Notifications#
TheHive Notifications allow you to automatically react on specific events occurring in TheHive and send notification to defined Endpoints that can be:
-
Cortex
-
Webhook listener
-
Http listener
-
Slack
-
Mattermost
Endpoints need to be configured prior to use them in Notifications. You can also send an Email as notification.
Notifications management#
Notifications are unique to each organisation. With an org admin account open the Organization menu (1), and navigate to the Notifications tab (2).
To create a notification, clic on the "+" button (3)
Configure a Notification#
While clicking on add or edit a notifier, a drawer will appear where you can define the following settings:
- Name: Notification name to display within TheHive
- Send notification to every user in the organisation: Check this box to notify by email every users of the organization this Notifier has triggered
- Trigger: Chose in a list of triggers on which event you want to react. You can also select "FilteredEvent" to create your own event filter.
- Enable notification: Check this box to enable the notifier. Uncheck the box to disable the notifier.
Finally, select which endpoint will receive the notification.
Pre-defined triggers & FilteredEvent#
While configuring the Trigger setting, you can pick a pre-defined trigger from a list, or chose to create your own filters.
Current pre-defined filters list:
-
AnyEvent
-
Case Created
-
Case Closed
-
Case Shared
-
Alert Created
-
Alert Imported
-
Job Finished
-
Alert Observable Created
-
Case Observable Created
-
Observable Created
-
Log in my task
-
Task Assigned
-
Task Closed
-
Task Mandatory
But you can also chose to use a custom filter to react on specific events.
Custom filters are JSON format written and can use common operators. Example with a filter for cases which Severity is updated to High or Critical:
Use variables in notifications#
You can include variables in your Email & HTTP notification.
Use the "add variable" bouton to see the list of available variables. Example with an email notification:
See our Leveraging TheHive 5 notifications capabilities blog articles to know more about Notifications