Sold by: StrangeBee
TheHive is the Cybersecurity Incident Response Management (CIRM) platform from StrangeBee. Over 5,000 SOC, CERT, CSIRT and MSSP analysts in 50+ countries rely on it to investigate and respond to threats. It connects alerts, cases, automated workflows and analyst decisions in one auditable workspace, available as SaaS, IaaS or fully on-premises.
4.3
Overview
Cybersecurity teams today are under constant pressure: threats evolve, alerts keep coming, investigations pile up, and coordination between analysts isn't always clear. TheHive is built to change that.
TheHive is a dedicated Cybersecurity Incident Response Management (CIRM) platform designed for SOCs, CSIRTs, CERTs and MSSPs. It is a single pane of glass that helps analysts reduce alert fatigue, spend less time switching between tools and resolve incidents faster together, in a structured way and with full traceability.
-
Centralize alerts from multiple sources into a single view for faster triage and consistent management
-
Manage cases end-to-end: create and assign tasks, collect evidence and track incident timelines
-
Support multiple organizations with multi-tenancy and precise access control via customizable roles and LDAP/AD synchronization
-
Keep teams informed automatically via webhooks, email, Slack, Mattermost or custom HTTP requests
-
Track performance with dynamic dashboards and actionable KPIs; create detailed incident reports using customizable templates
-
Connect with over 300 security tools: SIEMs, EDRs, threat intelligence platforms, ticketing systems and more
-
Share threat intelligence natively with MISP and map techniques to MITRE ATT&CK for more context
-
Trigger automated investigation or response actions (Cortex, native engine for TheHive) or chain them with other actions via building workflows (TheHive Flow, native automation and orchestration layer, offered in the TheHive ONE plan)
-
Deploy the way you need: on-premises, SaaS on AWS or IaaS images on AWS and Azure
-
Available in multiple languages to support distributed, global teams
Whether you're running a lean in-house SOC or managing security operations across multiple clients, TheHive adapts to your scale. Its flexible architecture, broad integration ecosystem and straightforward interface mean teams get up to speed quickly and stay effective under pressure. Audit-ready case records support compliance requirements out of the box, and when you need help, a strong user community and responsive support team have you covered.
Highlights
- Centralized, case-centric incident response management, automation and orchestration to respond to incidents faster and more efficiently
- Over 300 integrations with SIEMs, EDRs, threat intelligence platforms and ticketing systems fit into the workflows your team already relies on
- Flexible deployment (on-premises, SaaS or IaaS) gives you the freedom to choose what fits your organization's operational needs and growth trajectory
Details
Sold by
Categories
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
TheHive Gold | Gold license, with standard use included (on-premises) - based on number of users and organizations. | $26,724.00 |
TheHive Platinum | Platinum license, with standard use included (on-premises) - based on number of users and organizations. | $34,978.00 |
TheHive Cloud Platform Large | Large license, with standard use included (SaaS) - based on number of users and organizations. | $57,658.00 |
TheHive ONE | Platinum license, with standard use included (on-premises), plus TheHive Flow (native automation and orchestration capabilities) - based on number of users and organization - based on number of users and organizations. | $82,979.00 |
TheHive Cloud Images | Platinum license, with standard use included (IaaS) - based on number of users and organizations. | $34,978.00 |
Dimensions summary
All five options bill as yearly contracts priced by the number of users and organizations you need. They differ mainly by capability level and deployment method. TheHive Gold and TheHive Platinum run on-premises, with Platinum covering more features than Gold. TheHive ONE adds native automation and orchestration to the Platinum feature set, also on-premises. TheHive Cloud Platform Large delivers the platform as a managed SaaS instance. TheHive Cloud Images provide the platform as deployable images you run in your own infrastructure (IaaS). You scale by adding users or organizations within your chosen tier.
Top-of-mind questions for buyers
A user is any person who needs access to the interface; a team of ten needs ten user licenses. Read-only and unlicensed profiles are free. An organization is a dedicated workspace that isolates one team's alerts, cases, users, and settings from others.
Cloud Platform Large is a managed SaaS instance, where StrangeBee runs deployment, updates, backups, and maintenance in a dedicated AWS environment. Cloud Images are pre-built images you deploy and operate yourself in your own infrastructure, handling updates and maintenance on your side.
