--- title: TheHive Reviews meta\_title: 'TheHive Reviews 2026: Details, Pricing, & Features | G2' meta\_description: Filter 18 reviews by the users' company size, role or industry to find out how TheHive works for a business like yours. aggregate\_rating: rating\_value: 4.3 review\_count: 18 scale: '5' date\_modified: '2026-08-07' parent\_category: name: System Security url: https://www.g2.com/categories/system-security --- # TheHive Reviews & Product Details Visit Website TheHive is a collaborative security case management platform designed to help SOC, CERT, CSIRT and MSSP teams manage the full incident response lifecycle. It serves as a central hub where security analysts can receive and triage alerts, conduct investigations, coordinate team actions and close incidents—all without switching tools. The platform integrates natively with other security tools, allowing teams to operate within existing workflows rather than replacing them. TheHive supports multi-tenancy, making it suitable for MSSPs and large organizations that manage security operations across multiple clients, business units or environments. Key capabilities include: - 300+ pre-built integrations: Connect TheHive to your SIEM, EDR, threat intelligence platforms, ticketing systems and other tools to embed it into existing infrastructure. - Alert ingestion and triage: Automatically receive, deduplicate and prioritize alerts from connected sources, with full visibility into alert status and assignment across the team. - Case and task management: Organize investigations using cases and tasks with defined ownership to maintain transparency and accountability. - Multi-tenancy and client isolation: Run separate, isolated workspaces for different clients or internal teams from a single deployment, with granular access controls and role-based permissions. - Automation: Trigger automated investigation or response actions, analyst notifications and third-party integrations, reducing manual effort. - Reporting and compliance: Generate incident reports and maintain full audit trails across investigations. Give external stakeholders controlled access to specific case details. TheHive is developed and maintained by StrangeBee and is trusted by 3,500+ security professionals across 50+ countries. Organizations including BMW, Thales, Pipedrive, Garmin and Cisco use TheHive to centralize and speed up incident response actions, enforce consistent processes across distributed teams, scale security operations and reduce alert fatigue. The platform is available as an on-premises deployment or as a cloud-hosted service, with tiered plans designed to match the operational needs of mid-size to large security teams. It supports air-gapped environments and offers deployment flexibility for organizations with strict data residency or compliance requirements. * * * Product Website TheHive Seller [StrangeBee](https://www.g2.com/sellers/strangebee) Discussions [TheHive Community](https://www.g2.com/products/thehive/discuss) Languages Supported Arabic, German, English, French, Italian, Japanese, Dutch, Polish, Portuguese, Russian, Spanish, Swedish, Chinese (Simplified) Overview by Nabil Adouani (CEO at StrangeBee, Building TheHive) Show More ## Pricing Pricing provided by TheHive. ### Gold (on-prem) Contact Us Per Year [ View More Pricing Information ](https://www.g2.com/products/thehive/pricing) ## TheHive Integrations (13) What do users say about integrations? Verified by TheHive [ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") CrowdStrike Falcon Endpoint Protection Platform ](https://www.g2.com/products/crowdstrike-falcon-endpoint-protection-platform/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Google Threat Intelligence ](https://www.g2.com/products/google-threat-intelligence/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Mattermost ](https://www.g2.com/products/mattermost/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Microsoft Defender for Endpoint ](https://www.g2.com/products/microsoft-defender-for-endpoint/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Microsoft Defender for Office 365 ](https://www.g2.com/products/microsoft-microsoft-defender-for-office-365/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Microsoft Entra ID ](https://www.g2.com/products/microsoft-entra-id/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Microsoft Teams ](https://www.g2.com/products/microsoft-teams/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Proofpoint Adaptive Email Security ](https://www.g2.com/products/proofpoint-adaptive-email-security/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Recorded Future ](https://www.g2.com/products/recorded-future/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Shodan ](https://www.g2.com/products/shodan/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Slack ](https://www.g2.com/products/slack/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Splunk ](https://www.g2.com/products/splunk-2025-01-30/reviews)[ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") VirusTotal ](https://www.g2.com/products/virustotal/reviews) Show More ![Sam F.