Skip to content

Configure the RunResponder Notifier#

manageConfig Platinum

Configure the RunResponder notifier in TheHive to automatically execute Cortex responders when specific triggers occur.

Notifier availability

The RunResponder notifier is available only when you turn off the Send notification to every user in the organization toggle and use one of the following triggers:

  • FilteredEvent
  • ActionFinished
  • CaseClosed
  • CaseCreated
  • CaseFlagged
  • CaseShared
  • AlertClosed
  • AlertCreated
  • AlertImported
  • AlertObservableCreated
  • CaseObservableCreated
  • ObservableCreated
  • TaskClosed
  • TaskMandatory

Cortex integration required

To use analyzers and responders within TheHive, you must connect at least one Cortex server to your TheHive instance.

Procedure

  1. When creating a new notification or editing an existing one, select the RunResponder notifier.

  2. Select the responders you want to run.

  3. Select Confirm.

Next steps