Skip to content

Enrich Alert Details#

manageAlert/update

Enrich alert details in TheHive by updating its title, tags, description, and custom fields to provide additional context for triage and investigation.

Status update

When you enrich a new alert, its status automatically changes from one linked to the New stage to one linked to the In progress stage. To choose a different status within the In progress stage, see Change an Alert Status.

Procedure

  1. Find the alert you want to enrich.

  2. Update the following fields:

    - Title

    The title of the alert.

    - Tags

    Relevant tags for labeling the alert.

    - Description

    A description of the alert using TheHive-flavored Markdown syntax.

    5.5 You can add a full-size image by dropping it into the Description field or selecting the symbol.

    Wait for the upload to complete

    Wait until the image path appears in parentheses. If it doesn’t, the upload is still in progress, and the image won’t display as expected.

    - Custom fields

    Custom fields for the alert, with or without predefined values.

  3. Select Confirm.

Next steps