Skip to content

Unlink an Alert and a Case#

Unlink an alert and a case in TheHive when they're no longer related or if the alert was linked incorrectly.

An alert is automatically linked to a case when you create a case from an alert or add an alert to an existing case.

Status update

When you unlink an alert from a case, its status automatically changes to one associated with the New stage, regardless of its previous status.

Data transfer

When unlinking an alert and a case, data from the alert, including observables, TTPs, attachments, comments, and custom fields, remains in the case.

From a case#

  1. Find the case where you want to unlink alerts.

  2. In the case, select the Linked alerts tab.

    Linked alerts

  3. Select next to the alert you want to unlink.

    Applying filters and views

    Apply filters and sorting and save preferences using views.

  4. Select Unlink.

  5. Select OK.

From an alert#

manageAlert/update

  1. Find the alert you want to unlink.

  2. In the alert, select Unlink.

    Unlink alert symbol

  3. Select OK.

Next steps