About Statuses#
The status represents the current state of a case or alert.
This topic explains how statuses works in TheHive.
Task statuses
This page doesn't cover task statuses, which are hard-coded in TheHive. They can't be modified, deleted, or extended.
Predefined statuses#
TheHive includes a set of predefined statuses. Administrators can change their color, or hide them to encourage the use of custom statuses.
Attributes#
Each status is associated with:
-
A stage: TheHive includes four predefined stages—New, Imported, In progress, and Closed. Stages are hard-coded and can't be modified, deleted, or extended.
Imported stage
The Imported stage and status aren't available for selection in the interface. The Imported status is automatically applied when an alert is merged into an existing case or merged into a new case.
-
5.5 A visibility: The status is either displayed or hidden in TheHive interface.
-
A color: The color helps users easily recognize the status.
Behavior#
Alert status restrictions
Alerts in a status linked to the Closed stage can't return to a New or In progress stage unless the user has permission to reopen a closed alert. The same restriction applies when trying to switch from In progress back to New.
-
Statuses linked to the In progress stage are available at any time for cases, but only when starting the investigation of an alert or reopening a closed alert for alerts.
-
Statuses linked to the Closed stage are available only when closing a case or closing an alert.
Permissions#
Required permissions
Only users with an admin-type profile that has the managePlatform
permission can manage case and alert statuses in TheHive.
After creation, statuses are available to users in cases and alerts.