Skip to content

How to Remove Tactics, Techniques and Procedures#

This topic provides step-by-step instructions for removing tactics, techniques and procedures (TTPs) from a case or an alert in TheHive.

TTPs describe the behaviors and methods commonly used by specific threat actors or groups.

Required permissions

Only users with the manageProcedure permission can add and remove TTPs in cases and alerts in TheHive.

Procedure

  1. Find the case or the alert where you want to remove TTPs.

  2. In the description, select the TTPs tab.

    TTPs tab

  3. Select next to the TTP you want to remove.

    Applying filters and views

    You can apply filters and sorting. These preferences can be saved using views.

    Bulk remove

    To remove TTPs in bulk, select to each TTP you want to remove, then at the top of the screen.

  4. Select Delete.

  5. Select OK.

Next steps