TheHive 5 Documentation
Cortex latest version
Initializing search
Home
TheHive
Cortex
Cortex Neurons
Resources
TheHive 5 Documentation
Home
TheHive
TheHive
Overview
Download
Installation
Installation
System Requirements
Automated Installation Script
Step-by-Step Installation Guide
Deploying a Cluster
Running with Docker
Kubernetes Deployment
Licenses
Licenses
About Licenses
Request a Community License
Activate or Update a License
Version Upgrades
Version Upgrades
Upgrade from Version 5.x
Upgrade from Version 4.x
Migration from TheHive 3.x
Configuration
Configuration
Database & Index
File Storage
Connectors
Akka (Version 5.3 and Earlier)
Pekko (Version 5.4+)
Logs
Proxy
Secrets
SSL
Service
Compliance
Compliance
General Data Protection Regulation (GDPR)
Operations
Operations
Cassandra Cluster Operations
Cassandra Security Operations
MinIO Cluster Operations
Backup & Restore Operations
Backup & Restore Operations
Overview
Backup Process
Backup Process
Physical Server
Virtual Server
Docker Compose
Hot backups
Restore Process
Restore Process
Physical Server
Virtual Server
Docker Compose
Cloud Infrastructure
Restore hot backups
End of APT and YUM repositories
End of APT and YUM repositories
Deprecation Notice
Switch to Manual Download and Installation
Index Management
Troubleshooting Guide
Monitoring Setup
Administration Guides
Administration Guides
First Start
Organizations
Organizations
About Organizations
About Organizations Sharing Rules
Create an Organization
Link an Organization
Lock an Organization
User Accounts
User Accounts
About User Accounts
Create a User Account
Manage User Accounts
Add or Remove An Existing User Account from an Organization
Delete a User Account
Lock a User Account
Export a List of User Accounts
Platform Management
Platform Management
Customize Branding
Licenses
Licenses
About Licenses
Request a Community License
Activate or Update a License
Cortex Integration
Cortex Integration
About Cortex
Add a Cortex Server
Remove a Cortex Server
MISP Integration
MISP Integration
About MISP Integration
Connect a MISP Server
Delete a MISP Server Connection
Email Intake Connectors
Email Intake Connectors
About Email Intake Connectors
Connect a Mailbox
Manually Fetch Emails
Delete a Mailbox Connection
Authentication Settings
Authentication Settings
Configure Authentication
Configure Providers
Configure Providers
Local
Active Directory (AD)
LDAP
OAUTH 2.0
SAML
OpenID
Configure SSL
Configure SMTP
Configure SMTP
About SMTP
Configure an SMTP Server
Configure LDAP
Configure LDAP
About LDAP
Configure an LDAP Server
Add a Global Endpoint
Entities Management
Entities Management
Profiles
Profiles
About Profiles
Create a Profile
Add or Remove Permissions from a Profile
Delete a Profile
Custom Fields
Custom Fields
About Custom Fields
Create a Custom Field
Manage Custom Fields
Delete a Custom Field
Observable Types
Observable Types
Create an Observable Type
Delete an Observable Type
Statuses
Statuses
About Statuses
Create a Status
Change a Status Visibility
Change a Color Visibility
Delete a Status
Analyzer Templates
Analyzer Templates
About Analyzer Templates
Import Analyzer Templates
Customize an Analyzer Template
Taxonomies
Taxonomies
About Taxonomies
Add a Custom Taxonomy
Update MISP Taxonomies
Activate or Deactivate a Taxonomy
Delete a Taxonomy
TTPs
TTPs
About TTPs
Add a Catalog
Update a Catalog
Remove a Catalog
View Techniques
How To
How To
Fail2ban Configuration
Splunk Integration Guide
User Guides
User Guides
Flavored Markdown Syntax
Date Field Definitions
Account Management
Account Management
Manage your Account Settings
Manage your Password
Change your Account Theme
View your Account Profile and Permissions
Switch Between Organizations
Log Out of your Account
Knowledge Base
Knowledge Base
About the Knowledge Base
Create a Page
Delete a Page
Share a Page
View a Page
Key Performance Indicators
Key Performance Indicators
KPIs
Measure Case Management Performance
Measure Alert Management Performance
