logo
  • Home
  • TheHive
  • Cortex
  • Cortex Neurons
  • Resources
Initializing search
    • Home
      • Overview
        • Installation Methods
          • System Requirements
          • Software Requirements
        • Install on Linux
        • One-Command Install
        • Deploy with Docker
        • Deploy on Kubernetes
        • Set Up a Cluster on Linux
          • About Licenses
          • Request a Community License
          • Activate or Update a License
          • Upgrade from Version 5.x
          • Upgrade from Version 4.x
          • Migration from TheHive 3.x
        • Cortex Integration
        • MISP Integration
        • Service Configuration
        • Database and Index Authentication
        • Database and Index SSL
        • Akka (Version 5.3 and Earlier)
        • Pekko (Version 5.4+)
        • Docker Entrypoint Settings
        • JVM SSL Trust
        • HTTPS via Reverse Proxy
        • Outbound Proxy Settings
        • Log Configuration
        • GDPR Compliance Feature
        • Cassandra Cluster Operations
        • Cassandra Security Operations
        • MinIO Cluster Operations
          • Overview
            • Physical Server
            • Virtual Server
            • Docker Compose
            • Hot backups
            • Physical Server
            • Virtual Server
            • Docker Compose
            • Cloud Infrastructure
            • Restore hot backups
          • Deprecation Notice
          • Switch to Manual Download and Installation
        • Index Management
        • Troubleshooting Guide
        • Set Up Monitoring
        • First Start
          • About Organizations
          • About Organizations Sharing Rules
          • Create an Organization
          • Link an Organization
          • Lock an Organization
          • About User Accounts
          • Create a User Account
          • Manage User Accounts
          • Add or Remove An Existing User Account from an Organization
          • Delete a User Account
          • Lock a User Account
          • Export a List of User Accounts
          • Customize Branding
            • About Licenses
            • Request a Community License
            • Activate or Update a License
            • About Cortex
            • Add a Cortex Server
            • Remove a Cortex Server
            • About MISP Integration
            • Connect a MISP Server
            • Delete a MISP Server Connection
            • About Email Intake Connectors
            • Connect a Mailbox
            • Manually Fetch Emails
            • Delete a Mailbox Connection
            • Configure Authentication
              • Local
              • Active Directory (AD)
              • LDAP
              • OAUTH 2.0
              • SAML
              • OpenID
            • About SMTP
            • Configure an SMTP Server
            • About LDAP
            • Configure an LDAP Server
          • Add a Global Endpoint
            • About Profiles
            • Create a Profile
            • Add or Remove Permissions from a Profile
            • Delete a Profile
            • About Custom Fields
            • Create a Custom Field
            • Manage Custom Fields
            • Delete a Custom Field
            • Create an Observable Type
            • Delete an Observable Type
            • About Statuses
            • Create a Status
            • Change a Status Visibility
            • Change a Color Visibility
            • Delete a Status
            • About Analyzer Templates
            • Import Analyzer Templates
            • Customize an Analyzer Template
            • About Taxonomies
            • Add a Custom Taxonomy
            • Update MISP Taxonomies
            • Activate or Deactivate a Taxonomy
            • Delete a Taxonomy
            • About TTPs
            • Add a Catalog
            • Update a Catalog
            • Remove a Catalog
            • View Techniques
          • Fail2ban Configuration
          • Splunk Integration Guide
        • Flavored Markdown Syntax
        • Date Field Definitions
          • Manage your Account Settings
          • Manage your Password
          • Change your Account Theme
          • View your Account Profile and Permissions
          • Switch Between Organizations
          • Log Out of your Account
          • About the Knowledge Base
          • Create a Page
          • Delete a Page
          • View a Page
          • KPIs
          • Measure Case Management Performance
          • Measure Alert Management Performance
            • About User Accounts
            • Create a User Account
            • Manage User Accounts
            • Add or Remove An Existing User Account from an Organization
            • Lock a User Account
            • Export a List of User Accounts
              • About Case Templates
              • Create a Case Template
              • Delete a Case Template
              • Export or Import a Case Template
              • About Page Templates
              • Create a Page Template
              • Delete a Page Template
              • Export a Page Template
              • Import a Page Template