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Sam F.") SF Sam F. IT Security Officer Enterprise (\> 1000 emp.) 5/29/2024 "Incident Response Platform: TheHive" 5/5 What do you like best about TheHive? The platform plays a critical role in our incident response. It integrates with and automates many of our processes for our analysts, helping to decrease our response times. The platform is easy to set up, maintain, and use. There is also an active Discord community for sharing information and asking questions. Review collected by and hosted on G2.com. What do you dislike about TheHive? None. We've fed back any problems we've had, which've all been taken onboard and resolved. Review collected by and hosted on G2.com. What problems is TheHive solving and how is that benefiting you? The platform helps us automate our incident response processes and stores and correlates much of our data. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerSource: Organic ![Rohan G.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Rohan G.") RG Rohan G. Mid-Market (51-1000 emp.) 6/23/2023 "Opensource Case Management: TheHive" 5/5 What do you like best about TheHive? TheHive is an open source which helps us to create & merge cases in which you are working. You can integrate TheHive with Cortex & Wazuh, which maintains a better security posture. For integration purposes, you need the API key of hive, which help us to integrate it with another software. Also you can create different dashboards to visualise the cases & alerts coming from SIEM tool. Review collected by and hosted on G2.com. What do you dislike about TheHive? TheHive5 is not an opensource it is a paid tool you have to paid to use it. Also there are different opensource tool like IRIS which can be considered as competitor for TheHive. Review collected by and hosted on G2.com. What problems is TheHive solving and how is that benefiting you? TheHive helps us to solve the problem of tracking down the incident and also you can assign the tasks to your teammates & track down the case. Also if your investigation is over, you can close this case with proper justification. You can also integrate tool with different SIEM, Threat Intel tool etc. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerIncentivizedSource: G2 invite SA Satykam A. Red Team Director Mid-Market (51-1000 emp.) 6/3/2022 "Best Open Source Case management" 4.5/5 What do you like best about TheHive? Best part of TheHive is its integration with multiple threat intelligence tools like Cortex and MISP Review collected by and hosted on G2.com. What do you dislike about TheHive? some of the module not working properly, rest all is fine Review collected by and hosted on G2.com. What problems is TheHive solving and how is that benefiting you? Best for SOC team for incident response and case management Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 invite YP Yash P. Senior SOC ANALYST Mid-Market (51-1000 emp.) 12/8/2021 "Thehive Overview" 5/5 What do you like best about TheHive? Easy to use and Configure. Various Integration with various threat intel tools. Review collected by and hosted on G2.com. What do you dislike about TheHive? Sometimes it's the cortex module's analyzers not working properly. Review collected by and hosted on G2.com. What problems is TheHive solving and how is that benefiting you? Using TheHive we get all alerts from our SIEM tool to thehive and easily manage. Immense benefits. Review collected by and hosted on G2.com. Show More Validated ReviewerSource: Organic ![Verified User in Computer & Network Security](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Computer & Network Security") AC Verified User in Computer & Network Security Mid-Market (51-1000 emp.) 12/8/2021 "Case Management" 4/5 What do you like best about TheHive? integration with cortex (threat intelligence) and misp (threat exchange) Review collected by and hosted on G2.com. What do you dislike about TheHive? Looks fine nothing missing into it. Product looks promising Review collected by and hosted on