.
Backoff	Coefficient applied to the retry delay to increase the wait time after each failed attempt.

Retries and timeouts

If the node includes retry settings, the timeout applies to each attempt, not to the total duration of all attempts.

- Execution configuration

Set the Execution mode to control how the node behaves when several branches converge on it.

Mode	Behavior
Execute once per branch	The node runs once for each incoming branch. Applies when this section is not configured.
Wait for all branches	The node waits for all incoming branches to complete, then runs once.

Execution output

When executed, the node returns the value assigned to the variable as the output.

To access the output, select your Set local variable node and then select in the top-right corner of the screen. Hover over the output name to view its details.

This output can then be reused as an output variable in subsequent nodes, using the $var button or by typing $ and selecting the variable from the suggestions. The inserted reference is displayed as $<node_name>.<field_name>.

Configure a Python code node#

A Python code node executes custom Python scripts within a workflow. Use it for advanced data transformations, integration with external tools, or any logic that can't be handled by standard nodes.

Go to the Flow view from the sidebar menu.
Select a workflow from the list.
Drag the previous node connector to an empty area of the canvas.
In the What is the next step? drawer, select Transformations.
Select Python code.
In the Python code drawer, enter your Python script in the editor.
- You can use libraries available in the configured execution image. The default image ships the Python standard library only. Providing additional libraries requires a custom execution image configured on the deployment.
- You can use variables.
- Under Environment, you can define environment variables the script can read. Each value can reference a variable.
Using variables in Python scripts

To insert a variable, use the $var button and assign it to a variable in your script:
```
<var_name> = $<var>
```
Variables are scoped to the script by default. To make a value available to the workflow and reuse it as an output variable in later nodes, you must explicitly return it as a workflow output using flow.set():
```
flow.set("<var_name>", <var_name>)
```
For values stored as files, such as large or binary content, use flow.get_file() and flow.set_file() instead: they hand you a file path to read from or write to, instead of loading the whole value into the script.
- flow.get_file("<variable>") returns the path of a file made available to the script for a variable holding a file reference. Read it with normal file operations.
- flow.set_file("<name>", "<path>") registers a file written by the script as an output variable. The file is stored after the run, and the output carries its file reference.
See Examples for real-world use cases.
Accessing a field from a variable

To access a field, type .<field_name> directly after the variable.

Optional: Select Add options to configure the following settings.

- Timeout & retry

Configure how the node handles execution time limits and failure recovery.

If no timeout is configured, the node runs until it completes or the workflow-level timeout is reached. If the timeout is reached, the node fails.

Global timeout vs. local timeout

A timeout for the entire workflow is defined when creating the workflow. When both a node timeout and a workflow-level timeout are defined, the shortest timeout value is applied.

Field	Description
Timeout	Maximum allowed execution time for the node, in seconds, minutes, or hours. The minimum value is 30 seconds.
Retry attempts	Number of times the node is retried on failure.
Retry delay	Time to wait between retry attempts, in seconds, minutes, or hours. Always set it when retry attempts are configured: without a delay, retries are effectively never scheduled.
Backoff	Coefficient applied to the retry delay to increase the wait time after each failed attempt.

Retries and timeouts

If the node includes retry settings, the timeout applies to each attempt, not to the total duration of all attempts.

- Execution configuration

Set the Execution mode to control how the node behaves when several branches converge on it.

Mode	Behavior
Execute once per branch	The node runs once for each incoming branch. Applies when this section is not configured.
Wait for all branches	The node waits for all incoming branches to complete, then runs once.

Execution outputs

When executed, the node returns the following outputs. Each output is a JSON value:

Output	Type	Description
`script_out`	string	The raw output returned by the script.
`script_code`	number	The exit code returned by the script. `0` indicates success.
`script_image`	string	The Docker image digest used to run the script.
custom output	any	Any additional outputs defined using `flow.set()`.

To access outputs, select your Python code node and then select in the top-right corner of the screen. Hover over each output name to view its details.

These outputs can then be reused as output variables in subsequent nodes, using the $var button or by typing $ and selecting the output from the suggestions. Inserted references are displayed in the following form:

$<node_name>.script_out: to get the raw script output
$<node_name>.script_code: to get the exit code
$<node_name>.script_image: to get the Docker image digest used to run the script
$<node_name>.<custom_output>: to get a value you exposed with flow.set()

Configure a JavaScript code node#

A JavaScript code node executes custom JavaScript scripts within a workflow. Use it for advanced data transformations, integration with external tools, or any logic that can't be handled by standard nodes.

