Skip to content

Create a Case Report Template#

manageCaseReportTemplate Platinum

Create a case report template in TheHive to generate reports in a predefined format, available from case descriptions.

Procedure

  1. Go to the Organization view from the sidebar menu.

    Organization view

  2. Select the Templates tab.

    Organization templates

  3. Select the Reports tab.

    Organization templates reports

  4. Two options are available:

    • Create a case report template from scratch by selecting .

    • Duplicate an existing case report template by selecting next to the case report template you want to duplicate, then select Duplicate.

  5. In the drawer, enter the following fields:

    - Title *
    The title users will see when selecting reports in case descriptions.

    - Description
    A brief summary of your case report template, outlining its purpose and contents.

  6. Select Add report template or Edit report template.

  7. Drag available widgets to position them as needed.

    Drag widgets

  8. Enter the required information for the widget.

    Available variables

    You can insert variables into certain fields and widgets such as the header, footer, and text widget by selecting Add variable.

    Helpers using Mustache syntax

    Data transformation helpers#

    Helper Description Usage Output
    tlpLabel Format the tlp field of the object {{ tlpLabel object.tlp }} Amber
    papLabel Format the pap field of the object {{ papLabel object.pap }} Amber
    severityLabel Format the severity field of the object {{ severityLabel object.severity }} Critical
    dateFormat Format a date field of the object using Java date time patterns {{dateFormat audit._createdAt "EEEEE dd MMMMM yyyy" "fr" }} jeudi 01 septembre 2022

    Standard string helpers can be found in the official Handlebars documentation.

    Conditional helpers#

    Examples:

    • Displays Medium if case.severity equals 2, otherwise displays Other:
    {{#if (eq case.severity 2) }}
        Medium
    {{else}}
        Other 
    {{/if}}
    
    • Displays the threat actor value only if case.customFieldValues.threat-actor is defined:
    {{#if case.customFieldValues.threat-actor}}
        Threat Actor: {{case.customFieldValues.threat-actor}}
    {{/if}}
    

    Find additional supported operators in the official Handlebars documentation.

  9. Select Confirm.

  10. Select to edit sections, to duplicate them, and to delete them.

  11. Select to preview the case report display.

  12. Select to save your case report template.

Next steps