How to Ignore Alert Updates from MISP

This topic provides step-by-step instructions for ignoring alert updates from MISP in TheHive.

MISP is an open-source threat intelligence platform that integrates with TheHive to retrieve events from MISP servers and convert them into alerts. By default, TheHive automatically updates these alerts when the corresponding MISP events change, which may also update the alerts’ statuses.

Use this procedure to turn off automatic updates for specific alerts.

Requirements

Automatic alert updates are available only for alerts created through MISP server integrations.

Required permissions

Only users with the manageAlert/update permission can manage alert updates from MISP in TheHive.

Procedure

1. Find the alert you want to exclude from automatic updates.

2. In the alert, select Ignore new updates.

   

Next steps

• Change an Alert Status
• Start Investigating an Alert
• Assign an Alert