Configure the RunResponder Notifier#
Configure the RunResponder notifier in TheHive to automatically execute Cortex responders when specific triggers occur.
Notifier availability
The RunResponder notifier is available only when you turn off the Send notification to every user in the organization toggle and use one of the following triggers:
- FilteredEvent
- ActionFinished
- CaseClosed
- CaseCreated
- CaseFlagged
- CaseShared
- AlertClosed
- AlertCreated
- AlertImported
- AlertObservableCreated
- CaseObservableCreated
- ObservableCreated
- TaskClosed
- TaskMandatory
Cortex integration required
To use analyzers and responders within TheHive, you must connect at least one Cortex server to your TheHive instance.
Procedure
-
Go to the Organization view from the sidebar menu.
-
Select the Notifications tab.
-
Select next to the notification where you want to add the notifier, then select Edit.
-
Select the RunResponder notifier.
-
Select the responders you want to run.
-
Select Confirm.