Overview

TheHive is a purpose-built security operations platform designed for SOC, CSIRT, CERT, and MSSP teams. Developed by StrangeBee, it covers the full incident lifecycle — from alert triage and case management to investigation, response, and reporting. It integrates seamlessly with Cortex for automated response actions and MISP for threat intelligence sharing.

Key Features

• Collaborative Case Management: Enables security teams to work together on incidents with shared case files and real-time updates
• Alert Triage: Ingests and prioritizes alerts from multiple sources for efficient handling
• Observable Analysis: Analyzes IPs, domains, hashes, and other observables within cases
• Cortex Integration: Automates response actions with Cortex, TheHive’s analysis and automation engine
• MISP Integration: Seamlessly shares and correlates threat intelligence with MISP
• Custom Dashboards: Provides customizable dashboards for monitoring SOC performance and metrics
• Multi-Tenancy: Supports multiple organizations within a single instance

Official Resources

• Website: https://strangebee.com/thehive/
• Documentation: StrangeBee Documentation
• Source Code: GitHub – TheHive-Project/TheHive