diff --git a/docs/nodes/credentials/Cortex/README.md b/docs/nodes/credentials/Cortex/README.md
new file mode 100644
index 000000000..fe504c1a7
--- /dev/null
+++ b/docs/nodes/credentials/Cortex/README.md
@@ -0,0 +1,19 @@
+# Cortex
+
+You can find information about the operations supported by the Cortex node on the [integrations](./integrations/n8n-nodes-base.cortex) page. You can also browse the source code of the node on [Github](https://github.com/n8n-io/n8n/tree/master/packages/nodes-base/nodes/Cortex).
+
+## Pre-requisites
+
+Have access to a Cortex instance.   
+Ask admin for an API key.
+
+## Using Access Token
+
+1. Open your Cortex dashboard.
+2. Click on your user icon in the top right of the window.
+3. Click on the Settings button.
+4. Click on the 'Reveal' button at the bottom.
+5. Use the API key with your Cortex instance URL to create your Cortex node credentials in n8n.
+
+
+![Getting Cortex credentials](./using-access-token.gif)
diff --git a/docs/nodes/credentials/Cortex/using-access-token.gif b/docs/nodes/credentials/Cortex/using-access-token.gif
new file mode 100644
index 000000000..4c9afc2af
Binary files /dev/null and b/docs/nodes/credentials/Cortex/using-access-token.gif differ
diff --git a/docs/nodes/credentials/TheHive/README.md b/docs/nodes/credentials/TheHive/README.md
new file mode 100644
index 000000000..a3dd5d14c
--- /dev/null
+++ b/docs/nodes/credentials/TheHive/README.md
@@ -0,0 +1,19 @@
+# TheHive
+
+You can find information about the operations supported by the TheHive node on the [integrations](https://n8n.io/integrations/n8n-nodes-base.thehive) page. You can also browse the source code of the node on [Github](https://github.com/n8n-io/n8n/tree/master/packages/nodes-base/nodes/TheHive).
+
+## Pre-requisites
+
+Have access to TheHive instance.   
+Have an org-admin account
+
+## Using Access Token
+
+1. Open your TheHive dashboard.
+2. Click on 'Organization' in the top right.
+3. Click on 'Users' Tab.
+4. Choose the right user, then click on 'Create Api Key' button.
+5. Use copied API key and your TheHive instance URL in your TheHive node credentials in n8n. Don't forget to choose the API version
+
+
+![Getting TheHive credentials](./using-access-token.gif)
diff --git a/docs/nodes/credentials/TheHive/using-access-token.gif b/docs/nodes/credentials/TheHive/using-access-token.gif
new file mode 100644
index 000000000..ce186290a
Binary files /dev/null and b/docs/nodes/credentials/TheHive/using-access-token.gif differ
diff --git a/docs/nodes/nodes-library/nodes/Cortex/README.md b/docs/nodes/nodes-library/nodes/Cortex/README.md
new file mode 100644
index 000000000..04fb43e5f
--- /dev/null
+++ b/docs/nodes/nodes-library/nodes/Cortex/README.md
@@ -0,0 +1,43 @@
+---
+permalink: /nodes/n8n-nodes-base.cortex
+---
+
+# Cortex
+
+Cortex offers a powerful observable (URL, file, IP, etc) analysis mechanism. It helps SOCs, CSIRTs and security researchers to analyze collected observables using a single tool instead of several, respond to threats and interact with the constituency and other teams.
+
+::: tip 🔑 Credentials
+You can find authentication information for this node [here](../../../credentials/Cortex/README.md).
+:::
+
+## Basic Operations
+
+- Analyzer
+    - Execute
+- Responder
+    - Execute 
+- Job
+    - Get Job
+    - Get Report
+## Example Usage
+
+This workflow allows you to analyze an URL and get the tool report. This example usage workflow uses the following two nodes.
+- [Start](../../core-nodes/Start/README.md)
+- [Cortex]()
+
+The final workflow should look like the following image.
+
+![A workflow with the Cortex node](./workflow.png)
+
+### 1. Start node
+
+The start node exists by default when you create a new workflow.
+
+### 2. Cortex node
+
+1. First of all, you'll have to enter credentials for the Cortex node. You can find out how to do that [here](../../../credentials/Cortex/README.md).
+2. Choose an Analyzer (that support URL, exp Abuse Finder) under the *Analyzer Type* field.
+3. Select the 'URL' option under the *Observable Type* field.
+4. Enter the URL to be analyzed under the *Observable Value* field.
+5. Choose TLP level, cache and timeout (Optionals).
+6. Click on *Execute Node* to run the workflow.
diff --git a/docs/nodes/nodes-library/nodes/Cortex/workflow.png b/docs/nodes/nodes-library/nodes/Cortex/workflow.png
new file mode 100644
index 000000000..694ffe1e4
Binary files /dev/null and b/docs/nodes/nodes-library/nodes/Cortex/workflow.png differ
diff --git a/docs/nodes/nodes-library/nodes/TheHive/README.md b/docs/nodes/nodes-library/nodes/TheHive/README.md
new file mode 100644
index 000000000..253d24dd0
--- /dev/null
+++ b/docs/nodes/nodes-library/nodes/TheHive/README.md
@@ -0,0 +1,84 @@
+---
+permalink: /nodes/n8n-nodes-base.TheHive
+---
+
+# TheHive
+
+[TheHive](https://thehive-project.org/) is a scalable 4-in-1 open source and free security incident response platform designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner. Thanks to Cortex, the powerful analysis engine It offers an easy way to investigate security incidents, plus you can actively respond to the threats and interact with other parties using Cortex responders.
