MISP Integration
Imports MISP events as alerts and exports case observables marked as IOCs to MISP. Connecting multiple MISP servers requires a paid TheHive license.
Response coordination EU-developed
TheHive
Incident response platform for triaging alerts, opening cases, coordinating investigation tasks, and analyzing observables through connected Cortex services.
By StrangeBee · France
EU-developed
The record identifies an EU developer or development origin. The origin note explains the evidence; current ownership and hosting are recorded separately where established.
At a glance
Recorded facts- Response workflow
- Response coordination
- Developer or maintainer
- StrangeBee
- Recorded country
- France
- Product model
- Commercial
- Deployment
- Self-hosted / SaaS
- Software license
- Proprietary
- Upstream status
- Active
- Evidence class
- EU-developed
What the sources establish
Origin noteBegan in an unnamed European financial institution CSIRT; current developer and licensor is French company StrangeBee. The original CSIRT country was not established.
Reported capabilities
- Turns alerts into cases and tracks investigation work.
- Community license is free for on-prem use but requires activation; cloud is a paid Platinum option.
- TheHive 5 Community license restricts modification and redistribution.
Scope and limits
Current TheHive 5 is proprietary despite older TheHive 4 AGPL releases. Cloud placement is not guaranteed in France; a trial becomes read-only without an activated license.
Inspect the research evidence 6 source observations
identity / capabilities
TheHive documentation covers alert triage and conversion to cases, supporting its incident-response workflow classification.
Read sourcelicense / deployment
Current documentation says Community is free but activated and on-prem only; Gold is paid on-prem; Platinum is paid on-prem or cloud; expired trial becomes read-only.
Read sourcelicense
TheHive 5 Community terms forbid modification, reverse engineering and redistribution, so free Community use is not open source.
Read sourceorigin
StrangeBee's history describes TheHive's inception in a European financial institution's CSIRT and its subsequent development by StrangeBee.
Read sourcecountry
StrangeBee's own SaaS agreement identifies the company as a French SAS based in Paris.
Read sourcemaintenance
The current release policy lists maintained TheHive 5 versions and 2026 release activity.
Read source
This profile summarizes source material. It does not include hands-on security testing, procurement review, or an assessment of fit for your environment.
Capabilities & integrations
Tags record specific documented functions. They do not establish end-to-end interoperability; check the component, edition and version in the source.
Cortex Integration
Connects to a separately installed Cortex server for analyzers and responders. Multiple Cortex servers require a paid license; TheHive 5.5 drops support for Cortex 3.1.5 and earlier.
Splunk Integration
A separately installed Splunk add-on turns saved-search results into TheHive alerts, with explicit field mapping and an alert action.
Put the tool in context.
Move from alert triage to assigned tasks, evidence, shift handoff and closure. A practical case management guide with TheHive and DFIR-IRIS references.
An incident response case management workflow