Home
TheHive
Cortex
Cortex Neurons
Resources

Initializing search

TheHive 5 Documentation

Home
TheHive
TheHive
- Overview
- Installation
  Installation
  - Installation Methods
  - System Requirements
  - Single Server Installation
    Single Server Installation
    
    Install on Linux
    
    One-Command Install
    
    Deploy with Docker
  - Cluster Deployment
    Cluster Deployment
    
    Set Up a Cluster on Linux
    
    Deploy on Kubernetes
  - Licenses
    Licenses
    
    About Licenses
    
    Request a Community License
    
    Activate or Update a License
  - Version Upgrades
    Version Upgrades
    
    Upgrade from Version 5.x
    
    Upgrade from Version 4.x
    
    Migration from TheHive 3.x
- Configuration
  Configuration
  - Database & Index
  - File Storage
  - Connectors
  - Akka (Version 5.3 and Earlier)
  - Pekko (Version 5.4+)
  - Logs
  - Proxy
  - Secrets
  - SSL
  - Service
  - Compliance
    Compliance
    
    General Data Protection Regulation (GDPR)
- Operations
  Operations
  - Cassandra Cluster Operations
  - Cassandra Security Operations
  - MinIO Cluster Operations
  - Backup & Restore Operations
    Backup & Restore Operations
    
    Overview
    
    Backup Process
    Backup Process
    
    Physical Server
    
    Virtual Server
    
    Docker Compose
    
    Hot backups
    
    Restore Process
    Restore Process
    
    Physical Server
    
    Virtual Server
    
    Docker Compose
    
    Cloud Infrastructure
    
    Restore hot backups
  - End of APT and YUM repositories
    End of APT and YUM repositories
    
    Deprecation Notice
    
    Switch to Manual Download and Installation
  - Index Management
  - Troubleshooting Guide
  - Set Up Monitoring
- Administration Guides
  Administration Guides
  - First Start
  - Organizations
    Organizations
    
    About Organizations
    
    About Organizations Sharing Rules
    
    Create an Organization
    
    Link an Organization
    
    Lock an Organization
  - User Accounts
    User Accounts
    
    About User Accounts
    
    Create a User Account
    
    Manage User Accounts
    
    Add or Remove An Existing User Account from an Organization
    
    Delete a User Account
    
    Lock a User Account
    
    Export a List of User Accounts
  - Platform Management
    Platform Management
    
    Customize Branding
    
    Licenses
    Licenses
    
    About Licenses
    
    Request a Community License
    
    Activate or Update a License
    
    Cortex Integration
    Cortex Integration
    
    About Cortex
    
    Add a Cortex Server
    
    Remove a Cortex Server
    
    MISP Integration
    MISP Integration
    
    About MISP Integration
    
    Connect a MISP Server
    
    Delete a MISP Server Connection
    
    Email Intake Connectors
    Email Intake Connectors
    
    About Email Intake Connectors
    
    Connect a Mailbox
    
    Manually Fetch Emails
    
    Delete a Mailbox Connection
    
    Authentication Settings
    Authentication Settings
    
    Configure Authentication
    
    Configure Providers
    Configure Providers
    
    Local
    
    Active Directory (AD)
    
