Skip to content

About Statuses#

The status represents the current state of a case or alert.

This topic explains how statuses works in TheHive.

Task statuses

This page doesn't cover task statuses, which are hard-coded in TheHive. They can't be modified, deleted, or extended.

Predefined statuses#

TheHive includes a set of predefined statuses. Administrators can change their color, or hide them to encourage the use of custom statuses.

Attributes#

Each status is associated with:

  • A stage: TheHive includes four predefined stages—New, Imported, In progress, and Closed. Stages are hard-coded and can't be modified, deleted, or extended.

    Imported stage

    The Imported stage and status aren't available for selection in the interface. The Imported status is automatically applied when an alert is merged into an existing case or merged into a new case.

  • 5.5 A visibility: The status is either displayed or hidden in TheHive interface.

  • A color: The color helps users easily recognize the status.

Behavior#

Alert status restrictions

Alerts in a status linked to the Closed stage can't return to a New or In progress stage unless the user has permission to reopen a closed alert. The same restriction applies when trying to switch from In progress back to New.

Permissions#

Required permissions

Only users with an admin-type profile that has the managePlatform permission can manage case and alert statuses in TheHive.

After creation, statuses are available to users in cases and alerts.

Next steps