Change an Alert Status

manageAlert/update manageAlert/reopen

Change the status of an alert in TheHive to reflect its current state in the triage workflow.

Procedure

1. Find the alert you want to update.

2. In the alert, move through the Status section in the left pane.

   

3. Select the new status from the dropdown list.

   Can't find a status?

   If you can't find the status you need, it may be due to one of the following reasons:

   • The status isn't available from the alert description page. Statuses linked to the In progress stage are available only when starting the investigation of an alert or reopening a closed alert. Statuses linked to the Closed stage are available only when closing an alert.
   • The status doesn't exist yet, or someone may have deleted or hidden it. Contact someone with admin-level permissions to create it or restore it.

4. Select Save.

Next steps

• Start Working on an Alert
• Assign an Alert
• Ignore Alert Updates from MISP
• Add an Alert to an Existing Case
• Create a Case from an Alert
• Run Responders and Review Reports for an Alert