+
+::: tip 🔑 Credentials
+You can find authentication information for this node [here](../../../credentials/TheHive/README.md).
+:::
+
+## Basic Operations
+
+- Alert
+    - List alerts
+    - Fetch one alert
+    - Create an alert
+    - Update an alert
+    - Search alerts
+    - Count alerts (API v1 only)
+    - Merge an alert into existing Case
+    - Promote an alert into new Case
+    - Execute a responder
+- Observable
+    - List observables
+    - Fetch one observable
+    - Create an observable
+    - Update an observable
+    - Search observables
+    - Count observables (API v1 only)
+    - Execute an analyzer
+    - Execute a responder
+- Case
+    - List cases
+    - Fetch one case
+    - Create a case
+    - Update a case
+    - Search cases
+    - Count cases (API v1 only)
+    - Execute a responder
+- Task
+    - List task (specified Case)
+    - Fetch one task
+    - Create a task
+    - Update a task
+    - Search tasks
+    - Count tasks (API v1 only)
+    - Execute a responder
+- Log
+    - List logs
+    - Fetch one log
+    - Create a log
+    - Execute a responder
+
+## Example Usage
+
+This workflow allows you to create a case in TheHive. You can also find the [workflow]() on the website. This example usage workflow would use the following two nodes.
+- [Start](../../core-nodes/Start/README.md)
+- [TheHive]()
+
+The final workflow should look like the following image.
+
+![A workflow with the TheHive node](./workflow.png)
+
+### 1. Start node
+
+The start node exists by default when you create a new workflow.
+
+### 2. TheHive node
+
+1. First of all, you'll have to enter credentials for the TheHive node. You can find out how to do that [here](../../../credentials/TheHive/README.md).
+2. Choose 'Case' in *Resource* field.
+3. Choose 'Create' in *Operation* field
+4. Enter case title in *Title* field. 
+5. Enter case description in *Description* field.
+6. Choose case severity in *Severity* field.
+7. Choose case start date in *Start Date* field.
+8. Enter case owner in *Owner* field
+9. Toggle *Flag* field
+10. Choose case TLP level in *TLP* field.
+11. Enter case tags (separated by comma) in *Tags* field.
+12. (Optional) Add any additional attributes, and provide their values. 
+13. Click on *Execute Node* to run the workflow.
diff --git a/docs/nodes/nodes-library/nodes/TheHive/workflow.png b/docs/nodes/nodes-library/nodes/TheHive/workflow.png
new file mode 100644
index 000000000..8cc39d399
Binary files /dev/null and b/docs/nodes/nodes-library/nodes/TheHive/workflow.png differ
diff --git a/docs/nodes/nodes-library/trigger-nodes/TheHiveTrigger/README.md b/docs/nodes/nodes-library/trigger-nodes/TheHiveTrigger/README.md
new file mode 100644
index 000000000..7ebd2b87f
--- /dev/null
+++ b/docs/nodes/nodes-library/trigger-nodes/TheHiveTrigger/README.md
@@ -0,0 +1,61 @@
+---
+permalink: /nodes/n8n-nodes-base.theHiveTrigger
+---
+
+# TheHive Trigger
+
+[TheHive](https://thehive-project.org/) is a scalable 4-in-1 open source and free security incident response platform designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioners
+
+::: tip 🔑 Credentials
+You can find authentication information for this node [here](../../../credentials/TheHive/README.md).
+:::
+
+
+## Example Usage
+
+This workflow allows you to receive event from a TheHive instance via TheHive Trigger node. You can also find the [workflow]() on the website. This example usage workflow would use the following node.
+- [TheHive Trigger]()
+
+The final workflow should look like the following image.
+
+![A workflow with the TheHive Trigger node](./workflow.png)
+
+
+### 1. TheHive Trigger node
+
+1. First of all, you'll have to add the webhook URL into TheHive instance configuration.
+2. Select the *events* that you are interested in.
+3. Click on *Execute Node* to run the workflow.
+
+
+###  Webhook configuration [docs](https://github.com/TheHive-Project/TheHiveDocs/blob/master/TheHive4/Administration/Webhook.md)
+
+To configure the webhook into TheHive instance you need   
+1. Copy the webhook URL from TheHive-Trigger node
+2. Add configuration lines to application.conf (TheHive configuration file)
+    ```
+    notification.webhook.endpoints = [
+        {
+            name: WEBHOOK_NAME
+            url: WEBHOOK_URL
+            version: 0
+            wsConfig: {}
+            includedTheHiveOrganisations: ["ORGANIZATION_NAME"]
+            excludedTheHiveOrganisations: []
+        }
+    ]
+    ```
+3. Enable notifications using this curl command
+    ```
+
+    curl -XPUT -uTHEHIVE_USERNAME:THEHIVE_PASSWORD -H 'Content-type: application/json' THEHIVE_URL/api/config/organisation/notification -d '
+    {
+        "value": [
+            {
+            "delegate": false,
+            "trigger": { "name": "AnyEvent"},
+            "notifier": { "name": "webhook", "endpoint": "WEBHOOK_NAME" }
+            }
+        ]
+    }'
+    ```
diff --git a/docs/nodes/nodes-library/trigger-nodes/TheHiveTrigger/workflow.png b/docs/nodes/nodes-library/trigger-nodes/TheHiveTrigger/workflow.png
new file mode 100644
index 000000000..bcd6cec65
Binary files /dev/null and b/docs/nodes/nodes-library/trigger-nodes/TheHiveTrigger/workflow.png differ