Home
TheHive
Cortex
Cortex Neurons
Resources
Initializing search
TheHive 5 Documentation
Home
TheHive
TheHive
Overview
Installation
Installation
Installation Methods
Requirements
Requirements
System Requirements
Software Requirements
Package Repository
Install with Packages
One-Command Install
Deploy with Docker
Deploy on Kubernetes
Set Up a Cluster with Packages
Licenses
Licenses
About Licenses
Request a Community License
Activate or Update a License
Version Upgrades
Version Upgrades
Upgrade from Version 6.x
Upgrade from Version 5.x
Upgrade from Version 4.x
Migration from Version 3.x
Configuration
Configuration
Cortex Integration
MISP Integration
Service Configuration
Database and Index Authentication
Database and Index SSL
Akka (Version 5.3 and Earlier)
Pekko (Version 5.4+)
Docker Entrypoint Settings
JVM SSL Trust
HTTPS via Reverse Proxy
Outbound Proxy Settings
Log Configuration
GDPR Compliance Feature
Operations
Operations
Cassandra Cluster Operations
Cassandra Security Operations
TheHive 6 and Cassandra on the Same Host
Backup & Restore Operations
Backup & Restore Operations
Cold vs. Hot Backups and Restores
Backup Process
Backup Process
Cold Backup
Cold Backup
Physical Server
Virtual Server
Docker Compose
Hot Backup
Hot Backup
Standalone Server
Cluster
Restore Process
Restore Process
Cold Restore
Cold Restore
Physical Server
Virtual Server
Docker Compose
Hot Restore
Hot Restore
Standalone Server
Cluster
End of APT and YUM repositories
End of APT and YUM repositories
Deprecation Notice
Switch to Manual Download and Installation
Index Management
Performance Optimization
Performance Optimization
Overview
Index Refresh Interval
JVM Memory
Troubleshooting
Monitoring
Admin Guides
Admin Guides
First Start
Organizations
Organizations
About Organizations
Organizations Sharing Rules
Create an Organization
Link an Organization
Lock an Organization
User Accounts
User Accounts
About User Accounts
Create a User Account
Manage User Accounts
Add or Remove An Existing User Account from an Organization
Modify the Default Organization for a User Account
Delete a User Account
Lock a User Account
Export a List of User Accounts
Platform Management
Platform Management
Customize Branding
Licenses
Licenses
About Licenses
Request a Community License
Activate or Update a License
Cortex Integration
Cortex Integration
About Cortex
Add a Cortex Server
Remove a Cortex Server
MISP Integration
MISP Integration
About MISP Integration
Connect a MISP Server
Delete a MISP Server Connection
Email Intake Connectors
Email Intake Connectors
About Email Intake Connectors
Connect a Mailbox
Manually Fetch Emails
Delete a Mailbox Connection
LLM Providers
Authentication Settings
Authentication Settings
Configure Authentication
Configure Providers
Configure Providers
Local
Active Directory (AD)
LDAP
OAuth 2.0
SAML
OpenID
Configure SMTP
Configure SMTP
About SMTP
Configure an SMTP Server
Configure LDAP
Configure LDAP
About LDAP
Configure an LDAP Server
Add a Global Endpoint
Entities Management
Entities Management
Profiles
Profiles
About Profiles
Create a Profile
Add or Remove Permissions from a Profile
Delete a Profile
Custom Fields
Custom Fields
About Custom Fields
Create a Custom Field
Manage Custom Fields
Delete a Custom Field
Observable Types
Observable Types
Create an Observable Type
Set an Observable Type as Case-Insensitive
Delete an Observable Type
Statuses
Statuses
About Statuses
Create a Status
Change a Status Visibility
Change a Color Visibility
Require an Impact for a Status
Delete a Status
Analyzer Templates
Analyzer Templates
About Analyzer Templates
Import Analyzer Templates
Customize an Analyzer Template
Taxonomies
Taxonomies
About Taxonomies
Add a Custom Taxonomy
Update MISP Taxonomies
Activate or Deactivate a Taxonomy
