How to Unlink an Alert and a Case#
This topic provides step-by-step instructions for unlinking an alert and a case in TheHive.
An alert is automatically linked to a case when you create a case from an alert or add an alert to an existing case.
Status update
When you unlink an alert from a case, its status automatically changes to one associated with the New stage, regardless of its previous status.
Data transfer
When unlinking an alert and a case, data from the alert, including observables, TTPs, attachments, comments, and custom fields, remains in the case.
From a case#
-
Find the case where you want to unlink alerts.
-
In the case description, select the Linked alerts tab.
-
Select next to the alert you want to unlink.
Applying filters and views
You can apply filters and sorting. These preferences can be saved using views.
-
Select Unlink.
-
Select OK.
From an alert#
Required permissions
Only users with the manageAlert/update permission can unlink an alert and a case from an alert in TheHive.
-
Find the alert you want to unlink.
-
In the alert description, select Unlink.
-
Select OK.