    LDAP
    
    OAUTH 2.0
    
    SAML
    
    OpenID
    
    Configure SSL
    
    Configure SMTP
    Configure SMTP
    
    About SMTP
    
    Configure an SMTP Server
    
    Configure LDAP
    Configure LDAP
    
    About LDAP
    
    Configure an LDAP Server
    
    Add a Global Endpoint
  - Entities Management
    Entities Management
    
    Profiles
    Profiles
    
    About Profiles
    
    Create a Profile
    
    Add or Remove Permissions from a Profile
    
    Delete a Profile
    
    Custom Fields
    Custom Fields
    
    About Custom Fields
    
    Create a Custom Field
    
    Manage Custom Fields
    
    Delete a Custom Field
    
    Observable Types
    Observable Types
    
    Create an Observable Type
    
    Delete an Observable Type
    
    Statuses
    Statuses
    
    About Statuses
    
    Create a Status
    
    Change a Status Visibility
    
    Change a Color Visibility
    
    Delete a Status
    
    Analyzer Templates
    Analyzer Templates
    
    About Analyzer Templates
    
    Import Analyzer Templates
    
    Customize an Analyzer Template
    
    Taxonomies
    Taxonomies
    
    About Taxonomies
    
    Add a Custom Taxonomy
    
    Update MISP Taxonomies
    
    Activate or Deactivate a Taxonomy
    
    Delete a Taxonomy
    
    TTPs
    TTPs
    
    About TTPs
    
    Add a Catalog
    
    Update a Catalog
    
    Remove a Catalog
    
    View Techniques
  - How To
    How To
    
    Fail2ban Configuration
    
    Splunk Integration Guide
- User Guides
  User Guides
  - Flavored Markdown Syntax
  - Date Field Definitions
  - Account Management
    Account Management
    
    Manage your Account Settings
    
    Manage your Password
    
    Change your Account Theme
    
    View your Account Profile and Permissions
    
    Switch Between Organizations
    
    Log Out of your Account
  - Knowledge Base
    Knowledge Base
    
    About the Knowledge Base
    
    Create a Page
    
    Delete a Page
    
    View a Page
  - Key Performance Indicators
    Key Performance Indicators
    
    KPIs
    
    Measure Case Management Performance
    
    Measure Alert Management Performance
  - Organization Administration
    Organization Administration
    
    User Accounts
    User Accounts
    
    About User Accounts
    
    Create a User Account
    
    Manage User Accounts
    
    Add or Remove An Existing User Account from an Organization
    
    Lock a User Account
    
    Export a List of User Accounts
    
    Templates
    Templates
    
    Case Templates
    Case Templates
    
    About Case Templates
    
    Create a Case Template
    
    Delete a Case Template
    
    Export or Import a Case Template
    
    Case Page Templates
    Case Page Templates
    
    About Page Templates
    
    Create a Page Template
    
    Delete a Page Template
    
    Export a Page Template
    
    Import a Page Template
    
    Case Report Templates
    Case Report Templates
    
    About Case Report Templates
    
    Widgets
    
    Create a Case Report Template
    
    Add or Remove Widgets
    
    Delete a Case Report Template
    
    Custom Tags
    Custom Tags
    
    About Custom Tags
    
    Change the Color of a Custom Tag
    
    Rename a Custom Tag
    
    Delete a Custom Tag
    
    View Custom Tag Statistics
    
    UI Configuration
    UI Configuration
    
    UI Configuration Settings
    
    Prevent Users from Creating Empty Cases
    
    Prevent Users from Merging Alerts into Closed Cases
    
    Select Similar Cases and Alerts Filters
    
    Pause Dashboard Refresh
    
    Remove the All Periods Option in a Dashboard
    
    Hide KPIs
    
    Notifications & Endpoints
    Notifications & Endpoints
    
    About Notifications
    
    Create a Notification
    
    Turn Off a Notification
    
    Delete a Notification
    
    Variable Usage Examples
    
    Notifier Configuration
    Notifier Configuration
    
    EmailToUser
    
    EmailToAddr
    
    HttpRequest
    
    Mattermost
    
    Slack
    
    Teams
    
    Webhook
    
    Kafka
    
    Redis
    
    RunAnalyzer
    
    RunResponder
    
    Function
    
    Filtered Event Setup
    Filtered Event Setup
    
    Write a FilteredEvent Trigger
    
    Operators
    
    Endpoints
    Endpoints
    
    About Endpoints
    
    Add a Local HttpRequest Endpoint
    
    Add a Local Mattermost Endpoint
    
    Add a Local Slack Endpoint
    
    Add a Local Teams Endpoint
    
    Add a Local Webhook Endpoint
    
    Functions
    Functions
    
    About Functions
    
    Create a Function
    
    Delete a Function
    
    Invoke a Function
    
    Functions Objects
    
    Alert Feeders
    Alert Feeders
    
    About Alert Feeders
    
    Create an Alert Feeder
    
    Turn Off an Alert Feeder
    
    Delete an Alert Feeder
    
    Attachments
    Attachments
    
    About Attachments
    
    Add an Attachment
    
    Remove an Attachment
    
    Download an Attachment
    
    Share an Attachment
  - Automation Hacks
    Automation Hacks
    
    Tutorial: Automate Tracking of Pending Alerts
  - Analyst's Corner
    Analyst's Corner
    
