Centralize and automate incident response with TheHive
Investigate with full context, react to threats faster and scale your operations with our collaborative Cybersecurity Incident Response Management (CIRM) platform trusted in 50+ countries.
Trusted by 5,000+ SOC, CERT, CSIRT and MSSP analysts in 50+ countries
developed for clarity, consistency and control
Purpose-built to solve incident response
challenges for SOCCERTCSIRTMSSP teams
Reducing
alert fatigue
alert fatigue
Alerts pour in from every direction, and it's easy to lose track of what actually matters. Cutting through that requires one deduplicated queue with everything ready for triage.
Centralizing
all context
all context
Evidence and context scatter across separate tools, and analysts lose time piecing it together. What it takes is a case that holds it all, easy to manage.
Automating
routine steps
routine steps
Manually executing actions like enrichment and response case after case drains time and energy. Built-in automation frees analysts for judgment calls that matter.
Getting full visibility
& collaborating
& collaborating
Lack of standardized collaboration and transparency can add complexity as teams grow, so they need one shared way to work together and report.
thehive in action
How TheHive works
See how our Cybersecurity Incident Response Management platform brings the complete incident lifecycle
into a collaborative, case-centric workspace, from the first alert to final resolution.
into a collaborative, case-centric workspace, from the first alert to final resolution.
Centralize
Manage security alerts
from a single interface
from a single interface
Bring alerts from every source into one structured queue, deduplicated and ready to triage, turning alert volume into clear priorities before analysts even start investigating.
Investigate
Structure your case management
Bring every piece of an investigation (observables, evidence, tasks, decisions and enrichment results) into one case, structured as you see fit, easy to manage and navigate.
Respond
React to incidents
in one click
Trigger active responses directly from a case, so action follows the decision immediately, with no delay in between.
Scale
Grow without adding complexity
Scale your operations with standardized collaboration, automated routine steps and full transparency. Establish one shared way to work, act and report, with clear roles, permissions and visibility along the way.
Automation and orchestration
TheHive Flow:
investigation-first automation
TheHive Flow brings native orchestration to your incident data in TheHive. Launch workflows straight from a case or an alert
and automate every stage of the investigation, from the first alert to resolution.
TheHive Flow handles the repetitive tasks like alert triage, enrichment and escalation through automated workflows. Analysts save time to assess threats and decide how to respond.
Build fast using the visual editor, then customize with custom Python or JavaScript. Start simple, add depth when needed.
Bring your own LLM to summarize alerts, classify observables or draft a case comment, directly within a workflow. Bring relevant context into the investigation to support your judgment.
Bring your EDR, SIEM, threat intelligence, ticketing and other tools into a same workflow, with ready-to-use nodes. Pass results between systems and use them to drive the next action.
TheHive records every run, with details of each step’s results and see exactly where a workflow breaks. Automation stays transparent and auditable.
Expand
Expand
Expand
Expand
Expand
5,000+ analysts worldwide are using TheHive.
Let us show you how you could, too.
Let us show you how you could, too.
a perfect fit
See how TheHive integrates into your infrastructure
A single workspace at the centre of your security operations
TheHive easily connects to your detection, enrichment and response systems, so analysts work from one place instead of a dozen.
Ecosystem
Extend TheHive
with 300+ integrations
with 300+ integrations
to boost your investigations and response
deploy your way
Deployment options for TheHive
Find what fits your team’s infrastructure and operational requirements.
On-premises
Run TheHive in your own infrastructure and retain complete control over your environment and data.
self-hosted
Learn more
Cloud Platform
Host TheHive in your own dedicated AWS environment and let StrangeBee maintain it.
SaaS
Learn more
Cloud Images
Deploy TheHive as images on AWS and Azure.
IaaS
Learn more
Learning, testing or researching security operations?
Try TheHive's free Community license, limited to two users! It's a scaled-down version of our platform for individual and non-production purposes, built for students, researchers and homelab enthusiasts.
Testimonials
What security teams say about TheHive
We have been using TheHive for many years for our internal needs and those of our customers. It is a tool we have seen evolve over time, which is simple to use and effective for our day-to-day operational activities. The SOAR component is quite relevant and efficiently allows for improving the operational load of SOC/CSIRT analysts. It facilitates our life and has a multitude of integration possibilities with third-party tools such as MISP.
