--- title: TheHive Reviews meta_title: 'TheHive Reviews 2026: Details, Pricing, & Features | G2' meta_description: Filter 18 reviews by the users' company size, role or industry to find out how TheHive works for a business like yours. aggregate_rating: rating_value: 4.3 review_count: 18 scale: '5' date_modified: '2026-11-12' parent_category: name: System Security url: https://www.g2.com/categories/system-security ---

TheHive Pros and Cons: Top Advantages and Disadvantages

Quick AI Summary Based on G2 Reviews

Generated from real user reviews

Users value the customizable workflows of TheHive, enhancing efficiency in incident management for teams. (1 mentions)
Users find TheHive's ease of use and scalability ideal for efficiently managing incident response in SOCs and CSIRTs. (1 mentions)
Users value the good integrations and customizable workflows of TheHive, enhancing collaborative incident management for SOCs and CSIRTs. (1 mentions)
Users appreciate the excellent integrations of TheHive, enhancing collaboration and efficiency in incident management. (1 mentions)
Users appreciate the customizable workflows and integrations of TheHive, enhancing collective incident management for SOCs and CSIRTs. (1 mentions)
Users find the complex setup of TheHive daunting, often requiring community support for troubleshooting delays. (1 mentions)
Users feel the lack of guidance in TheHive makes it challenging for new users to navigate and troubleshoot effectively. (1 mentions)
New users find the steep learning curve of TheHive challenging, often requiring substantial community assistance for setup. (1 mentions)

Top Pros or Advantages of TheHive

Top Cons or Disadvantages of TheHive

TheHive Reviews (18)

Reviews

TheHive Reviews (18)

4.3
18 reviews
Search reviews
Filter Reviews
Clear Results
G2 reviews are authentic and verified.
Sam F.
SF
Sam F.
IT Security Officer
Enterprise (> 1000 emp.)
"Incident Response Platform: TheHive"
5/5
What do you like best about TheHive?

The platform plays a critical role in our incident response. It integrates with and automates many of our processes for our analysts, helping to decrease our response times.

The platform is easy to set up, maintain, and use. There is also an active Discord community for sharing information and asking questions. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

None. We've fed back any problems we've had, which've all been taken onboard and resolved. Review collected by and hosted on G2.com.

Rohan G.
RG
Rohan G.
CyberSecurity Analyst
Mid-Market (51-1000 emp.)
"Opensource Case Management: TheHive"
5/5
What do you like best about TheHive?

TheHive is an open source which helps us to create & merge cases in which you are working.

You can integrate TheHive with Cortex & Wazuh, which maintains a better security posture.

For integration purposes, you need the API key of hive, which help us to integrate it with another software.

Also you can create different dashboards to visualise the cases & alerts coming from SIEM tool. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

TheHive5 is not an opensource it is a paid tool you have to paid to use it.

Also there are different opensource tool like IRIS which can be considered as competitor for TheHive. Review collected by and hosted on G2.com.

SA
Satykam A.
Red Team Director
Mid-Market (51-1000 emp.)
"Best Open Source Case management"
4.5/5
What do you like best about TheHive?

Best part of TheHive is its integration with multiple threat intelligence tools like Cortex and MISP Review collected by and hosted on G2.com.

What do you dislike about TheHive?

some of the module not working properly, rest all is fine Review collected by and hosted on G2.com.

YP
Yash P.
Senior SOC ANALYST
Mid-Market (51-1000 emp.)
"Thehive Overview"
5/5
What do you like best about TheHive?

Easy to use and Configure. Various Integration with various threat intel tools. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

Sometimes it's the cortex module's analyzers not working properly. Review collected by and hosted on G2.com.

Verified User in Computer & Network Security
AC
Verified User in Computer & Network Security
Mid-Market (51-1000 emp.)
Originally submitted 12/8/2021
"Case Management"
4/5
What do you like best about TheHive?

integration with cortex (threat intelligence) and misp (threat exchange) Review collected by and hosted on G2.com.

What do you dislike about TheHive?

Looks fine nothing missing into it. Product looks promising Review collected by and hosted on G2.com.

Verified User in Telecommunications
IT
Verified User in Telecommunications
Enterprise (> 1000 emp.)
Originally submitted 10/14/2019
"Excelent tool on Enterprise Level"
5/5
What do you like best about TheHive?

The Alert Management and the Openness of TheHive allows it to easily integrate from small to Enterprise large installations. We are able to use it in a very big Environment with extremly complex use-cases and Operation processes and it works really great. It is becoming a new de-facto-Standard for SOAR Tools on enterprise Level. Especially the native Integration of MISP Interface is really helpfull. Addintional the New TheHiveFile-System, Multi-Tenancy, Case-, Alert- and Observable sharing are outstanding features, that makes this product to choince number 1. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

TheHive is grewing constantly and as there are always new Features you have to ensure that you can install the new updates in time to be able to constatnly increasing productivitiy. Sometimes it takes a little time to get reaction from the support team, especially regarding new feature requests. Review collected by and hosted on G2.com.

Julien M.
JM
Julien M.
Cyber Security Analyst - CERT Gemalto
Enterprise (> 1000 emp.)
"Thank you for your feedback! If you have any specific text in an unknown language that you need translated, please provide it, and I'll be happy to assist."
5/5
What do you like best about TheHive?

Maintained Dockers, scalability, efficiency in CTI checks, easy to use, design, and connectivity to other tools thanks to the strong contributions from the community. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

Tags or comments are mandatory for observables. Tags for Indicators of Compromise (IOCs) (not event tags) are pushed to MISP during exports, and there should be no rotation of cases (e.g., do not delete closed cases after 2 months). Finally, analyzers and responders must be reviewed to reduce confusion between investigation and response. Review collected by and hosted on G2.com.

Verified User in Civil Engineering
AC
Verified User in Civil Engineering
Mid-Market (51-1000 emp.)
"Soar not a soar"
3.5/5
What do you like best about TheHive?

I was looking for a SOAR system, TheHive is not a SOAR but can help analysts and SOC specialists on incident response activities Review collected by and hosted on G2.com.

What do you dislike about TheHive?

Installation is too complicated for a beginner Review collected by and hosted on G2.com.

Verified User in Information Services
AI
Verified User in Information Services
Enterprise (> 1000 emp.)
"Hive review"
4.5/5
What do you like best about TheHive?

It's easy to use once you get the hang of it. It can be created quickly and assignment groups are easy to use and configure. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

It takes a little time to learn it, it is missing many options that competitors offer. Review collected by and hosted on G2.com.

Eric T.
ET
Eric T.
Special Forces Officer
Military
Mid-Market (51-1000 emp.)
"Works great."
5/5
What do you like best about TheHive?

We like the fact the since implementation our downtime is very low. Review collected by and hosted on G2.com.

What do you dislike about TheHive?

We don’t have anything at this time that we have wanted to address with anyone. Review collected by and hosted on G2.com.