TheHive
TheHive: A security case platform for teams that need alert triage and collaborative investigations. Ranked #12 of 28 in Incident Management Software by our editors (7.9/10); pricing: Free plan · 14-day trial; best for security operations investigation teams.
At a glance
- Editor score7.9 / 10
- PricingFree plan · 14-day trial
- Best forSecurity operations investigation teams
- Free planYes
- Founded2018 · Paris, France
- Facts checked19 Sep 2026
Where it wins
- Collaborative casework includes task assignment and evidence handling.
- Cortex automation and MISP and MITRE ATT&CK support aid investigations.
- Dashboards, reports, audit logs and post-mortem knowledge pages.
Where it doesn't
- Community is limited to 2 users and 1 organization.
- Gold and Platinum require a custom quote.
- No verified on-call, escalation, status-page or mobile capabilities.
Our verdict on TheHive
TheHive is a security operations and case-management platform for SOC, CSIRT, CERT and MSSP teams. It brings alert collection and triage together with case creation, investigation, evidence attachments, observables and task assignment. Its focus is collaborative security investigations rather than the full range of incident-response operations, making it a fit for teams that need structured casework and threat-intelligence workflows. Teams seeking on-call coordination or status-page functions should consider a different kind of incident management product.
Investigation depth is a central strength. Analysts can enrich and respond to cases through Cortex, work with MISP and MITRE ATT&CK, and use functions and APIs to create custom workflows. Dashboards, KPIs, Markdown or PDF reports, audit logs and activity history support tracking and documentation; knowledge-base pages can capture post-mortems. The integration list also includes LDAP, Active Directory, email systems, Microsoft 365, Google Workspace, Slack, Mattermost and Kafka. That makes TheHive relevant to security teams connecting case workflows with identity, communications and threat-intelligence tools.
The published plans show a self-hosted Community option for 2 users and 1 organization. Gold is self-hosted, paid per user and supports up to 5 Cortex and MISP servers. Platinum can be self-hosted or cloud-hosted, is paid per user, and adds unlimited Cortex and MISP servers, clustering support and a GDPR feature. StrangeBee directs buyers to request a custom quote for Gold and Platinum, and a 14-day free trial is available. Choose TheHive if security case investigation and evidence workflows are the priority; look elsewhere if on-call scheduling, escalation, status pages or mobile capabilities are essential.
Your product? Our editors can test TheHive in depth and publish a review, labelled as paid · from $149/mo →
TheHive pricing
All 3 TheHive plans and prices →
TheHive fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Not verified |
| Escalation policies | Not verified |
| Post-incident reviews | Yes |
| Status pages | Not verified |
| Mobile apps | Not verified |
| Audit logs | Yes |
| Incident retention | Not verified |
| Free trial | 14 days |
| Deployment | Cloud, Desktop, Self-hosted |
| Platforms | Web, Linux |
| Integrations | 11 integrations: Cortex, MISP, MITRE ATT&CK, LDAP, Active Directory, IMAP … |
| Pricing | Free plan · 14-day trial (source) |
| Website | strangebee.com |
| Facts checked | 19 Sep 2026 |
TheHive integrations
TheHive lists 11 integrations on its own site.
- Cortex
- MISP
- MITRE ATT&CK
- LDAP
- Active Directory
- IMAP
- Microsoft 365
- Google Workspace
- Slack
- Mattermost
- Kafka
Alternatives to TheHive
- AlertOpsBroad incident response coverage with a free plan and paid tiers from $10 per user monthly.9.4
- PagerDutyPagerDuty routes incidents to on-call responders and coordinates response across teams.9.3
- incident.ioA chat-native incident platform with on-call, workflows, status pages, and postmortems.9.1
See all TheHive alternatives →
Also Ranked In
TheHive is ranked in 2 of our directories.
Used TheHive? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used TheHive for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
TheHive is listed in our Incident Management Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/thehive/"><img src="https://www.itechguides.com/best/badge/thehive.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update