              • About Case Report Templates
              • Widgets
              • Create a Case Report Template
              • Add or Remove Widgets
              • Delete a Case Report Template
            • About Custom Tags
            • Change the Color of a Custom Tag
            • Rename a Custom Tag
            • Delete a Custom Tag
            • View Custom Tag Statistics
            • UI Configuration Settings
            • Prevent Users from Creating Empty Cases
            • Prevent Users from Merging Alerts into Closed Cases
            • Select Similar Cases and Alerts Filters
            • Pause Dashboard Refresh
            • Remove the All Periods Option in a Dashboard
            • Hide KPIs
            • Allow Custom Link Schemes
            • About Notifications
            • Create a Notification
            • Turn Off a Notification
            • Delete a Notification
            • Variable Usage Examples
              • EmailToUser
              • EmailToAddr
              • HttpRequest
              • Mattermost
              • Slack
              • Teams
              • Webhook
              • Kafka
              • Redis
              • RunAnalyzer
              • RunResponder
              • Function
              • Write a FilteredEvent Trigger
              • Operators
              • About Endpoints
              • Add a Local HttpRequest Endpoint
              • Add a Local Mattermost Endpoint
              • Add a Local Slack Endpoint
              • Add a Local Teams Endpoint
              • Add a Local Webhook Endpoint
            • About Functions
            • Create a Function
            • Delete a Function
            • Invoke a Function
            • Functions Objects
            • About Alert Feeders
            • Create an Alert Feeder
            • Turn Off an Alert Feeder
            • Delete an Alert Feeder
            • About Attachments
            • Add an Attachment
            • Remove an Attachment
            • Download an Attachment
            • Share an Attachment
          • Tutorial: Automate Tracking of Pending Alerts
            • About Alerts
              • Find an Alert
              • Overview of Search Methods for Alerts
            • Start Investigating an Alert
            • Create a Case from an Alert
            • Add an Alert to an Existing Case
            • Unlink an Alert and a Case
            • Change an Alert Status
            • Change Alert Classification Settings
            • Enrich Alert Details
            • Ignore Alert Updates from MISP
            • Start Investigating an Alert
            • Assign an Alert
            • Run a Function on an Alert
            • Run Responders and Review Reports for an Alert
            • Find Similar Alerts or Cases
            • Export a List of Alerts
              • About Observables
              • Add an Observable
              • Update the Status of an Observable
              • Edit Multiple Observables
              • Exclude an Observable From Similarity Checks
              • Delete an Observable
              • Find an Observable
              • Find a Job
              • Share an Observable with Other Organizations
              • Export Data from an Observable
              • Pin an Observable
              • Run Analyzers and Review Reports for an Observable
              • Import Observables from Analyzer Reports
              • Run Responders and Review Reports for an Observable
              • About TTPs
              • Export TTPs
              • About Attachments
              • Add an Attachment
              • Remove an Attachment
              • Download an Attachment
              • Share an Attachment
              • About Tags
              • Add or Remove Tags
              • Add Custom Fields
              • Remove Custom Fields
              • Enter Values in Custom Fields
            • About Audit Logs
            • Comment on Alerts
            • Close an Alert
            • Reopen an Alert
            • About Cases
              • Find a Case
              • Overview of Search Methods for Cases
            • Create a Case
            • Export a List of Cases
            • Export an Archived Case
            • Export a Case to MISP
            • Apply a Case Template
            • Find Similar Alerts or Cases
              • About Observables
              • Add an Observable
              • Update the Status of an Observable
              • Edit Multiple Observables
              • Exclude an Observable From Similarity Checks
              • Delete an Observable
              • Find an Observable
              • Find a Job
              • Share an Observable with Other Organizations
              • Export Data from an Observable
              • Pin an Observable
              • Run Analyzers and Review Reports for an Observable
              • Import Observables from Analyzer Reports
              • Run Responders and Review Reports for an Observable
              • Add Custom Fields
              • Remove Custom Fields
              • Enter Values in Custom Fields