Activate or Deactivate a Taxonomy Tag
Delete a Taxonomy
TTPs
TTPs
About TTPs
Add a Catalog
Update a Catalog
Remove a Catalog
View Techniques
Setting up TheHive Portal
Setting up TheHive Portal
About TheHive Portal
Tutorial: Set Up TheHive Portal Access
How To
How To
Fail2ban Configuration
Splunk Integration Guide
User Guides
User Guides
Account Management
Account Management
Manage Your Account Settings
Manage Your Password
Change Your Account Theme
View Your Account Profile and Permissions
Switch Between Organizations
Log Out of Your Account
Organization Admin
Organization Admin
User Accounts
User Accounts
About User Accounts
Create a User Account
Manage User Accounts
Add or Remove An Existing User Account from an Organization
Lock a User Account
Export a List of User Accounts
Templates
Templates
Case Templates
Case Templates
About Case Templates
Create a Case Template
Delete a Case Template
Export or Import a Case Template
Case Page Templates
Case Page Templates
About Page Templates
Create a Page Template
Delete a Page Template
Export a Page Template
Import a Page Template
Case Report Templates
Case Report Templates
About Case Report Templates
Widgets
Create a Case Report Template
Add or Remove Widgets
Delete a Case Report Template
Export or Import a Case Report Template
Custom Tags
Custom Tags
About Custom Tags
Change the Color of a Custom Tag
Rename a Custom Tag
Delete a Custom Tag
View Custom Tag Statistics
UI Configuration
UI Configuration
UI Configuration Settings
Prevent Users from Creating Empty Cases
Prevent Users from Merging Alerts into Closed Cases
Select Similar Cases and Alerts Filters
Pause Dashboard Refresh
Remove the All Periods Option in a Dashboard
Hide KPIs
Allow Custom Link Schemes
Notifications & Endpoints
Notifications & Endpoints
About Notifications
Create a Notification
Turn Off a Notification
Delete a Notification
Variable Usage Examples
Query Syntax
Notifier Configuration
Notifier Configuration
EmailToUser
EmailToAddr
HttpRequest
Mattermost
Slack
Teams
Webhook
Kafka
Redis
RunAnalyzer
RunResponder
Function
Filtered Event Setup
Filtered Event Setup
Write a FilteredEvent Trigger
Operators
Endpoints
Endpoints
About Endpoints
Add a Local HttpRequest Endpoint
Add a Local Mattermost Endpoint
Add a Local Slack Endpoint
Add a Local Teams Endpoint
Add a Local Webhook Endpoint
SLA Management
SLA Management
Configure SLA Rules
Functions
Functions
About Functions
Create a Function
Delete a Function
Invoke a Function
Functions Objects
Query Syntax
Alert Feeders
Alert Feeders
About Alert Feeders
Create an Alert Feeder
Turn Off an Alert Feeder
Delete an Alert Feeder
Attachments
Attachments
About Attachments
Add an Attachment
Remove an Attachment
Download an Attachment
Share an Attachment
Automation Hacks
Automation Hacks
Tutorial: Automate Tracking of Pending Alerts
Tutorial: Automate Monitoring of Tasks Approaching Their Due Date
Tutorial: Automate Extraction of Observables from Emails
Analyst Corner
Analyst Corner
Alerts Management
Alerts Management
About Alerts
Search for Alerts
Search for Alerts
Find an Alert
Overview of Search Methods for Alerts
Create a Case from an Alert
Add an Alert to an Existing Case
Unlink an Alert and a Case
Change an Alert Status
Change Classification Settings
Enrich Alert Details
Ignore Alert Updates from MISP
Start Working on an Alert
Assign an Alert
Run a Function on a Case or Alert and Review Results
Run Responders and Review Reports for an Alert
Find Similar Alerts or Cases
Export a List of Alerts
Observables
Observables
About Observables
Add an Observable
Update the Status of an Observable
Edit Multiple Observables
Exclude an Observable From Similarity Checks
Delete an Observable
Find an Observable
Find a Job