Abdoulaye Fadiga
GM, Global Cyber Operations EU, BT Business
Thanks to the creative minds and community behind TheHive and Cortex, we can efficiently investigate alerts and threats at scale throughout our organization. Having TheHive allows the freedom to build, design, and integrate with all of our security analyst's tools.
Nicholas Penning
Cybersecurity architect, Bureau of Information and Telecommunications, State of South Dakota
CERT Arkéa has been using the TheHive/Cortex combo for several years. In addition to the monitoring of submitted cases, the analysis of IOCs and the automation of incident responses via Cortex are a huge added value to our daily activity. The ease of creating a responder allows us to interact with the various IS APIs (ticketing, proxy blacklisting, IP blocking, takedown of phishing sites). By industrializing and automating our processes via TheHive/Cortex, the analysts save precious time in resolving incidents.
Guillaume Roussel
CERT / CSIRT, ARKEA
My experience with TheHive platform was nothing short of exhilarating. It's like the turbocharged engine of our cybersecurity arsenal, accelerating our threatening message to new heights. TheHive’s sleek interface and top-tier customer support make it a true champion on the cybersecurity track. I am revved up to recommend it.
gartner.com
Software industry
TheHive is a very high-performance and scalable product, which is designed for different platforms, with a very good user-friendly interface.
gartner.com
Education industry
TheHive is incredibly adaptable to our workflow needs. Its alert management system and integration capabilities make it suitable for both small setups and large enterprises.
gartner.com
Manufacturing industry
TheHive is a pretty cool tool for dealing with cyber incidents. You can tweak it to fit your needs, and it plays well with other security tools. It's great for teamwork, helps you stay organized, and makes it easier to figure out which threats are serious.
gartner.com
IT services industry
Our experience with TheHive has been largely positive. It has become an integral part of our incident response and threat intelligence workflow.
gartner.com
IT services industry
TheHive is a powerful and versatile tool for security incident response. It has the ability to automate tasks very well. TheHive has a user-friendly and intuitive interface that makes it easy to create, manage, and analyze security incidents.
gartner.com
IT services industry
From the first deployment until today, it has proved itself to be a game-changer in cybersecurity, and the results are evident. It helps automate repetitive security tasks and workflows. It also reduces the overall work pressure on our threat analysts, who can, in return, focus more on critical tasks and thus improve response time. The UI is also smooth, and navigation is easy. Integration and deployment were done quickly as well.
gartner.com
Insurance (except health) industry
It boasts tight integration with MISP and has been specifically designed to streamline and accelerate the resolution of security incidents. The three most important things that I liked about it are: 1. The ability to facilitate collaboration among multiple SOCs and CERTs. 2. It simplifies the management of tasks and alerts originating from various sources. 3. It is user-friendly and cost-effective.
gartner.com
Transportation industry
I have had a positive experience utilizing TheHive, a product implemented by our parent company and has helped us easily navigate incident response cases.
gartner.com
Construction industry
Excellent speed. User-friendly UI. Excellent support: TheHive's support team operates like a well-oiled pit crew, consistently responsive and prepared to assist.
gartner.com
Education industry
[TheHive] facilitates the creation and consolidation of cases within your ongoing work. The alert management and flexible integration capabilities of TheHive enable seamless adoption across a spectrum of installations, ranging from small setups to expansive enterprise deployments.
gartner.com
Software industry
Ease of use, easy integration with various security tools, able to be used in big environments.
gartner.com
Miscellaneous industry
TheHive makes life easier for SOCs
gartner.com
Miscellaneous industry
A scalable Security Incident Response platform. Very powerful. Recommended.
gartner.com
IT services industry
TheHive helps us create and merge cases. You can integrate it with Cortex and Wazuh, which maintains a better security posture. TheHive also helps us solve the problem of tracking down incidents. You can assign tasks to your teammates and track down the case. Also, if your investigation is over, you can close this case with proper justification. You can also integrate the tool with different SIEMs, Threat Intel tools, etc.
g2.com
Miscellaneous industry
A very good tool to manage incident response workflows, it helps create and maintain a structure for your security operations team.
