TheHive review
A security case platform for teams that need alert triage and collaborative investigations.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
TheHive is a security operations and case-management platform for SOC, CSIRT, CERT and MSSP teams. It brings alert collection and triage together with case creation, investigation, evidence attachments, observables and task assignment. Its focus is collaborative security investigations rather than the full range of incident-response operations, making it a fit for teams that need structured casework and threat-intelligence workflows. Teams seeking on-call coordination or status-page functions should consider a different kind of incident management product.
Investigation depth is a central strength. Analysts can enrich and respond to cases through Cortex, work with MISP and MITRE ATT&CK, and use functions and APIs to create custom workflows. Dashboards, KPIs, Markdown or PDF reports, audit logs and activity history support tracking and documentation; knowledge-base pages can capture post-mortems. The integration list also includes LDAP, Active Directory, email systems, Microsoft 365, Google Workspace, Slack, Mattermost and Kafka. That makes TheHive relevant to security teams connecting case workflows with identity, communications and threat-intelligence tools.
The published plans show a self-hosted Community option for 2 users and 1 organization. Gold is self-hosted, paid per user and supports up to 5 Cortex and MISP servers. Platinum can be self-hosted or cloud-hosted, is paid per user, and adds unlimited Cortex and MISP servers, clustering support and a GDPR feature. StrangeBee directs buyers to request a custom quote for Gold and Platinum, and a 14-day free trial is available. Choose TheHive if security case investigation and evidence workflows are the priority; look elsewhere if on-call scheduling, escalation, status pages or mobile capabilities are essential.
TheHive pros and cons
- Where it wins
- Collaborative casework includes task assignment and evidence handling.
- Cortex automation and MISP and MITRE ATT&CK support aid investigations.
- Dashboards, reports, audit logs and post-mortem knowledge pages.
- Where it doesn't
- Community is limited to 2 users and 1 organization.
- Gold and Platinum require a custom quote.
- No verified on-call, escalation, status-page or mobile capabilities.
TheHive fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update