G2.com. What problems is TheHive solving and how is that benefiting you? Incident Response and Incident Handling is performed and managed very nicely. Review collected by and hosted on G2.com. Show More 6/8/2022 Validated ReviewerSource: Organic ![Verified User in Telecommunications](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Telecommunications") IT Verified User in Telecommunications Enterprise (\> 1000 emp.) 10/14/2019 "Excelent tool on Enterprise Level" 5/5 What do you like best about TheHive? The Alert Management and the Openness of TheHive allows it to easily integrate from small to Enterprise large installations. We are able to use it in a very big Environment with extremly complex use-cases and Operation processes and it works really great. It is becoming a new de-facto-Standard for SOAR Tools on enterprise Level. Especially the native Integration of MISP Interface is really helpfull. Addintional the New TheHiveFile-System, Multi-Tenancy, Case-, Alert- and Observable sharing are outstanding features, that makes this product to choince number 1. Review collected by and hosted on G2.com. What do you dislike about TheHive? TheHive is grewing constantly and as there are always new Features you have to ensure that you can install the new updates in time to be able to constatnly increasing productivitiy. Sometimes it takes a little time to get reaction from the support team, especially regarding new feature requests. Review collected by and hosted on G2.com. What problems is TheHive solving and how is that benefiting you? Multi-Tier OC Operations Review collected by and hosted on G2.com. Show More 3/6/2020 Current UserValidated ReviewerSource: Organic ![Julien M.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Julien M.") JM Julien M. Cyber Security Analyst - CERT Gemalto Enterprise (\> 1000 emp.) 9/12/2019 "Thank you for your feedback! If you have any specific text in an unknown language that you need translated, please provide it, and I'll be happy to assist." 5/5 What do you like best about TheHive? Maintained Dockers, scalability, efficiency in CTI checks, easy to use, design, and connectivity to other tools thanks to the strong contributions from the community. Review collected by and hosted on G2.com. What do you dislike about TheHive? Tags or comments are mandatory for observables. Tags for Indicators of Compromise (IOCs) (not event tags) are pushed to MISP during exports, and there should be no rotation of cases (e.g., do not delete closed cases after 2 months). Finally, analyzers and responders must be reviewed to reduce confusion between investigation and response. Review collected by and hosted on G2.com. What problems is TheHive solving and how is that benefiting you? Fastup assessments, CTI investigations, sharing. Review collected by and hosted on G2.com. Show More Validated ReviewerSource: Organic ![Verified User in Civil Engineering](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Civil Engineering") AC Verified User in Civil Engineering Mid-Market (51-1000 emp.) 10/22/2019 "Soar not a soar" 3.5/5 What do you like best about TheHive? I was looking for a SOAR system, TheHive is not a SOAR but can help analysts and SOC specialists on incident response activities Review collected by and hosted on G2.com. What do you dislike about TheHive? Installation is too complicated for a beginner Review collected by and hosted on G2.com. Recommendations to others considering TheHive: Use TheHive if you are skilled with Linux OS and server CLI Review collected by and hosted on G2.com. What problems is TheHive solving and how is that benefiting you? Deploy a new SOAR system Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 invite ![Verified User in Information Services](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Information Services") AI Verified User in Information Services Enterprise (\> 1000 emp.) 5/10/2019 "Hive review " 4.5/5 What do you like best about TheHive? Its easy to use once you get the hang of it.ince can be. Reated quickly and assignment groups are easy to use and configure. Review collected by and hosted on G2.com. What do you dislike about TheHive? It take a little time to learn it,it is missing many options that competitors offer Review collected by and hosted on G2.com. Recommendations to others considering TheHive: Hand held and mac,windows Review collected by and hosted on G2.com. What problems is TheHive solving and how is that benefiting you? Incident response and incident logging,tracking and trend analysis Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 invite ![Eric T.