TheHive Reviews & Product Details

TheHive is a Cybersecurity Incident Response Management (CIRM) platform designed to help SOC, CERT, CSIRT and MSSP teams manage the full incident response lifecycle. It serves as a central hub where security analysts can receive and triage alerts, investigate, collaborate, automate actions and close incidents—all without switching tools. The platform integrates natively with other security tools, allowing teams to operate within existing workflows rather than replacing them. TheHive supports multi-tenancy, making it suitable for MSSPs and large organizations that manage security operations across multiple clients, business units or environments. Key capabilities include: - 300+ pre-built integrations: Connect TheHive to your SIEM, EDR, threat intelligence platforms, ticketing systems and other tools to embed it into existing infrastructure. - Alert ingestion and triage: Automatically receive, deduplicate and prioritize alerts from connected sources, with full visibility into alert status and assignment across the team. - Case and task management: Organize investigations using cases and tasks with defined ownership to maintain transparency and accountability. - Multi-tenancy and client isolation: Run separate, isolated workspaces for different clients or internal teams from a single deployment, with granular access controls and role-based permissions. - Automation: Trigger automated investigation or response actions (Cortex, native engine for TheHive) or chain them with other actions via building workflows (TheHive Flow, native automation and orchestration layer, offered in the TheHive ONE plan). - Reporting and compliance: Generate incident reports and maintain full audit trails across investigations. Give external stakeholders controlled access to specific case details. TheHive is developed and maintained by StrangeBee and is trusted by 5,000+ security professionals across 50+ countries. Organizations including BMW, Thales, Pipedrive, Garmin and Cisco use TheHive to centralize and speed up incident response actions, enforce consistent processes across distributed teams, scale security operations and reduce alert fatigue. The platform is available as an on-premises deployment, as IaaS or as a cloud-hosted SaaS, with tiered plans designed to match the operational needs of mid-size to large security teams. It supports air-gapped environments and offers deployment flexibility for organizations with strict data residency or compliance requirements.

Seller

StrangeBee

Discussions

TheHive Community

Languages Supported

English, French

Overview by

Nabil Adouani (CEO at StrangeBee, Building TheHive)

Used by Pipedrive and 3 others

Beta

Pricing

Pricing provided by TheHive.

TheHive Gold (on-prem)

Contact for pricing

Per Year

View More Pricing Information

TheHive Integrations

(70)

Verified by TheHive

Show More Integrations

TheHive Reviews FAQs

Generated using AI

Last updated: Nov 04, 2026

What is TheHive, and what problem is it built to solve?

TheHive is a security incident response and case management platform built to help SOC, CERT, CSIRT, and MSSP teams manage and automate response work. It helps teams centralize and scale security operations across multiple teams, environments, or clients.

What languages does TheHive support?

TheHive supports 13 languages, including Arabic, Chinese (Simplified), Dutch, English, French, and others.

What company sizes and industries is TheHive the best fit for?

The strongest fit signal is for enterprise and mid-market organizations. Industry experience spans security and IT as well as sectors such as telecommunications and financial services.

Enterprise: the most represented company-size segment.
Mid-market: also well represented.

What customer support options does TheHive provide, and how do users find the overall support experience?

TheHive’s support experience includes positive feedback about reported problems being addressed, alongside some frustration with slower responses on feature requests. An active Discord community is also mentioned as a place to share information and ask questions.

G2 reviews are authentic and verified.

Here's how.

Sam F.

IT Security Officer

Enterprise (> 1000 emp.)

5/29/2024

"Incident Response Platform: TheHive"

5/5

What do you like best about TheHive?

The platform plays a critical role in our incident response. It integrates with and automates many of our processes for our analysts, helping to decrease our response times.

The platform is easy to set up, maintain, and use. There is also an active Discord community for sharing information and asking questions. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

None. We've fed back any problems we've had, which've all been taken onboard and resolved. Review collected by and hosted on G2.com.

Rohan G.

CyberSecurity Analyst

Mid-Market (51-1000 emp.)

6/23/2023

"Opensource Case Management: TheHive"

5/5

What do you like best about TheHive?

TheHive is an open source which helps us to create & merge cases in which you are working.

You can integrate TheHive with Cortex & Wazuh, which maintains a better security posture.

