How to Change an Alert Status

This topic provides step-by-step instructions for changing the status of an alert in TheHive.

Required permissions

Only users with the manageAlert/update or manageAlert/reopen permissions can change an alert status in TheHive.

Procedure

1. Find the alert you want to update.

2. In the alert, move through the Status section in the left pane.

   

3. Select the new status from the dropdown list.

   Can't find a status?

   If you can't find the status you need, it may be due to one of the following reasons:

   • The status isn't available from the alert description page. Statuses linked to the In progress stage are available only when starting the investigation of an alert or reopening a closed alert. Statuses linked to the Closed stage are available only when closing an alert.
   • The status doesn't exist yet, or someone may have deleted or hidden it. Contact someone with admin-level permissions to create it or restore it.

4. Select Save.

Next steps

• Start Investigating an Alert
• Assign an Alert
• Ignore Alert Updates from MISP
• Add an Alert to an Existing Case
• Create a Case from an Alert
• Run Responders and Review Reports for an Alert