Skip to content

Change Case or Alert Classification Settings#

This topic provides step-by-step instructions for changing the classification settings of a case or alert in TheHive, including severity, Traffic Light Protocol (TLP), and Permissible Actions Protocol (PAP).

Required permissions

  • Only users with the manageCase/update permission can change case classification settings in TheHive.
  • Only users with the manageAlert/update permission can change alert classification settings in TheHive.

Procedure

  1. Find the case or the alert you want to update.

  2. In the case or alert, move through the left pane.

    Case classification settings

  3. Select the severity button to update its value. It indicates the severity level of the case or alert.

  4. Select the TLP button to update its value. It indicates how you can share information about the case or alert with others. Refer to the Malware Information Sharing Platform (MISP) taxonomy for detailed definitions of TLP values.

  5. Select the PAP button to update its value. It specifies which actions you can take with the data of the case or alert. Refer to the MISP taxonomy for detailed definitions of PAP values.

Next steps