For integration purposes, you need the API key of hive, which help us to integrate it with another software.

Also you can create different dashboards to visualise the cases & alerts coming from SIEM tool. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

TheHive5 is not an opensource it is a paid tool you have to paid to use it.

Also there are different opensource tool like IRIS which can be considered as competitor for TheHive. Review collected by and hosted on G2.com.

What problems is TheHive solving and how is that benefiting you?

TheHive helps us to solve the problem of tracking down the incident and also you can assign the tasks to your teammates & track down the case.

Also if your investigation is over, you can close this case with proper justification.

You can also integrate tool with different SIEM, Threat Intel tool etc. Review collected by and hosted on G2.com.

Satykam A.

Red Team Director

Mid-Market (51-1000 emp.)

6/3/2022

"Best Open Source Case management"

4.5/5

What do you like best about TheHive?

Best part of TheHive is its integration with multiple threat intelligence tools like Cortex and MISP Review collected by and hosted on G2.com.

What do you dislike about TheHive?

some of the module not working properly, rest all is fine Review collected by and hosted on G2.com.

Yash P.

Senior SOC ANALYST

Mid-Market (51-1000 emp.)

12/8/2021

"Thehive Overview"

5/5

What do you like best about TheHive?

Easy to use and Configure. Various Integration with various threat intel tools. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

Sometimes it's the cortex module's analyzers not working properly. Review collected by and hosted on G2.com.

Verified User in Computer & Network Security

Mid-Market (51-1000 emp.)

Originally submitted 12/8/2021

"Case Management"

4/5

What do you like best about TheHive?

integration with cortex (threat intelligence) and misp (threat exchange) Review collected by and hosted on G2.com.

What do you dislike about TheHive?

Looks fine nothing missing into it. Product looks promising Review collected by and hosted on G2.com.

Verified User in Telecommunications

Enterprise (> 1000 emp.)

Originally submitted 10/14/2019

"Excelent tool on Enterprise Level"

5/5

What do you like best about TheHive?

The Alert Management and the Openness of TheHive allows it to easily integrate from small to Enterprise large installations. We are able to use it in a very big Environment with extremly complex use-cases and Operation processes and it works really great. It is becoming a new de-facto-Standard for SOAR Tools on enterprise Level. Especially the native Integration of MISP Interface is really helpfull. Addintional the New TheHiveFile-System, Multi-Tenancy, Case-, Alert- and Observable sharing are outstanding features, that makes this product to choince number 1. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

TheHive is grewing constantly and as there are always new Features you have to ensure that you can install the new updates in time to be able to constatnly increasing productivitiy. Sometimes it takes a little time to get reaction from the support team, especially regarding new feature requests. Review collected by and hosted on G2.com.

Julien M.

Cyber Security Analyst - CERT Gemalto

Enterprise (> 1000 emp.)

9/12/2019

"Thank you for your feedback! If you have any specific text in an unknown language that you need translated, please provide it, and I'll be happy to assist."

5/5

What do you like best about TheHive?

Maintained Dockers, scalability, efficiency in CTI checks, easy to use, design, and connectivity to other tools thanks to the strong contributions from the community. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

Tags or comments are mandatory for observables. Tags for Indicators of Compromise (IOCs) (not event tags) are pushed to MISP during exports, and there should be no rotation of cases (e.g., do not delete closed cases after 2 months). Finally, analyzers and responders must be reviewed to reduce confusion between investigation and response. Review collected by and hosted on G2.com.

Verified User in Civil Engineering

Mid-Market (51-1000 emp.)

10/22/2019

"Soar not a soar"

3.5/5

What do you like best about TheHive?

I was looking for a SOAR system, TheHive is not a SOAR but can help analysts and SOC specialists on incident response activities Review collected by and hosted on G2.com.

What do you dislike about TheHive?

Installation is too complicated for a beginner Review collected by and hosted on G2.com.

Verified User in Information Services

Enterprise (> 1000 emp.)

5/10/2019

"Hive review"

4.5/5

What do you like best about TheHive?

It's easy to use once you get the hang of it. It can be created quickly and assignment groups are easy to use and configure. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

It takes a little time to learn it, it is missing many options that competitors offer. Review collected by and hosted on G2.com.