              • Add a Link to a Case
              • Remove a Link from a Case
              • View Links in a Case
              • View Alerts Linked to a Case
              • Unlink an Alert and a Case
            • Change a Case Status
            • Change Alert Classification Settings
            • Flag a Case
              • About Tags
              • Add or Remove Tags
            • Add Tasks to a Case
            • Merge Cases
            • Share a Case with Other Organizations
              • About TTPs
              • Add TTPs
              • Export TTPs
              • Remove TTPs
              • About Attachments
              • Add an Attachment
              • Remove an Attachment
              • Download an Attachment
              • Share an Attachment
              • About Case Timelines
              • Add a Custom Event
              • View a Case Timeline
              • Export a Case Timeline
              • Delete a Case Timeline
              • About Case Reports
              • Save and Download a Case Report
            • About Audit Logs
              • Restrict Case Visibility
              • Restore Case Visibility
            • Run a Function on an Alert
            • Run Responders and Review Reports for a Case
            • Comment on Alerts
              • About Case Pages
              • Create a Page
              • Delete a Page
              • Share a Page
              • View a Page
            • Close a Case
            • Reopen a Case
            • Delete a Case
              • About Tasks
              • Create a Task
              • Start a Task
              • Change a Task Status
              • Manage Tasks
              • Export a List of Tasks
              • Delete a Task
                • Find a Task
                • Overview of Search Methods for Tasks
              • Run Responders and Review Reports for a Task
              • Share a Task with Other Organizations
              • Close a Task
              • About Task Logs
              • Create a Task Log
              • Delete a Task Log
              • Find a Task Log
              • Run Responders and Review Reports for a Task Log
            • About Dashboards
            • Widgets
            • Create a Dashboard
            • Add or Remove Widgets
            • Delete a Dashboard
            • Change Visibility of a Dashboard
            • Adjust Dashboard Refresh Frequency
            • Set a Dashboard Display Period
            • Export or Import a Dashboard
            • Download a Dashboard
          • Detail View vs. Preview
          • About Filtering and Sorting
            • About Views
            • Create a Custom View
            • Update a Custom View
            • Delete a Custom View
          • About Autorefresh
          • About Statistics
          • About the Live Feed
        • API Documentation
        • Python Client
        • Go Client
        • Release Notes for Version 5.0
        • Release Notes for Version 5.1
        • Release Notes for Version 5.2
        • Release Notes for Version 5.3
        • Release Notes for Version 5.4
        • Release Notes for Version 5.5
      • Home
        • Download Cortex
        • Authentication
        • Secret key configuration
        • Advanced configuration
        • Configure SSL
        • Step-by-Step Guide
        • Installation and Configuration Guides
        • Analyzers & Responders
        • Run Cortex with Docker
        • Proxy settings
        • Parameters for Docker
        • Database configuration
        • Deploy Cortex on Kubernetes
        • First start
        • User roles
        • Backup & Restore
        • Analyzers/Responders input and output
        • Upgrade to Cortex 3.1
        • Upgrade to Cortex 4.0
          • Deprecation Notice
          • Switch to Manual Download and Installation
        • API Guide
        • How to create an Analyzer
        • How to create a Responder
    • Cortex Neurons
      • Resources
      • TheHive Templates
        • How to download the VM
        • Use the Demo Virtual Machine
          • Main Features
          • Deploy TheHive AMI
          • Deploy Cortex AMI
          • AWS sample code
          • Create and manage the SecOps VPC
          • TheHive v5 and Cortex within a SecOps VPC
          • Main Features
          • Deploy TheHive Azure image
          • Deploy Cortex Azure image
          • Azure sample code
          • Creating a new SecOps Virtual Network
          • Deploying TheHive v5 and Cortex with Terraform
          • Upgrading your Azure instances
          • TheHive4py
          • TheHive4go
          • Cortex4py
          • Cortexutils
      • Security and Data Protection

    Operators list

    Operators

    For a complete list of available operators, see FilteredEvent Trigger Operators.

    StrangeBee
    Empowering incident responders worldwide
    Company
    About usServicesContact us
    Products
    Request a demoTry TheHive On-premTry TheHive Cloud Platform SaaS
    Resources
    BlogSuccess storiesThird-party software licenses
    AICPA SOC certification
    Copyright 2025 StrangeBee. All rights reserved.