    Alerts Management
    Alerts Management
    
    About Alerts
    
    Search for Alerts
    Search for Alerts
    
    Find an Alert
    
    Overview of Search Methods for Alerts
    
    Start Investigating an Alert
    
    Create a Case from an Alert
    
    Add an Alert to an Existing Case
    
    Unlink an Alert and a Case
    
    Change an Alert Status
    
    Change Alert Classification Settings
    
    Enrich Alert Details
    
    Ignore Alert Updates from MISP
    
    Start Investigating an Alert
    
    Assign an Alert
    
    Run a Function on an Alert
    
    Run Responders and Review Reports for an Alert
    
    Find Similar Alerts or Cases
    
    Export a List of Alerts
    
    Observables
    Observables
    
    About Observables
    
    Add an Observable
    
    Update the Status of an Observable
    
    Edit Multiple Observables
    
    Exclude an Observable From Similarity Checks
    
    Remove an Observable
    
    Find an Observable
    
    Find a Job
    
    Share an Observable with Other Organizations
    
    Export Data from an Observable
    
    Pin an Observable
    
    Run Analyzers and Review Reports for an Observable
    
    Import Observables from Analyzer Reports
    
    Run Responders and Review Reports for an Observable
    
    TTPs
    TTPs
    
    About TTPs
    
    Add TTPs
    
    Export TTPs
    
    Remove TTPs
    
    Attachments
    Attachments
    
    About Attachments
    
    Add an Attachment
    
    Remove an Attachment
    
    Download an Attachment
    
    Share an Attachment
    
    Tags
    Tags
    
    About Tags
    
    Add or Remove Tags
    
    Custom Fields
    Custom Fields
    
    Add Custom Fields
    
    Remove Custom Fields
    
    Enter Values in Custom Fields
    
    About Audit Logs
    
    Comment on Alerts
    
    Close an Alert
    
    Reopen an Alert
    
    Cases Management
    Cases Management
    
    About Cases
    
    Search for Cases
    Search for Cases
    
    Find a Case
    
    Overview of Search Methods for Cases
    
    Create a Case
    
    Export a List of Cases
    
    Export an Archived Case
    
    Export a Case to MISP
    
    Apply a Case Template
    
    Find Similar Alerts or Cases
    
    Observables
    Observables
    
    About Observables
    
    Add an Observable
    
    Update the Status of an Observable
    
    Edit Multiple Observables
    
    Exclude an Observable From Similarity Checks
    
    Remove an Observable
    
    Find an Observable
    
    Find a Job
    
    Share an Observable with Other Organizations
    
    Export Data from an Observable
    
    Pin an Observable
    
    Run Analyzers and Review Reports for an Observable
    
    Import Observables from Analyzer Reports
    
    Run Responders and Review Reports for an Observable
    
    Custom Fields
    Custom Fields
    
    Add Custom Fields
    
    Remove Custom Fields
    
    Enter Values in Custom Fields
    
    Link Elements in Cases
    Link Elements in Cases
    
    Add a Link to a Case
    
    Remove a Link from a Case
    
    View Links in a Case
    
    Linked Alerts to Cases
    Linked Alerts to Cases
    
    View Alerts Linked to a Case
    
    Unlink an Alert and a Case
    
    Change a Case Status
    
    Change Alert Classification Settings
    
    Flag a Case
    
    Tags
    Tags
    
    About Tags
    
    Add or Remove Tags
    
    Add Tasks to a Case
    
    Merge Cases
    
    Share a Case with Other Organizations
    
    TTPs
    TTPs
    
    About TTPs
    
    Add TTPs
    
    Export TTPs
    
    Remove TTPs
    
    Attachments
    Attachments
    
    About Attachments
    
    Add an Attachment
    
    Remove an Attachment
    
    Download an Attachment
    
    Share an Attachment
    
    Case Timelines
    Case Timelines
    