gartner.com
Banking industry
The best part of TheHive is its integration with multiple threat intelligence tools like Cortex and MISP. Best for SOC teams for their incident response and case management.
g2.com
Miscellaneous industry
Easy to use and configure. Various integrations with various threat intel tools. We get all alerts from our SIEM on TheHive and easily manage them. Immense benefits.
g2.com
Miscellaneous industry
The alert management and the openness of TheHive allow to easily integrate it with different enterprise installations, from small to large. We are able to use it in a very big environment with extremely complex use cases and operation processes, and it works really great. The native integration of MISP interface is really helpful. TheHive’s file system, multi-tenancy, sharing of cases, alerts and observables are outstanding features that make this product choice number 1.
g2.com
Miscellaneous industry
What I like the most about TheHive are maintained dockers, scalability, efficiency in CTI checks, ease of use, design, and connectivity to other tools, thanks to the strong contributions from the community.
Julien M.
Cybersecurity analyst, CERT Gemalto
TheHive is designed for different environments and provides a user-friendly application GUI. It is a great product with good support and is easy to implement. Very little training was needed to navigate and use it. The collaboration method and being able to use TheHive in various capacities.
g2.com
Miscellaneous industry
We have been using TheHive for many years for our internal needs and those of our customers. It is a tool we have seen evolve over time, which is simple to use and effective for our day-to-day operational activities. The SOAR component is quite relevant and efficiently allows for improving the operational load of SOC/CSIRT analysts. It facilitates our life and has a multitude of integration possibilities with third-party tools such as MISP.
Abdoulaye Fadiga
GM, Global Cyber Operations EU, BT Business
Thanks to the creative minds and community behind TheHive and Cortex, we can efficiently investigate alerts and threats at scale throughout our organization. Having TheHive allows the freedom to build, design, and integrate with all of our security analyst's tools.
Nicholas Penning
Cybersecurity architect, Bureau of Information and Telecommunications, State of South Dakota
CERT Arkéa has been using the TheHive/Cortex combo for several years. In addition to the monitoring of submitted cases, the analysis of IOCs and the automation of incident responses via Cortex are a huge added value to our daily activity. The ease of creating a responder allows us to interact with the various IS APIs (ticketing, proxy blacklisting, IP blocking, takedown of phishing sites). By industrializing and automating our processes via TheHive/Cortex, the analysts save precious time in resolving incidents.
Guillaume Roussel
CERT / CSIRT, ARKEA
My experience with TheHive platform was nothing short of exhilarating. It's like the turbocharged engine of our cybersecurity arsenal, accelerating our threatening message to new heights. TheHive’s sleek interface and top-tier customer support make it a true champion on the cybersecurity track. I am revved up to recommend it.
gartner.com
Software industry
TheHive is a very high-performance and scalable product, which is designed for different platforms, with a very good user-friendly interface.
gartner.com
Education industry
TheHive is incredibly adaptable to our workflow needs. Its alert management system and integration capabilities make it suitable for both small setups and large enterprises.
gartner.com
Manufacturing industry
TheHive is a pretty cool tool for dealing with cyber incidents. You can tweak it to fit your needs, and it plays well with other security tools. It's great for teamwork, helps you stay organized, and makes it easier to figure out which threats are serious.
gartner.com
IT services industry
Our experience with TheHive has been largely positive. It has become an integral part of our incident response and threat intelligence workflow.
gartner.com
IT services industry
TheHive is a powerful and versatile tool for security incident response. It has the ability to automate tasks very well. TheHive has a user-friendly and intuitive interface that makes it easy to create, manage, and analyze security incidents.
gartner.com
IT services industry
From the first deployment until today, it has proved itself to be a game-changer in cybersecurity, and the results are evident. It helps automate repetitive security tasks and workflows. It also reduces the overall work pressure on our threat analysts, who can, in return, focus more on critical tasks and thus improve response time. The UI is also smooth, and navigation is easy. Integration and deployment were done quickly as well.
gartner.com
Insurance (except health) industry
It boasts tight integration with MISP and has been specifically designed to streamline and accelerate the resolution of security incidents. The three most important things that I liked about it are: 1. The ability to facilitate collaboration among multiple SOCs and CERTs. 2. It simplifies the management of tasks and alerts originating from various sources. 3. It is user-friendly and cost-effective.
