Skip to content

About Notifications#

A notification triggers automated actions when specific events occur within an organization.

This topic explains the different notification capabilities in TheHive.

Key components#

A notification consists of two key components:

One trigger, multiple notifiers

A notification can have only one trigger but multiple notifiers.

  • A trigger: Defines the event that activates the notification, such as case creation, task assignment, or alert import.
  • One or more notifiers: Specify the action taken when the notification is triggered, such as sending an email, making an HTTP request, or posting to Slack or Mattermost.

Triggers#

Associate each notification with only one trigger.

TheHive provides several predefined triggers for cases, alerts, tasks, observables, jobs, and actions. Additionally, create custom triggers using FilteredEvent.

Use the AnyEvent trigger to execute notifications for any event in TheHive.

Triggers on cases#

Triggers on alerts#

Triggers on observables#

  • AlertObservableCreated: Triggered when an observable is created within an alert
  • CaseObservableCreated: Triggered when an observable is created within a case
  • ObservableCreated: Triggered when an observable is created, regardless of whether it belongs to an alert or a case

Triggers on tasks#

  • LoginMyTask: Triggered when a new log is added to a task
  • TaskAssigned: Triggered when a task is assigned to a user or the assignee is updated
  • TaskClosed: Triggered when a task is closed
  • TaskMandatory: Triggered when a task is made mandatory

Triggers on jobs#

  • JobFinished: Triggered when an analyzer job is completed, whether it succeeds or fails

Triggers on actions#

  • ActionFinished: Triggered when a responder action is completed, whether it succeeds or fails

FilteredEvent#

When you select FilteredEvent, TheHive allows you to define a structured JSON filter. This filter is used to match specific events in TheHive.

Learn how to create filtered events and explore examples in the Write a Filtered Event Trigger topic.

Notifiers#

Several types of notifiers are available in TheHive:

Endpoints required

Some notifiers require at least one defined endpoint. Endpoints can be local, defined at the organization level, or global, defined at the client level for one or more organizations. Refer to the dedicated page for each notifier to learn how to create the necessary local endpoints.

Permissions#

Required permissions

Only users with the manageConfig permission can manage notifications in TheHive.

Next steps