Skip to content

How to Run Responders and Review Reports for a Case#

This topic provides step-by-step instructions for running responders on a case and reviewing responder reports in TheHive.

Responders execute actions on cases, alerts, observables, tasks, and task logs.

Run a responder on a case to take actions such as closing an external ticket or executing a predefined response within TheHive.

Observables not included

Running a responder on a case doesn't run it on the observables linked to the case. To run responders on an observable, see Run Responders and Review Reports for an Observable.

Running functions on a case

5.4 Did you know it’s possible to run functions on cases just like running responders? See Run a Function on a Case or an Alert for detailed instructions.

Run responders on a case#

  1. Locate the alert on which you want to run responders.

  2. In the case, select Responders.

    Responders button

  3. In the drawer, select the responders you want to run.

  4. Select Launch actions.

  5. Select Confirm.

Review responder reports for a case#

  1. Locate the case on which you ran responders.

  2. In the case, select the Responders tab to check the status of the executed responders.

    Responders tab

Next steps