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Eric T.") ET Eric T. Special Forces Officer Military Mid-Market (51-1000 emp.) 1/2/2018 "Works great." 5/5 What do you like best about TheHive? We like the fact the since implementation our downtime is very low. Review collected by and hosted on G2.com. What do you dislike about TheHive? We don’t have anything at this time that we have wanted to address with anyone. Review collected by and hosted on G2.com. What problems is TheHive solving and how is that benefiting you? What problems are we not solving? It’s helped us shape the IT side our what we do for companies. Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 invite ## Questions about TheHive? Ask real users or explore answers from the community Get practical answers, real workflows, and honest pros and cons from the G2 community or share your insights. [ Ask about TheHive ](https://www.g2.com/products/thehive/discussions/new) GU Guest User • Last activity about 2 months ago What is TheHive used for? 0 Upvotes 1 [ Join the conversation ](https://www.g2.com/discussions/what-is-thehive-used-for) [ View all Discussions ](https://www.g2.com/products/thehive/discuss) ## Pricing Options Pricing provided by TheHive. ### Gold (on-prem) Contact Us Per Year ### Platinum (on-prem) Contact Us Per Year ### Cloud Platform Large (SaaS) Contact Us Per Year [ View More Pricing Information ](https://www.g2.com/products/thehive/pricing) TheHive Comparisons ![Product Avatar Image](https://images.g2crowd.com/uploads/product/image/small_square/small_square_1616bb8054a8f27102d8ba094c99bab5/ibm-qradar-soar.png "Product Avatar Image") IBM QRadar SOAR 4/5(29) [ Compare Now ](https://www.g2.com/compare/ibm-qradar-soar-vs-thehive) ![Product Avatar Image](https://images.g2crowd.com/uploads/product/image/small_square/small_square_8b3109519c061f3739371275d691098a/demisto.png "Product Avatar Image") Demisto 4.5/5(15) [ Compare Now ](https://www.g2.com/compare/demisto-vs-thehive) ![Product Avatar Image](https://images.g2crowd.com/uploads/product/image/small_square/small_square_8d31602793a3055a5482a48147140ea9/wazuh.png "Product Avatar Image") Wazuh 4.5/5(70) [ Compare Now ](https://www.g2.com/compare/thehive-vs-wazuh) ##### ##### TheHive Features Response Resolution Automation Resolution Guidance System Isolation Records Incident Logs Incident Reports Management Incident Alerts Incident Case Management [ View More Features ](https://www.g2.com/products/thehive/features) ## Top-Rated Alternatives [ ![IBM QRadar SOAR](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "IBM QRadar SOAR") IBM QRadar SOAR 4/5(29) ](https://www.g2.com/products/ibm-qradar-soar/reviews) [ ![Wazuh](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Wazuh") Wazuh 4.5/5(70) ](https://www.g2.com/products/wazuh/reviews) [ ![LevelBlue USM Anywhere](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "LevelBlue USM Anywhere") LevelBlue USM Anywhere 4.4/5(114) ](https://www.g2.com/products/levelblue-usm-anywhere/reviews) [ View All Alternatives ](https://www.g2.com/products/thehive/competitors/alternatives) ##### Categories on G2 [Incident Response](https://www.g2.com/categories/incident-response) ##### Explore More [Is a dedicated engineering document management system worth it for a small design firm?](https://www.g2.com/discussions/is-a-dedicated-engineering-document-management-system-worth-it-for-a-small-design-firm)[Which records management systems automate document redaction while maintaining complete audit trails?](https://www.g2.com/discussions/which-records-management-systems-automate-document-redaction-while-maintaining-complete-audit-trails)[How does JumpCloud manage a mixed environment of macOS, Windows, Linux, iOS, and Android devices from a single console?](https://www.g2.com/discussions/how-does-jumpcloud-manage-a-mixed-environment-of-macos-windows-linux-ios-and-android-devices-from-a-single-console) [Which CLM platforms are best for mid-market organizations that need real-time visibility into contract status across the team?](https://www.g2.com/discussions/which-clm-platforms-are-best-for-mid-market-organizations-that-need-real-time-visibility-into-contract-status-across-the-team)[Which FSM platforms work well for teams that deal with complex multi-step jobs but do not have dedicated IT staff on hand?](https://www.g2.com/discussions/which-fsm-platforms-work-well-for-teams-that-deal-with-complex-multi-step-jobs-but-do-not-have-dedicated-it-staff-on-hand)[Pros and Cons Details](https://www.g2.com/products/thehive/reviews?qs=pros-and-cons) [Show MoreShow Less](javascript:void(0);)