    About Case Timelines
    
    Add a Custom Event
    
    View a Case Timeline
    
    Export a Case Timeline
    
    Delete a Case Timeline
    
    Case Reports
    Case Reports
    
    About Case Reports
    
    Save and Download a Case Report
    
    About Audit Logs
    
    Manage Case Visibility
    Manage Case Visibility
    
    Restrict Case Visibility
    
    Restore Case Visibility
    
    Run a Function on an Alert
    
    Run Responders and Review Reports for a Case
    
    Comment on Alerts
    
    Case Pages
    Case Pages
    
    About Case Pages
    
    Create a Page
    
    Delete a Page
    
    Share a Page
    
    View a Page
    
    Close a Case
    
    Reopen a Case
    
    Delete a Case
    
    Tasks Management
    Tasks Management
    
    Tasks
    Tasks
    
    About Tasks
    
    Create a Task
    
    Start a Task
    
    Change a Task Status
    
    Manage Tasks
    
    Export a List of Tasks
    
    Delete a Task
    
    Search for Tasks
    Search for Tasks
    
    Find a Task
    
    Overview of Search Methods for Tasks
    
    Run Responders and Review Reports for a Task
    
    Share a Task with Other Organizations
    
    Close a Task
    
    Task Logs
    Task Logs
    
    About Task Logs
    
    Create a Task Log
    
    Delete a Task Log
    
    Find a Task Log
    
    Run Responders and Review Reports for a Task Log
    
    Dashboards
    Dashboards
    
    About Dashboards
    
    Widgets
    
    Create a Dashboard
    
    Add or Remove Widgets
    
    Delete a Dashboard
    
    Change Visibility of a Dashboard
    
    Adjust Dashboard Refresh Frequency
    
    Set a Dashboard Display Period
    
    Export or Import a Dashboard
    
    Download a Dashboard
    
    Detail View vs. Preview
    
    About Filtering and Sorting
    
    Views
    Views
    
    About Views
    
    Create a Custom View
    
    Update a Custom View
    
    Delete a Custom View
    
    About Autorefresh
    
    About Statistics
    
    About the Live Feed
- API
  API
  - API Documentation
  - Python Client
- Release Notes
  Release Notes
Cortex
Cortex
- Home
- Download
  Download
  - Download Cortex
- Installation & configuration
  Installation & configuration
- User Guides
  User Guides
  - First start
  - User roles
- Operations
  Operations
  - Backup & Restore
  - Analyzers/Responders input and output
  - Upgrade to Cortex 3.1
  - End of APT and YUM repositories
    End of APT and YUM repositories
    
    Deprecation Notice
    
    Switch to Manual Download and Installation
- API
  API
Cortex Neurons
Resources
Resources
- Resources
- TheHive Templates
- Demo Virtual Machine
  Demo Virtual Machine
  - How to download the VM
  - Use the Demo Virtual Machine
- IaaS deployment
  IaaS deployment
  - Amazon AWS
    Amazon AWS
    
    Main Features
    
    Deploy TheHive AMI
    
    Deploy Cortex AMI
    
    AWS sample code
    
    Create and manage the SecOps VPC
    
    TheHive v5 and Cortex within a SecOps VPC
  - Microsoft Azure
    Microsoft Azure
    
    Main Features
    
    Deploy TheHive Azure image
    
    Deploy Cortex Azure image
    
    Azure sample code
    
    Creating a new SecOps Virtual Network
    
    Deploying TheHive v5 and Cortex with Terraform
    
    Upgrading your Azure instances
- Open source projects
  Open source projects
  - SDK
    SDK
    
    TheHive4py
    
    Cortex4py
    
    Cortexutils
- Security

Elasticsearch limitation

!!! info "Case sensitivity"
    Partial-word searches and filters are case sensitive in Elasticsearch, so capitalization matters.

Empowering incident responders worldwide

Company

About us Services Contact us

Products

Request a demo Try TheHive On-premTry TheHive Cloud Platform SaaS

Resources

Blog Success stories

Copyright 2025 StrangeBee. All rights reserved.