Skip to content

Run Responders and Review Reports for a Case#

Cortex responders execute actions on cases, alerts, observables, tasks, and task logs.

Run responders on a case to execute automated actions such as closing an external ticket or performing a predefined response within TheHive.

Responders execute actions on cases, alerts, observables, tasks, and task logs.

Observables not included

Running a responder on a case doesn't run it on the observables linked to the case. To run responders on an observable, see Run Responders and Review Reports for an Observable.

Running functions on a case

5.4 Did you know it’s possible to run functions on cases just like running responders? See Run a Function on a Case or an Alert for detailed instructions.

Run responders on a case#

  1. Locate the alert on which you want to run responders.

  2. In the case, select Responders.

    Responders button

  3. In the drawer, select the responders you want to run.

  4. Select Launch actions.

  5. Select Confirm.

Review responder reports for a case#

  1. Locate the case on which you ran responders.

  2. In the case, select the Responders tab to check the status of the executed responders.

    Responders tab

Next steps