Skip to content

How to Start Investigating an Alert#

This topic provides step-by-step instructions for starting the investigation of an alert in TheHive.

Use this procedure to start investigating a new alert and change its status so that it moves from the New stage to the In progress stage.

Required permissions

Only users with the manageAlert/update permission can start investigating an alert in TheHive.

Procedure

  1. Find the alert you want to start investigating.

  2. In the alert description, select Start.

    Start investigating an alert

  3. In the Change the alert status drawer, update the status for the alert, write an initial analysis, and assign it to someone else if needed.

  4. Select Confirm.

Next steps