Share an Observable with Internal Organizations
Export Data from an Observable
Pin an Observable
Run Analyzers and Review Reports for an Observable
Import Observables from Analyzer Reports
Run Responders and Review Reports for an Observable
TTPs
TTPs
About TTPs
Export TTPs
Attachments
Attachments
About Attachments
Add an Attachment
Remove an Attachment
Download an Attachment
Share an Attachment
Tags
Tags
About Tags
Add or Remove Tags
Custom Fields
Custom Fields
Add Custom Fields
Remove Custom Fields
Enter Values in Custom Fields
About Audit Logs
Comments
Comments
Comment on Alerts
Share a Comment
Find a Comment
Close an Alert
Reopen an Alert
Cases Management
Cases Management
About Cases
Search for Cases
Search for Cases
Find a Case
Overview of Search Methods for Cases
Create a Case
Apply a Case Template
Find Similar Alerts or Cases
Observables
Observables
About Observables
Add an Observable
Update the Status of an Observable
Edit Multiple Observables
Exclude an Observable From Similarity Checks
Delete an Observable
Find an Observable
Find a Job
Share an Observable with Internal Organizations
Export Data from an Observable
Pin an Observable
Run Analyzers and Review Reports for an Observable
Import Observables from Analyzer Reports
Run Responders and Review Reports for an Observable
Custom Fields
Custom Fields
Add Custom Fields
Remove Custom Fields
Enter Values in Custom Fields
Tags
Tags
About Tags
Add or Remove Tags
TTPs
TTPs
About TTPs
Add TTPs
Export TTPs
Remove TTPs
Attachments
Attachments
About Attachments
Add an Attachment
Remove an Attachment
Download an Attachment
Share an Attachment
Remove External User Access to an Attachment
Link Elements in Cases
Link Elements in Cases
Add a Link to a Case
Remove a Link from a Case
View Links in a Case
Linked Alerts to Cases
Linked Alerts to Cases
View Alerts Linked to a Case
Unlink an Alert and a Case
Comments
Comments
Comment on Cases
Share a Comment
Control Comment Access for External Users
Find a Comment
Change a Case Status
Change Classification Settings
Flag a Case
Add Tasks to a Case
Merge Cases
Run a Function on a Case or Alert and Review Results
Run Responders and Review Reports for a Case
Close a Case
Reopen a Case
Delete a Case
Case Access Control
Case Access Control
Share a Case with Internal Organizations
Share a Case with External Users
Revoke Case Access for External Users
Restrict Case Visibility
Restore Case Visibility
Case Timelines
Case Timelines
About Case Timelines
Add a Custom Event
View a Case Timeline
Export a Case Timeline
Delete a Case Timeline
Export Cases
Export Cases
Export a List of Cases
Export an Archived Case
Export a Case to MISP
Case Pages
Case Pages
About Case Pages
Create a Page
Delete a Page
Share a Page
View a Page
Find a Page
Case Reports
Case Reports
About Case Reports
Save and Download a Case Report
About Audit Logs
Tasks Management
Tasks Management
Tasks
Tasks
About Tasks
Create a Task
Start a Task
Change a Task Status
Manage Tasks
Export a List of Tasks
Delete a Task
Search for Tasks
Search for Tasks
Find a Task
Overview of Search Methods for Tasks
Run Responders and Review Reports for a Task
Share a Task with Internal Organizations
Close a Task
Task Logs
Task Logs
About Task Logs
Create a Task Log
Delete a Task Log
Find a Task Log
Run Responders and Review Reports for a Task Log
Dashboards
Dashboards
About Dashboards
Widgets
Create a Dashboard
Add or Remove Widgets
Delete a Dashboard
Change Visibility of a Dashboard
Adjust Dashboard Refresh Frequency
Set a Dashboard Display Period
Export or Import a Dashboard
Download a Dashboard
Preview vs. Detail View
Filtering and Sorting
Views
Views
About Views
Create a Custom View
Update a Custom View
Rename a Custom View
Delete a Custom View
