Skip to content

Added Run Suspicious_Verdict Responder notification - #6

Open
EnzoCyberSec wants to merge 1 commit into
StrangeBeeCorp:mainfrom
EnzoCyberSec:feature/suspicious-notification
Open

Added Run Suspicious_Verdict Responder notification#6
EnzoCyberSec wants to merge 1 commit into
StrangeBeeCorp:mainfrom
EnzoCyberSec:feature/suspicious-notification

Conversation

@EnzoCyberSec

Copy link
Copy Markdown

Summary

Adds a TheHive notification that automatically runs the Suspicious_Verdict Responder (submitted in TheHive-Project/Cortex-Analyzers, see PR #1503) whenever a suspicious:verdict= tag is added to a Case or an Alert. This automates the synchronization between TheHive triage and Suspicious, Thales CERT's case management platform.

What's included

  • integrations/vendors/Suspicious/thehive/notifications/run_suspicious_verdict_responder.json — the filteredEvent notification definition
  • integrations/vendors/Suspicious/thehive/notifications/README.md — documentation: how the filter works, prerequisites, import steps in TheHive, and a link back to the responder

Verification performed

  • ✅ Imported into a test TheHive instance and confirmed the notification triggers only on Case/Alert objects with an added suspicious:verdict= tag (no false trigger on tag removal or unrelated tags).
  • ✅ Confirmed the responder runs end-to-end once triggered, updating the matching Suspicious investigation.

Related contribution

This notification is an optional companion to the Suspicious_Verdict responder submitted in TheHive-Project/Cortex-Analyzers (Issue #1496).

@EnzoCyberSec
EnzoCyberSec changed the base branch from develop to main September 4, 2026 15:07
@EnzoCyberSec

Copy link
Copy Markdown
Author

Refer to the issue #5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant