Skip to content

Close Cases#

Closing a case is one of the basic TheHive functionnalities. It indicates the investigations and responses on this incident are over.

To close a case, you must have the manageCase permission (refer to Profiles and permissions)

You can find the Close button on the case banner:

close case

Closing a case requires that all tasks contained in the case are closed. If you didn't closed the tasks before, a pop-up will suggest you to close them all.

Finally, provide the necessary details to close the case:

  • Status: If the case was a True Positive, a False Positive, if this is still Indeterminate or Other (not an incident)
    • If True positive: Was there an impact (yes/no)
  • Summary: a summary of the incident

close case

Once the details provided, clic on Close case.

Last update: September 15, 2021 04:34:56