If you like playbooks, you’ll love case templates. In fact, most mature teams even disable the option to create cases from scratch, ensuring analysts rely on predefined templates for consistency and efficiency.
Let’s explore why this is one of the greatest features of TheHive.
When creating a case or an alert, you can start from scratch or use a case template.
With a template, each case automatically inherits predefined customFields (and their values), tasks with clear descriptions to guide analysts, tags, TLP, severity and much more.
Having these customFields already included—and even pre-filled with values—significantly improves your average case qualification, while reducing analysts’ workload and the risk of errors.
And if you need to complete a post-mortem analysis for your incidents, templates have you covered too, with pre-written sections automatically added to the case’s text page.
(Did we already tell you that you’re going to love case templates?)
Before creating a case template, it’s worth considering which approach or philosophy you want to follow.
A threat-oriented approach is the most commonly used and often the most effective for security teams.
For example, a phishing case template allows analysts to go deeper into every step required to analyze and respond to that specific threat. As a result, analysts are guided through successive tasks right up to case closure.
On the other hand, detection source-oriented playbooks are higher-level and often easier to implement. They give analysts more flexibility to adapt their response to each situation and can also simplify the mapping of alert sources during integration.
So far, these are the two main approaches we’ve seen in use. But because TheHive is highly flexible, you can design templates that follow your own methodology—no matter how advanced or unique it is.
Let’s take a closer look at each component of a case template and see how to extract the most value from this feature.
*These values can be overridden by the analyst or by data coming from an alert.
If your team already has well-defined playbooks, building your task list will be as easy as ABC. And if not, it might be the perfect time to create them!
Starting from your existing playbooks or workflows, simply break down each step into a task and use the task description to define the what and how:
Another way to build a task list is to reuse a structure that’s widely adopted across the community for all your case templates: Preparation, Identification, Containment, Remediation, Recovery and Lessons Learned.
Using such a standard framework means you’ll need to clarify what each task represents in the context of your own playbook. In this case, the more information you provide to analysts through task descriptions, the less room there is for mistakes or omissions.
Missing inspiration to create your case template tasks? A great place to start is by looking at standard incident response procedures and adapting them over time to fit your team’s needs and context.
The next section might just give you the inspiration you’re looking for!
At StrangeBee, we love the CERT-SG IRM sheets: they are an strong foundation for any team building its own incident response procedures.
We thought our users would enjoy using them as case templates and customizing them to add their own touch, so we made it happen:
