{
	"name": "TheHive Observable Create Test Workflow",
	"nodes": [
		{
			"parameters": {},
			"type": "n8n-nodes-base.manualTrigger",
			"typeVersion": 1,
			"position": [0, 0],
			"id": "manual-trigger",
			"name": "When clicking 'Execute Workflow'"
		},
		{
			"parameters": {
				"resource": "observable",
				"operation": "create",
				"createIn": "case",
				"id": {
					"__rl": true,
					"mode": "id",
					"value": "~123789"
				},
				"dataType": "domain",
				"data": "malicious.example.com",
				"observableFields": {
					"mappingMode": "defineBelow",
					"value": {
						"message": "Suspicious domain detected in analysis",
						"tags": "malware,suspicious",
						"tlp": 2,
						"pap": 2,
						"ioc": true,
						"sighted": false
					}
				}
			},
			"type": "n8n-nodes-base.theHiveProject",
			"typeVersion": 1,
			"position": [200, 0],
			"id": "thehive-node",
			"name": "TheHive Observable Create",
			"credentials": {
				"theHiveProjectApi": {
					"id": "thehive-creds",
					"name": "TheHive API Credentials"
				}
			}
		}
	],
	"pinData": {
		"TheHive Observable Create": [
			{
				"json": {
					"_id": "~456789",
					"_type": "Observable",
					"data": "malicious.example.com",
					"dataType": "domain",
					"message": "Suspicious domain detected in analysis",
					"tags": ["malware", "suspicious"],
					"tlp": 2,
					"pap": 2,
					"ioc": true,
					"sighted": false,
					"createdAt": 1698753600000,
					"updatedAt": 1698753600000
				}
			}
		]
	},
	"connections": {
		"When clicking 'Execute Workflow'": {
			"main": [
				[
					{
						"node": "TheHive Observable Create",
						"type": "main",
						"index": 0
					}
				]
			]
		}
	},
	"active": false,
	"settings": {
		"executionOrder": "v1"
	}
}