Report and page templates

Every security team needs to provide incident reports to management. Writing these reports manually can be time-consuming, but TheHive 5 simplifies your daily work with a simple, customizable and powerful report generator. Once your templates are ready, generating a report takes just two clicks!

Good reports are the easiest to read. You’ll want to identify which information is most valuable to your readers and make it visible at first glance. For example, a good starting point is adding the case number and title to the report header so everyone immediately knows what the document refers to.

The footer is also a great place to watermark the report with useful data, such as the TLP level, relevant DLP keywords or the name of the user who generated it.

In the body, you can drag and drop widgets that best represent the data you want to highlight. Use lists or tables for customFields, observables or TTPs. With the text widget, you can insert variables to display case details like severity, creation date or assignee.

Using the list or table widget, you can really explore the full depth of this feature. For example, you can choose which columns to display and define the order of each one.

You also have full control over the rows: set the maximum number of elements, choose the field to sort by and apply filters to exclude sensitive or irrelevant data.

Finally, you can even protect the data to prevent accidental clicks on potentially malicious hyperlinks.

Timeline enthusiasts, you’re in good hands! Include the auto-generated, fully customizable case timeline in your reports and let readers catch up on the incident in seconds.

You’re now ready to create clean, professional and effective reports to share with management or external partners.

If you’re looking for inspiration, check out the “Standard report template” included out of the box with TheHive 5. It’s designed to cover common use cases—so feel free to duplicate and customize it to fit your needs.

We added pages to TheHive for analysts who want to write content within a case that doesn’t originate from a task or doesn’t belong in the case description or summary.

Once created, you can include a page template in your case templates or import it into any existing case.

We’re delighted to see that lots of mature teams make great use of this feature to draft various documents related to their cases, like post-mortem analyses, lessons learned and more.

Thanks to page templates, analysts can import and use ready-made skeletons to fill in, drastically reducing their workload and improving overall efficiency.