TheHive 5 Documentation

Access merge cases

Initializing search

Home
TheHive
Cortex
Cortex Neurons
Resources

TheHive 5 Documentation

Home
TheHive
TheHive
- Overview
- Download
- Installation
  Installation
  - System Requirements
  - Automated Installation Script
  - Step-by-Step Installation Guide
  - Deploying a Cluster
  - Running with Docker
  - Kubernetes Deployment
  - Activating TheHive License
  - Version Upgrades
    Version Upgrades
    
    Upgrade from Version 5.x
    
    Upgrade from Version 4.x
    
    Migration from TheHive 3.x
  - Archives
- Configuration
  Configuration
  - Database & Index
  - File Storage
  - Connectors
  - Akka (Version 5.3 and Earlier)
  - Pekko (Version 5.4+)
  - Logs
  - Proxy
  - Secrets
  - SSL
  - Service
  - Compliance
    Compliance
    
    General Data Protection Regulation (GDPR)
- Operations
  Operations
  - Cassandra Cluster Operations
  - Cassandra Security Operations
  - MinIO Cluster Operations
  - Backup & Restore Operations
    Backup & Restore Operations
    
    Overview
    
    Backup Process
    Backup Process
    
    Physical Server
    
    Virtual Server
    
    Docker Compose
    
    Hot backups
    
    Restore Process
    Restore Process
    
    Physical Server
    
    Virtual Server
    
    Docker Compose
    
    Cloud Infrastructure
    
    Restore hot backups
  - Index Management
  - Troubleshooting Guide
  - Monitoring Setup
- Administration Guides
  Administration Guides
  - TheHive - First Start
  - Organizations
    Organizations
    
    About Organizations
    
    About Organizations Sharing Rules
    
    Create an Organization
    
    Add Users to an Organization
    
    Link an Organization
    
    Lock an Organization
  - Manage Accounts
    Manage Accounts
    
    Account Creation/Update Guide
  - Platform Management
    Platform Management
    
    Branding Guide
    
    License Management
    
    Cortex Integration
    Cortex Integration
    
    About Cortex
    
    Add a Cortex Server
    
    Remove a Cortex Server
    
    MISP Integration
    MISP Integration
    
    About MISP Integration
    
    Connect a MISP Server
    
    Delete a MISP Server Connection
    
    Email Intake Connectors
    Email Intake Connectors
    
    About Email Intake Connectors
    
    Connect a Mailbox
    
    Manually Fetch Emails
    
    Delete a Mailbox Connection
    
    Authentication Settings
    Authentication Settings
    
    Configure Authentication
    
    Configure Providers
    Configure Providers
    
    Local
    
    Active Directory (AD)
    
    LDAP
    
    OAUTH 2.0
    
    SAML
    
    OpenID
    
    Configure SSL
    
    SMTP Configuration
    
    Add a Global Endpoint
  - Entities Management
    Entities Management
    
    Profiles
    
    Custom Fields
    Custom Fields
    
    About Custom Fields
    
    Create a Custom Field
    
    Manage Custom Fields
    
    Delete a Custom Field
    
    Observable Types
    
    Statuses
    Statuses
    
    About Statuses
    
    Create a Status
    
    Change a Status Visibility
    
    Change a Color Visibility
    
    Delete a Status
    
    Analyzers Templates
    
    Taxonomies
    Taxonomies
    
    About Taxonomies
    
    Add a Custom Taxonomy
    
    Update MISP Taxonomies
    
    Activate or Deactivate a Taxonomy
    
    Delete a Taxonomy
    
    Att&ck Patterns
  - How To
    How To
    
    Fail2ban Configuration
    
    Splunk Integration Guide
- User Guides
  User Guides
  - Forgot Password Guide
  - Flavored Markdown Syntax
  - Knowledge Base
    Knowledge Base
    
    About the Knowledge Base
    
    Create a Page
    
    Delete a Page
    
    Share a Page
    
    View a Page
  - Key Performance Indicators
    Key Performance Indicators
    
    KPIs
    
    Hide KPIs
    
    Measure Case Management Performance
    
    Measure Alert Management Performance
  - Organization Administration
    Organization Administration
    
    User
    
    Templates
    Templates
    
    Case Templates
    Case Templates
    
    About Case Templates
    
    Create a Case Template
    
    Delete a Case Template
    
    Export or Import a Case Template
    
    Case Page Templates
    Case Page Templates
    
    About Page Templates
    
    Create a Page Template
    
    Delete a Page Template
    
    Export a Page Template
    
    Import a Page Template
    
    Case Report Templates
    Case Report Templates
    
    About Case Report Templates
    
    Widgets
    
    Create a Case Report Template
    
    Add or Remove Widgets
    
    Delete a Case Report Template
    
    Custom Tags
    Custom Tags
    
    About Custom Tags
    
    Change the Color of a Custom Tag
    
    Rename a Custom Tag
    
    Delete a Custom Tag
    
    View Custom Tag Statistics
    
    UI Configuration
    
    Notifications & Endpoints
    Notifications & Endpoints
    
    About Notifications
    
    Create a Notification
    
    Turn Off a Notification
    
    Delete a Notification
    
    Variable Usage Examples
    
    Notifier Configuration
    Notifier Configuration
    
    EmailToUser
    
    EmailToAddr
    
    HttpRequest
    
    Mattermost
    
    Slack
    
    Teams
    
    Webhook
    
    Kafka
    
    Redis
    
    RunAnalyzer
    
    RunResponder
    
    Function
    
    Filtered Event Setup
    Filtered Event Setup
    
    Write a FilteredEvent Trigger
    
    Operators
    
    Endpoints
    Endpoints
    
    About Endpoints
    
    Add a Local HttpRequest Endpoint
    
    Add a Local Mattermost Endpoint
    
    Add a Local Slack Endpoint
    
    Add a Local Teams Endpoint
    
    Add a Local Webhook Endpoint
    
    Functions
    Functions
    
    About Functions
    
    Create a Function
    
    Delete a Function
    
    Revoke a Function
    
    Run a Function
    
    Functions Objects
    
    Alert Feeders
    Alert Feeders
    
    About Alert Feeders
    
    Create an Alert Feeder
    
    Turn Off an Alert Feeder
    
    Delete an Alert Feeder
    
    Attachments
  - Analyst's Corner
    Analyst's Corner
    
    Alerts Management
    Alerts Management
    
    About Alerts
    
    Search for Alerts
    Search for Alerts
    
    Find an Alert
    
    Overview of Search Methods for Alerts
    
    Preview Alerts
    
    Actions on Alerts
    
    Merge Alerts
    
    Change an Alert Status
    
    Enrich Alert Details
    
    Create a Case from Alerts
    
    View Alert Details
    
    Run Responders on Alert
    
    View Responders
    
    View Similar Alerts
    
    View Similar Cases
    
    View TTPs
    
    View Observables
    
    Tags
    Tags
    
    About Tags
    
    Add or Remove Tags
    
    Close an Alert
    
    Custom Fields
    Custom Fields
    
    Add Custom Fields
    
    Remove Custom Fields
    
    Enter Values in Custom Fields
    
    Cases Management
    Cases Management
    
    About Cases
    
    Search for Cases
    Search for Cases
    
    Find a Case
    
    Overview of Search Methods for Cases
    
    Find an Observable
    
    Find a Job
    
    Create a Case
    
    Export an Archived Case
    
    Export a Case to MISP
    
    Apply a Case Template
    
    Preview Cases
    
    Actions on Cases
    
    View a Case
    
    Custom Fields
    Custom Fields
    
    Add Custom Fields
    
    Remove Custom Fields
    
    Enter Values in Custom Fields
    
    Link Elements in Cases
    Link Elements in Cases
    
    Add a Link to a Case
    
    Remove a Link from a Case
    
    View Links in a Case
    
    Change a Case Status
    
    Tags
    Tags
    
    About Tags
    
    Add or Remove Tags
    
    Add Tasks to a Case
    
    Merge Cases
    
    Share a Case with Other Organizations
    
    Share an Observable with Other Organizations
    
    View Observables
    
    View TTPs
    
    View Attachments
    
    Case Timelines
    Case Timelines
    
    About Case Timelines
    
    Add a Custom Event
    
    View a Case Timeline
    
    Export a Case Timeline
    
    Delete a Case Timeline
    
    Case Reports
    Case Reports
    
    About Case Reports
    
    Save and Download a Case Report
    
    Manage Case Visibility
    Manage Case Visibility
    
    Restrict Case Visibility
    
    Restore Case Visibility
    
    Run Responders on Case
    
    Run Analyzers on Case
    
    Close a Case
    
    Tasks Management
    Tasks Management
    
    Tasks
    Tasks
    
    About Tasks
    
    Create a Task
    
    Change a Task Status
    
    Manage Tasks
    
    Delete a Task
    
    Search for Tasks
    Search for Tasks
    
    Find a Task
    
    Overview of Search Methods for Tasks
    
    Run Responders from Task
    
    Share a Task with Other Organizations
    
    Task Logs
    Task Logs
    
    About Task Logs
    
    Create a Task Log
    
    Delete a Task Log
    
    Find a Task Log
    
    Dashboards
    Dashboards
    
    About Dashboards
    
    Widgets
    
    Create a Dashboard
    
    Add or Remove Widgets
    
    Delete a Dashboard
    
    Change Visibility of a Dashboard
    
    Export or Import a Dashboard
    
    Download a Dashboard
    
    About Filtering and Sorting
    
    About Views
    
    About Autorefresh
    
    About Statistics
    
    About the Live Feed
    
    Choose Your Theme
- API
  API
  - API Documentation
  - Python Client
- Release Notes
  Release Notes
Cortex
Cortex
- Home
- Download
  Download
  - Downloading Cortex
- Installation & configuration
  Installation & configuration
- User Guides
  User Guides
  - First start
  - User roles
- Operations
  Operations
- API
  API
Cortex Neurons
Resources
Resources
- Resources
- TheHive templates
- Demo Virtual Machine
  Demo Virtual Machine
  - How to download the VM
  - Use the Demo Virtual Machine
- IaaS deployment
  IaaS deployment
  - Amazon AWS
    Amazon AWS
    
    Main Features
    
    Deploy TheHive AMI
    
    Deploy Cortex AMI
    
    AWS sample code
    
    Create and manage the SecOps VPC
    
    TheHive v5 and Cortex within a SecOps VPC
  - Microsoft Azure
    Microsoft Azure
    
    Main Features
    
    Deploy TheHive Azure image
    
    Deploy Cortex Azure image
    
    Azure sample code
    
    Creating a new SecOps Virtual Network
    
    Deploying TheHive v5 and Cortex with Terraform
    
    Upgrading your Azure instances
- Open source projects
  Open source projects
  - SDK
    SDK
    
    TheHive4py
    
    Cortex4py
    
    Cortexutils
- Security

Access merge cases

Required permissions

Only users with the manageCase/merge permission can merge cases in TheHive.

Copyright 2025 StrangeBee. All rights reserved.