Go to the Flow view from the sidebar menu.
Select a workflow from the list.
Drag the previous node connector to an empty area of the canvas.
In the What is the next step? drawer, select Transformations.
Select JavaScript code.
In the JavaScript code drawer, enter your JavaScript script in the editor.
- You can use libraries available in the configured execution image. The default image ships the Node.js built-in modules only. Providing additional libraries requires a custom execution image configured on the deployment.
- You can use variables.
- Under Environment, you can define environment variables the script can read. Each value can reference a variable.
Using variables in JavaScript scripts

To insert a variable, use the $var button and assign it to a variable in your script:
```
let <var_name> = $<var>;
```
Variables are scoped to the script by default. To make a value available to the workflow and reuse it as an output variable in later nodes, you must explicitly return it as a workflow output using flow.set():
```
flow.set("<var_name>", <var_name>);
```
For values stored as files, such as large or binary content, use flow.get_file() and flow.set_file() instead: they hand you a file path to read from or write to, instead of loading the whole value into the script.
- flow.get_file("<variable>") returns the path of a file made available to the script for a variable holding a file reference. Read it with normal file operations.
- flow.set_file("<name>", "<path>") registers a file written by the script as an output variable. The file is stored after the run, and the output carries its file reference.
See Examples for real-world use cases.
Accessing a field from a variable

To access a field, type .<field_name> directly after the variable.

Optional: Select Add options to configure the following settings.

- Timeout & retry

Configure how the node handles execution time limits and failure recovery.

If no timeout is configured, the node runs until it completes or the workflow-level timeout is reached. If the timeout is reached, the node fails.

Global timeout vs. local timeout

A timeout for the entire workflow is defined when creating the workflow. When both a node timeout and a workflow-level timeout are defined, the shortest timeout value is applied.

Field	Description
Timeout	Maximum allowed execution time for the node, in seconds, minutes, or hours. The minimum value is 30 seconds.
Retry attempts	Number of times the node is retried on failure.
Retry delay	Time to wait between retry attempts, in seconds, minutes, or hours. Always set it when retry attempts are configured: without a delay, retries are effectively never scheduled.
Backoff	Coefficient applied to the retry delay to increase the wait time after each failed attempt.

Retries and timeouts

If the node includes retry settings, the timeout applies to each attempt, not to the total duration of all attempts.

- Execution configuration

Set the Execution mode to control how the node behaves when several branches converge on it.

Mode	Behavior
Execute once per branch	The node runs once for each incoming branch. Applies when this section is not configured.
Wait for all branches	The node waits for all incoming branches to complete, then runs once.

Execution outputs

When executed, the node returns the following outputs. Each output is a JSON value:

Output	Type	Description
`script_out`	string	The raw output returned by the script.
`script_code`	number	The exit code returned by the script. `0` indicates success.
`script_image`	string	The Docker image digest used to run the script.
custom output	any	Any additional outputs defined using `flow.set()`.

To access outputs, select your JavaScript code node and then select in the top-right corner of the screen. Hover over each output name to view its details.

These outputs can then be reused as output variables in subsequent nodes, using the $var button or by typing $ and selecting the output from the suggestions. Inserted references are displayed in the following form:

$<node_name>.script_out: to get the raw script output
$<node_name>.script_code: to get the exit code
$<node_name>.script_image: to get the Docker image digest used to run the script
$<node_name>.<custom_output>: to get a value you exposed with flow.set()

Examples#

The following examples demonstrate common use cases for the Python code node.

Multi-criteria alert scoring#

Calculates a priority score (0–100) and a priority level (P1–P4) based on severity, asset criticality, and enrichment results.

severity = $severity
asset_criticality = $asset_criticality
vt_verdict = $vt_verdict
ioc_matched = $ioc_matched

severity_scores = {"low": 10, "medium": 30, "high": 60, "critical": 90}
score = severity_scores.get(severity, 0)
score += min(int(asset_criticality or 1) * 5, 25)
if vt_verdict == "malicious":
    score += 40
if ioc_matched:
    score += 30
score = min(score, 100)
priority = "P1" if score >= 80 else "P2" if score >= 60 else "P3" if score >= 40 else "P4"
flow.set("score", score)
flow.set("priority", priority)

SIEM/EDR payload normalization#

Maps source-specific field names from SIEM or EDR payloads to a consistent set of output fields, regardless of the source system.

source_type = $source_type
raw_payload = $raw_payload

mapping = {
    "siem": ("SourceIP", "UserName", "ComputerName"),
    "edr":  ("local_ip", "user_name", "device_name")
}

ip_k, user_k, host_k = mapping.get(source_type, ("src_ip", "user", "hostname"))

src_ip = raw_payload.get(ip_k, "")
user = raw_payload.get(user_k, "")
hostname = raw_payload.get(host_k, "")

flow.set("src_ip", src_ip)
flow.set("user", user)
flow.set("hostname", hostname)

Configure a Transformation Node#

Configure a Set local variable node#

Configure a Python code node#

Configure a JavaScript code node#

Examples#

Multi-criteria alert scoring#

SIEM/EDR payload normalization#

Next steps