Share a Case with External Users#
5.6 Platinum
Share cases with external users to enable controlled collaboration with stakeholders outside the Security Operations Center (SOC) team. Through TheHive Portal, external users can view case information and contribute based on their profile permissions—creating cases, adding comments, uploading attachments, and submitting observables.
Limitation
Cases with restricted visibility can't be shared with external users.
Information sharing control
When cases are shared with external users, SOC teams control exactly what information becomes visible through the portal:
- Comments: Comments aren't automatically shared when a case is shared. Each comment requires explicit marking as external to be visible in the portal.
- Attachments: Like comments, attachments must be individually marked as external for portal visibility.
- Observables: Observables created by analysts remain private and can't be shared with external users. Only observables created by external users themselves are visible in the portal.
Procedure
Prerequisite
External users must already exist in TheHive with the External account type. Create External user accounts before sharing cases with them.
Bulk sharing
To share multiple cases in bulk with external users, go to the Cases view and select next to each case you want to share. Then select Manage external access above the list.
-
Select the Manage external access button.
-
In the External access management drawer, select All external users or Selected external users.
Future external users
Authorizing all external users grants access to both current and future external users.
-
Optional: If you selected Selected external users, select the authorized users.
-
Select Confirm.