Organization Administration
Organization Administration
User Accounts
User Accounts
About User Accounts
Create a User Account
Manage User Accounts
Add or Remove An Existing User Account from an Organization
Lock a User Account
Export a List of User Accounts
Templates
Templates
Case Templates
Case Templates
About Case Templates
Create a Case Template
Delete a Case Template
Export or Import a Case Template
Case Page Templates
Case Page Templates
About Page Templates
Create a Page Template
Delete a Page Template
Export a Page Template
Import a Page Template
Case Report Templates
Case Report Templates
About Case Report Templates
Widgets
Create a Case Report Template
Add or Remove Widgets
Delete a Case Report Template
Custom Tags
Custom Tags
About Custom Tags
Change the Color of a Custom Tag
Rename a Custom Tag
Delete a Custom Tag
View Custom Tag Statistics
UI Configuration
UI Configuration
UI Configuration Settings
Prevent Users from Creating Empty Cases
Prevent Users from Merging Alerts into Closed Cases
Select Similar Cases and Alerts Filters
Pause Dashboard Refresh
Remove the All Periods Option in a Dashboard
Hide KPIs
Notifications & Endpoints
Notifications & Endpoints
About Notifications
Create a Notification
Turn Off a Notification
Delete a Notification
Variable Usage Examples
Notifier Configuration
Notifier Configuration
EmailToUser
EmailToAddr
HttpRequest
Mattermost
Slack
Teams
Webhook
Kafka
Redis
RunAnalyzer
RunResponder
Function
Filtered Event Setup
Filtered Event Setup
Write a FilteredEvent Trigger
Operators
Endpoints
Endpoints
About Endpoints
Add a Local HttpRequest Endpoint
Add a Local Mattermost Endpoint
Add a Local Slack Endpoint
Add a Local Teams Endpoint
Add a Local Webhook Endpoint
Functions
Functions
About Functions
Create a Function
Delete a Function
Invoke a Function
Functions Objects
Alert Feeders
Alert Feeders
About Alert Feeders
Create an Alert Feeder
Turn Off an Alert Feeder
Delete an Alert Feeder
Attachments
Attachments
About Attachments
Add an Attachment
Remove an Attachment
Download an Attachment
Share an Attachment
Automation Hacks
Automation Hacks
Tutorial: Automate Tracking of Pending Alerts
Analyst's Corner
Analyst's Corner
Alerts Management
Alerts Management
About Alerts
Search for Alerts
Search for Alerts
Find an Alert
Overview of Search Methods for Alerts
Start Investigating an Alert
Create a Case from an Alert
Add an Alert to an Existing Case
Unlink an Alert and a Case
Change an Alert Status
Change Alert Classification Settings
Enrich Alert Details
Ignore Alert Updates from MISP
Start Investigating an Alert
Assign an Alert
Run a Function on an Alert
Run Responders and Review Reports for an Alert
Find Similar Alerts or Cases
Export a List of Alerts
Observables
Observables
About Observables
Add an Observable
Update the Status of an Observable
Edit Multiple Observables
Exclude an Observable From Similarity Checks
Remove an Observable
Find an Observable
Find a Job
Share an Observable with Other Organizations
Export Data from an Observable
Pin an Observable
Run Analyzers and Review Reports for an Observable
Import Observables from Analyzer Reports
Run Responders and Review Reports for an Observable
TTPs
TTPs
About TTPs
Add TTPs
Export TTPs
Remove TTPs
Attachments
Attachments
About Attachments
Add an Attachment
Remove an Attachment
Download an Attachment
Share an Attachment
Tags
Tags
About Tags
Add or Remove Tags
Custom Fields
Custom Fields
Add Custom Fields
Remove Custom Fields
Enter Values in Custom Fields
About Audit Logs
Comment on Alerts
Close an Alert
Reopen an Alert
Cases Management
Cases Management
About Cases
Search for Cases
Search for Cases
Find a Case
Overview of Search Methods for Cases
Create a Case
Export a List of Cases
Export an Archived Case
Export a Case to MISP
Apply a Case Template
Find Similar Alerts or Cases
Observables
Observables
About Observables
Add an Observable
Update the Status of an Observable
Edit Multiple Observables
Exclude an Observable From Similarity Checks
