Skip to content

How to Export Tactics, Techniques and Procedures#

This topic provides step-by-step instructions for exporting tactics, techniques and procedures (TTPs) from a case or an alert in TheHive.

TTPs describe the behaviors and methods commonly used by specific threat actors or groups.

Procedure

  1. Find the case or the alert where you want to export TTPs.

  2. In the alert or case, select the TTPs tab.

    TTPs tab

  3. Select Export list to export all TTPs displayed in the tab, reflecting the applied filters and sorting. To export a specific selection of TTPs, select next to the TTPs you want to export, then select Export selection.

    Export list TTPs

  4. In the Export TTP to file drawer, select your preferred formatting options.

  5. Select Export to file.

Next steps