gartner.com
Transportation industry
I have had a positive experience utilizing TheHive, a product implemented by our parent company and has helped us easily navigate incident response cases.
gartner.com
Construction industry
Excellent speed. User-friendly UI. Excellent support: TheHive's support team operates like a well-oiled pit crew, consistently responsive and prepared to assist.
gartner.com
Education industry
[TheHive] facilitates the creation and consolidation of cases within your ongoing work. The alert management and flexible integration capabilities of TheHive enable seamless adoption across a spectrum of installations, ranging from small setups to expansive enterprise deployments.
gartner.com
Software industry
Ease of use, easy integration with various security tools, able to be used in big environments.
gartner.com
Miscellaneous industry
A scalable Security Incident Response platform. Very powerful. Recommended.
gartner.com
IT services industry
TheHive helps us create and merge cases. You can integrate it with Cortex and Wazuh, which maintains a better security posture. TheHive also helps us solve the problem of tracking down incidents. You can assign tasks to your teammates and track down the case. Also, if your investigation is over, you can close this case with proper justification. You can also integrate the tool with different SIEMs, Threat Intel tools, etc.
g2.com
Miscellaneous industry
A very good tool to manage incident response workflows, it helps create and maintain a structure for your security operations team.
gartner.com
Banking industry
The best part of TheHive is its integration with multiple threat intelligence tools like Cortex and MISP. Best for SOC teams for their incident response and case management.
g2.com
Miscellaneous industry
Easy to use and configure. Various integrations with various threat intel tools. We get all alerts from our SIEM on TheHive and easily manage them. Immense benefits.
g2.com
Miscellaneous industry
The alert management and the openness of TheHive allow to easily integrate it with different enterprise installations, from small to large. We are able to use it in a very big environment with extremely complex use cases and operation processes, and it works really great. The native integration of MISP interface is really helpful. TheHive’s file system, multi-tenancy, sharing of cases, alerts and observables are outstanding features that make this product choice number 1.
g2.com
Miscellaneous industry
What I like the most about TheHive are maintained dockers, scalability, efficiency in CTI checks, ease of use, design, and connectivity to other tools, thanks to the strong contributions from the community.
Julien M.
Cybersecurity analyst, CERT Gemalto
TheHive is designed for different environments and provides a user-friendly application GUI. It is a great product with good support and is easy to implement. Very little training was needed to navigate and use it. The collaboration method and being able to use TheHive in various capacities.
g2.com
Miscellaneous industry
WANT TO KNOW MORE?
Frequently asked questions about TheHive
What is TheHive and who is it built for?
TheHive is a Cybersecurity Incident Response Management (CIRM) platform built for CERTs, CSIRTS, SOC and MSSP teams. It helps them centralize, structure, automate and scale their alert and case management, investigations, response and reporting.
Is TheHive a SOAR platform?
TheHive shares some capabilities with SOAR platforms, notably orchestration and automation, but its approach starts from the investigation and the work of analysts. As a Cybersecurity Incident Response Management (CIRM) platform, it centralizes alerts, their triage, investigations and response actions, while preserving context and a record of decisions. TheHive Flow extends this approach with native automation: teams connect their tools and automate the steps of their procedures directly within their investigations, while keeping control over operations.
What is a Cybersecurity Incident Response Management platform?
A Cybersecurity Incident Response Management platform brings alert triage, case management, investigation, collaboration and response into one system, giving security teams a structured, auditable way to handle incidents from first alert to resolution. Learn more in our dedicated article.
Does TheHive support MSSPs and multi-tenant environments?
Yes. TheHive supports multi-tenancy through separate organizations, so MSSPs and teams managing multiple clients can standardize their operations while keeping each client’s data and access isolated. Learn more about how our platform can help MSSP teams here.
How easy is it to connect TheHive to other security tools?
Very. TheHive plugs into your existing security stack with 300+ out-of-the-box integrations—no heavy engineering required. Documented APIs are also available for custom integrations.
Join 5,000+ users worldwide
Teams across 50+ countries rely on TheHive to centralize,
structure and automate their incident response.
structure and automate their incident response.