Skip to content



A notification is a described by:

  1. A Trigger
  2. One or more Notifiers



Each notification is associated to only one trigger. TheHive comes with several predefined triggers on Cases, Alerts, Tasks, Observables and Jobs. Custom triggers can also be defined with FilteredEvent.

Another trigger let you run notifications on any event when selecting AnyEvents.

Triggers on Cases#
  • CaseClosed: Run an action when closing a Case
  • CaseCreated: Run an action when a Case is created
  • CaseShared: Run an action when a Case is shared
Triggers on Alerts#
  • AlertCreated: Run an action when an Alert is created
  • AlertImported: Run an action when an Alert in imported (a Case is created from an Alert or an Alert is attached to an existing Case)
Triggers on Jobs#
  • JobFinished: Run an action when a Job is terminated, with success or failure
Triggers on Observables#
  • ObservableCreated: Run an action when an Observable is created
Triggers on Tasks#
  • LoginMyTask: Run an action when a Task gain a new Log
  • TaskAssigned: Run an action when a Task is assigned, or the assignee is updated
  • TaskClosed: Run an action when a Task is closed
Filtered Event#

When selecting FilteredEvent, TheHive lets you write a structured JSON filter. This filter aims to match particular events in the application that will trigger one or more actions described by notifiers.

Filtered Event

Filtered event example: "Case severity has been updated to Hight or Critical

Learn how to write filtered events and find more example in the dedicated page.


Several types of Notifiers are available in TheHive:

Two of them are dedicated to run Cortex Analyzers and Responders:

Some Notifiers require configuring Endpoints

Some Notifiers require at least one endpoint to be defined. Refer to the page dedicated to each Notifier to learn how to create related endpoints.

Create a Notification#

Access to the Notifications list by opening the Organisation menu, and the Notifications tab.

Notifications list

Click the button to add a notification.

Create a notification

  1. Give a unique name to the notification
  2. Select a trigger
  3. Select a notifier and configure it

Then click confirm to register the notification.

Operations on Notifications#

Delete a Notification#

In the list of notification, click on the delete option:

Delete a notification

Disable a Notificaiton#

  • In the list of Notifications, edit the one to disable:

Disable a notification

  • Verify the result in the list of Notifications

Disabled notification