Yes. You can buy licenses for more users and organizations, or move to a different deployment type, during an ongoing subscription while keeping all your data and configuration. Downgrades are not allowed mid-term but can be applied at renewal. All plans bill yearly.
strangebee.com+1
Helpful?
Vendor refund policy
Please contact us at support@strangebee.com .
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
For support with TheHive Collaborative Security Platform, please contact us at support@strangebee.com or visit https://strangebee.com/contact-us/ .
Support is available during business hours.
Buyers can expect help via email or through our website for general inquiries, troubleshooting and product guidance.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
IONSEC Cyber Security is a distinguished group of cybersecurity professionals specializing in combating sophisticated threat actors and delivering customized security solutions to global enterprises.
This is a repackaged open source software product wherein additional charges apply for a pre-hardened AMI with automated startup. Docker-based security incident response platform with REST API and RBAC
The AI-native CrowdStrike Falcon Platform provides comprehensive protection across all areas of enterprise risk - devices, identities, data, endpoints and cloud. Powered by a single agent, crowdsourced data, expert threat intelligence, and advanced AI, the Falcon Platform simplifies security operations and stops breaches.
Best in class solution to protect your cloud workloads and gain the complete visibility across your cloud infrastructure.
Customer reviews
Sam F.
Incident Response Platform: TheHive
Reviewed on May 29, 2024
Review provided by G2
What do you like best about the product?
The platform plays a critical role in our incident response. It integrates with and automates many of our processes for our analysts, helping to decrease our response times.
The platform is easy to set up, maintain, and use. There is also an active Discord community for sharing information and asking questions.
The platform is easy to set up, maintain, and use. There is also an active Discord community for sharing information and asking questions.
What do you dislike about the product?
None. We've fed back any problems we've had, which've all been taken onboard and resolved.
What problems is the product solving and how is that benefiting you?
The platform helps us automate our incident response processes and stores and correlates much of our data.
Rohan G.
Opensource Case Management: TheHive
Reviewed on Jun 23, 2023
Review provided by G2
What do you like best about the product?
TheHive is an open source which helps us to create & merge cases in which you are working.
You can integrate TheHive with Cortex & Wazuh, which maintains a better security posture.
For integration purposes, you need the API key of hive, which help us to integrate it with another software.
Also you can create different dashboards to visualise the cases & alerts coming from SIEM tool.
You can integrate TheHive with Cortex & Wazuh, which maintains a better security posture.
For integration purposes, you need the API key of hive, which help us to integrate it with another software.
Also you can create different dashboards to visualise the cases & alerts coming from SIEM tool.
What do you dislike about the product?
TheHive5 is not an opensource it is a paid tool you have to paid to use it.
Also there are different opensource tool like IRIS which can be considered as competitor for TheHive.
Also there are different opensource tool like IRIS which can be considered as competitor for TheHive.
What problems is the product solving and how is that benefiting you?
TheHive helps us to solve the problem of tracking down the incident and also you can assign the tasks to your teammates & track down the case.
Also if your investigation is over, you can close this case with proper justification.
You can also integrate tool with different SIEM, Threat Intel tool etc.
Also if your investigation is over, you can close this case with proper justification.
You can also integrate tool with different SIEM, Threat Intel tool etc.
Satykam A.
Best Open Source Case management
Reviewed on Jun 03, 2022
Review provided by G2
What do you like best about the product?
Best part of TheHive is its integration with multiple threat intelligence tools like Cortex and MISP
What do you dislike about the product?
some of the module not working properly, rest all is fine
What problems is the product solving and how is that benefiting you?
Best for SOC team for incident response and case management
Yash P.
Thehive Overview
Reviewed on Dec 08, 2021
Review provided by G2
What do you like best about the product?
Easy to use and Configure. Various Integration with various threat intel tools.
What do you dislike about the product?
Sometimes it's the cortex module's analyzers not working properly.
What problems is the product solving and how is that benefiting you?
Using TheHive we get all alerts from our SIEM tool to thehive and easily manage. Immense benefits.
Computer & Network Security
Case Management
Reviewed on Dec 08, 2021
Review provided by G2
What do you like best about the product?
integration with cortex (threat intelligence) and misp (threat exchange)
What do you dislike about the product?
Looks fine nothing missing into it. Product looks promising
What problems is the product solving and how is that benefiting you?
Incident Response and Incident Handling is performed and managed very nicely.