How to Run Responders and Review Reports for an Alert#
This topic provides step-by-step instructions for running responders on an alert and reviewing responder reports in TheHive.
Responders execute actions on cases, alerts, observables, tasks, and task logs.
Run a responder on an alert to take actions such as closing an external ticket or executing a predefined response within TheHive.
Observables not included
Running a responder on an alert doesn't run it on the observables linked to the alert. To run responders on an observable, see Run Responders and Review Reports for an Observable.
Running functions on an alert
5.4 Did you know it’s possible to run functions on alerts just like running responders? See Run a Function on a Case or an Alert for detailed instructions.
Run responders on an alert#
-
Locate the alert on which you want to run responders.
-
In the alert, select Responders.
-
In the Run actions on current alert drawer, select the responders you want to run.
-
Select Launch actions.
-
Select Confirm.
Review responder reports for an alert#
-
Locate the alert on which you ran responders.
-
In the alert, select the Responders tab to check the status of the executed responders.