Remove an Observable
Find an Observable
Find a Job
Share an Observable with Other Organizations
Export Data from an Observable
Pin an Observable
Run Analyzers and Review Reports for an Observable
Import Observables from Analyzer Reports
Run Responders and Review Reports for an Observable
Custom Fields
Custom Fields
Add Custom Fields
Remove Custom Fields
Enter Values in Custom Fields
Link Elements in Cases
Link Elements in Cases
Add a Link to a Case
Remove a Link from a Case
View Links in a Case
Linked Alerts to Cases
Linked Alerts to Cases
View Alerts Linked to a Case
Unlink an Alert and a Case
Change a Case Status
Change Alert Classification Settings
Flag a Case
Tags
Tags
About Tags
Add or Remove Tags
Add Tasks to a Case
Merge Cases
Share a Case with Other Organizations
TTPs
TTPs
About TTPs
Add TTPs
Export TTPs
Remove TTPs
Attachments
Attachments
About Attachments
Add an Attachment
Remove an Attachment
Download an Attachment
Share an Attachment
Case Timelines
Case Timelines
About Case Timelines
Add a Custom Event
View a Case Timeline
Export a Case Timeline
Delete a Case Timeline
Case Reports
Case Reports
About Case Reports
Save and Download a Case Report
About Audit Logs
Manage Case Visibility
Manage Case Visibility
Restrict Case Visibility
Restore Case Visibility
Run a Function on an Alert
Run Responders and Review Reports for a Case
Comment on Alerts
Close a Case
Reopen a Case
Delete a Case
Tasks Management
Tasks Management
Tasks
Tasks
About Tasks
Create a Task
Start a Task
Change a Task Status
Manage Tasks
Export a List of Tasks
Delete a Task
Search for Tasks
Search for Tasks
Find a Task
Overview of Search Methods for Tasks
Run Responders and Review Reports for a Task
Share a Task with Other Organizations
Close a Task
Task Logs
Task Logs
About Task Logs
Create a Task Log
Delete a Task Log
Find a Task Log
Run Responders and Review Reports for a Task Log
Dashboards
Dashboards
About Dashboards
Widgets
Create a Dashboard
Add or Remove Widgets
Delete a Dashboard
Change Visibility of a Dashboard
Adjust Dashboard Refresh Frequency
Set a Dashboard Display Period
Export or Import a Dashboard
Download a Dashboard
Detail View vs. Preview
About Filtering and Sorting
About Views
About Autorefresh
About Statistics
About the Live Feed
API
API
API Documentation
Python Client
Release Notes
Release Notes
Release Notes for Version 5.0
Release Notes for Version 5.1
Release Notes for Version 5.2
Release Notes for Version 5.3
Release Notes for Version 5.4
Release Notes for Version 5.5
Cortex
Cortex
Home
Download
Download
Download Cortex
Installation & configuration
Installation & configuration
Authentication
Secret key configuration
Advanced configuration
Configure SSL
Step-by-Step Guide
Installation and Configuration Guides
Analyzers & Responders
Run Cortex with Docker
Proxy settings
Parameters for Docker
Database configuration
Deploy Cortex on Kubernetes
User Guides
User Guides
First start
User roles
Operations
Operations
Backup & Restore
Analyzers/Responders input and output
Upgrade to Cortex 3.1
End of APT and YUM repositories
End of APT and YUM repositories
Deprecation Notice
Switch to Manual Download and Installation
API
API
API Guide
How to create an Analyzer
How to create a Responder
Cortex Neurons
Resources
Resources
Resources
TheHive templates
Demo Virtual Machine
Demo Virtual Machine
How to download the VM
Use the Demo Virtual Machine
IaaS deployment
IaaS deployment
Amazon AWS
Amazon AWS
Main Features
Deploy TheHive AMI
Deploy Cortex AMI
AWS sample code
Create and manage the SecOps VPC
TheHive v5 and Cortex within a SecOps VPC
Microsoft Azure
Microsoft Azure
Main Features
Deploy TheHive Azure image
Deploy Cortex Azure image
Azure sample code
Creating a new SecOps Virtual Network
Deploying TheHive v5 and Cortex with Terraform
Upgrading your Azure instances
Open source projects
Open source projects
SDK
SDK
TheHive4py
Cortex4py
Cortexutils
Security
Cortex latest version
3.2 3.2.1
Back to top