TheHive
SOC case management platform, now freemium under StrangeBee after its open source era.
Technical Architecture & Overview
TheHive is a SOC case management platform, organizing alerts into cases with tasks, observables, and timeline tracking, and pairing with MISP and Cortex. Version 5, developed by StrangeBee, replaced the original AGPL open source model with a commercial license: a free Community license covers basic needs, and paid Gold and Platinum licenses add features and scale. TheHive 3 and 4 are no longer maintained or distributed, and their repositories are archived.
Targeted Technical Use Cases
SOC teams that want mature case management with analyst workflow and integrations already designed in.
Evaluation & Trade-offs
Core Strengths
- +Purpose-built analyst workflow from alert triage through investigation and reporting.
- +Cortex and MISP integration are native.
- +Free Community license for on-prem use.
Trade-Offs & Limitations
- -v5 licensing is closed; the open source v4 is no longer distributed.
- -Platform migration from v4 needs planning.
Defensive Security Application
Structuring alert triage and incident casework for security operations teams.
Frequently Asked Questions
What is TheHive?→
TheHive is a SOC case management platform, organizing alerts into cases with tasks, observables, and timeline tracking, and pairing with MISP and Cortex. Version 5, developed by StrangeBee, replaced the original AGPL open source model with a commercial license: a free Community license covers basic needs, and paid Gold and Platinum licenses add features and scale. TheHive 3 and 4 are no longer maintained or distributed, and their repositories are archived.
What is TheHive used for?→
SOC teams that want mature case management with analyst workflow and integrations already designed in.
What are the strengths of TheHive?→
- +Purpose-built analyst workflow from alert triage through investigation and reporting.
- +Cortex and MISP integration are native.
- +Free Community license for on-prem use.
What are the limitations of TheHive?→
- +v5 licensing is closed; the open source v4 is no longer distributed.
- +Platform migration from v4 needs planning.
How is TheHive used defensively?→
Structuring alert triage and incident casework for security operations teams.