Change a Custom View Visibility
Autorefresh
Statistics
Live Feed
Knowledge Base
Knowledge Base
About the Knowledge Base
Create a Page
Delete a Page
Share a Page
View a Page
Find a Page
Key Performance Indicators
Key Performance Indicators
KPIs
Measure Case Management Performance
Measure Alert Management Performance
Measure Task Management Performance
SLA Management
SLA Management
About SLA Management
Monitor SLA
Configure SLA Notifications
Flavored Markdown Syntax
Date Field Definitions
External User Guides
External User Guides
Activate Your Account
Glossary
Find a Case
Create a Case
Post a Comment
Update a Comment
Delete a Comment
Upload an Attachment
Add an Observable
Account Settings
Account Settings
Manage Your Account Settings
Manage Your Password
Change Your Account Theme
Switch Between Organizations
Log Out of Your Account
Flow
Flow
About Flow
Installation
Installation
Requirements
Requirements
System Requirements
Software Requirements
Deploy with Docker Compose
Deploy on Kubernetes
First Start
Upgrade with Docker Compose
Upgrade on Kubernetes
Configuration
Configuration
Configuration Files
Environment Variables
Application Configuration
Nginx Reverse Proxy
Temporal Runtime
Operations
Operations
Component Authentication
Security
Maintenance
Security Maintenance
Backup & Restore
Logs
Monitoring
Troubleshooting
User Guides
User Guides
Build Your First Workflow
Manage Workflows
Triggers
Triggers
Add a Trigger
Access the Trigger Payload
Nodes
Nodes
Configure a Flow Node
Configure an Action Node
Configure an Integration Node
Configure a Transformation Node
Variables
Variables
Manage Input and Exit Variables
Manage Global Variables
Manually Run a Workflow
Display Workflow Execution Logs
Export or Import a Workflow
Workflow Templates
Jq Functions
Glossary
Glossary
API
API
API Documentation
Python Client
Go Client
MCP Server
Release Notes
Release Notes
Release Versioning and Maintenance Policy
Release Notes for Version 6.0
Release Notes for Version 5.8
Release Notes for Version 5.7
Release Notes for Version 5.6
Release Notes for Version 5.5
Release Notes for Version 5.4
Release Notes for Version 5.3
Release Notes for Version 5.2
Release Notes for Version 5.1
Release Notes for Version 5.0
Cortex
Cortex
Home
Download
Download
Cortex Installation Methods
Installation & configuration
Installation & configuration
Requirements
Requirements
System Requirements
Software Requirements
Installation
Installation
Package Repository
Install with Packages
One-Command Install
Run with Docker
Deploy on Kubernetes
Configuration
Configuration
Authentication
Secret Key
Database Configuration
Analyzers & Responders
Proxy Settings
Docker Parameters
SSL Configuration
Advanced Configuration
User Guides
User Guides
First start
User roles
Operations
Operations
Backup & Restore
Analyzers/Responders input and output
Upgrade to Cortex 3.1
Upgrade to Cortex 4.2
End of APT and YUM repositories
End of APT and YUM repositories
Deprecation Notice
Switch to Manual Download and Installation
API
API
API Guide
How to create an Analyzer
How to create a Responder
Cortex Neurons
Resources
Resources
Resources
TheHive Templates
Docker Demo Environment
IaaS deployment
IaaS deployment
Amazon AWS
Amazon AWS
Main Features
Deploy TheHive AMI
Deploy Cortex AMI
AWS sample code
Create and manage the SecOps VPC
TheHive v5 and Cortex within a SecOps VPC
Microsoft Azure
Microsoft Azure
Main Features
Deploy TheHive Azure image
Deploy Cortex Azure image
Azure sample code
Creating a new SecOps Virtual Network
Deploying TheHive v5 and Cortex with Terraform
Upgrading your Azure instances
Open source projects
Open source projects
SDK
SDK
TheHive4py
TheHive4go
Cortex4py
Cortexutils
Security and Data Protection
Cortex latest version
4.2
4.2.0
Back to top