Run Responders and Review Reports for an Alert#
Cortex responders execute actions on cases, alerts, observables, tasks, and task logs.
Run responders on an alert to execute automated actions such as closing an external ticket or performing a predefined response within TheHive.
Only responders authorized for alerts and matching their TLP (traffic light protocol) and PAP (permissible actions protocol) levels are available.
Observables not included
Running a responder on an alert doesn't run it on the observables linked to the alert. To run responders on an observable, see Run Responders and Review Reports for an Observable.
Running functions on an alert
5.4 Did you know it’s possible to run functions on alerts just like running responders? See Run a Function on a Case or an Alert for detailed instructions.
Run responders on an alert#
-
Locate the alert on which you want to run responders.
-
In the alert, select Responders.
6.0 You can also go to the Automations tab, select the Responders tab, then select Run Responders.
-
In the Run actions on current alert drawer, select the responders you want to run.
-
Select Launch actions.
-
Select Confirm.
Review responder reports for an alert#
-
Locate the alert on which you ran responders.
-
In the alert, select the Responders tab to check the status of the executed responders.
6.0 You can also go to the Automations tab and select the Responders tab. This list also includes the responders run on the observables of the alert, with the following columns:
- Status: Whether the responder is waiting, in progress, succeeded, failed, or was deleted from Cortex
- Name: The responder that ran. The name is blank while the responder is waiting.
- Title: The observable the responder ran on. Select it to open the observable. A dash means the responder ran on the alert itself.
- Entity: The type of object the responder ran on
- Triggered by: Who ran the responder
- Start date: When the responder started