Skip to content

Change Case or Alert Classification Settings#

manageCase/update manageAlert/update

This topic provides step-by-step instructions for changing the classification settings of a case or alert in TheHive, including severity, Traffic Light Protocol (TLP), and Permissible Actions Protocol (PAP).

Procedure

  1. Find the case or the alert you want to update.

  2. In the case or alert, move through the left pane.

    Case classification settings

  3. Select the severity button to update its value. It indicates the severity level of the case or alert.

  4. Select the TLP button to update its value. It indicates how you can share information about the case or alert with others. Refer to the Malware Information Sharing Platform (MISP) taxonomy for detailed definitions of TLP values.

  5. Select the PAP button to update its value. It specifies which actions you can take with the data of the case or alert. Refer to the MISP taxonomy for detailed definitions of PAP values.

Next steps