TheHive

What it is

A case management system from StrangeBee where analysts turn incoming alerts into cases, split the work into tasks, and track observables until closure.

What it helps with

- Collecting alerts, including ones from email intake, in one queue for triage
- Assigning tasks to teammates and following progress on each case
- Enriching observables through connected Cortex and MISP servers
- Mapping cases to MITRE ATT&CK tactics and techniques

Who it's for

Security operations, CSIRT, and CERT teams that handle incidents for their own organization or for clients.

Worth knowing

The Community license covers two users and one organization, works only on self-hosted installs, and is requested through a StrangeBee portal account that staff must validate. A new install starts with a 14-day Platinum trial and turns read-only if no license is added.

Is TheHive still open source?
No. The older open-source versions 3 and 4 are no longer maintained or distributed, and current releases ship under StrangeBee's own license terms.

Is there a hosted version?
Yes. TheHive Cloud Platform is available with the Platinum plan.