TheHive Reviews

I use TheHive as an end user, implementation engineer, and administrator. My main use cases include ingesting alerts from SIEM systems such as Wazuh or Splunk and acting on them as they come in to investigate them. I also use Cortex, which is a Strange Bee product integrated with TheHive, to help with getting intelligence from multiple sources such as multiple vendors including VirusTotal and AbuseIPDB.

TheHive's case management features have significantly improved my incident response workflow and boosted my productivity.

TheHive's main functionality centers on case management and incident tracking, which are on par with the best tools available. The platform is easy to use and intuitive, providing a single pane window to see what is happening in any case or alert. Tasks can be assigned to any alert according to the playbook, and both the playbook and tasks are very customizable, which are some very good standout features.

TheHive's alert aggregation system is impressive as it aggregates alerts from almost everywhere and parses them very nicely. This is one of the main reasons I love TheHive's case management, as it makes it easy for any end user or analyst to work on the alerts and gather information, providing very deep insight into what the problem is.

TheHive's case management features have had a pretty good impact on my incident response workflow. It has boosted my productivity. Although I have not used any other case management systems professionally, having used some open-source ones, TheHive being properly optimized has made my incident response workflow way easier, better, and more automated. I can even close alerts automatically using a SOAR platform in between and then take action based on user confirmation, closing the alerts and organizing them very effectively. This has had a pretty positive impact on my incident response workflow.

I integrate TheHive with other security tools. TheHive was integrated with my SIEM or Security Event and Information Management system, which is where all the logs come in. TheHive was integrated with Wazuh SIEM and even Splunk, which was pretty easy and did not require much technical effort. Integration always requires some technical effort, but this was pretty straightforward compared to other tools.

TheHive's reporting and analytics features are also good. I have not used their cloud platform much, so I cannot comment on how the newer reporting method is, but the last version of TheHive I used with the older dashboard was pretty intuitive. There was some room for improvement which I believe they have already overcome with the latest versions and continuous development of TheHive. The dashboard was a pretty rocky but good experience for me.

TheHive is actually quite beautiful and very optimized. If I had to improve anything, I would say that it could improve costing. TheHive is pretty expensive right now. With a low number of users, it works for how the business runs, but I feel that it is pretty expensive when you want to go for the commercial versions, which is where people might not want to go with it.

Cost is the only downside, but it is the major downside. I would like to share an incident with you about a recent meeting I had with a client regarding TheHive. The only trigger that they had not to go with TheHive was the cost. Everything looked very good and was very fine, but the costing part was hard. The costing part was something that made them hold off on TheHive and choose a different solution.

Over the years, TheHive has improved significantly in how the platform is used and how cases are managed. One good feature that I appreciated when I moved from TheHive 4 to TheHive 5 was the dark mode. When Strange Bee did the rebranding and made it a closed-source product, they added the dark mode feature, which I need because I am not good with light screens. TheHive was the only tool having only white mode capabilities. Once they added it, they have improved a lot. Many connectors are added, and many more integrations are possible now with TheHive. Basically, the appearance, performance, and integrations have improved a lot over the years.

I have been using the solution for approximately three and a half to four years and I am continuously using it.

I would rate the stability level of TheHive at a seven out of ten. I have faced multiple stability issues at points where the database goes down or enters a race condition, requiring a restart of the service to make the platform usable again. I believe that all these issues are already taken care of and solved in the cloud version. Basically, when you deploy it, if you have optimized it well based on your organization's data flow, it is a very reliable tool. If you miss the optimization, there might be a few hiccups.

I would say TheHive is scalable at an eight out of ten. It is pretty scalable, but it requires a good technical hand to manage it. Someone who is always working with servers and environments might get it done easily, but a security admin might face some issues at first. Once you get the hang of it, it gets much easier.

There was one more tool that I used alongside TheHive. I started with TheHive at the beginning of my career, but once it went to the paid version, I moved to another tool which was DFIR-IRIS. DFIR-IRIS is a totally open-source tool which helps a lot and is similar to TheHive. However, having used TheHive since the start, I find it a lot easier and better than DFIR-IRIS in every way possible, whether it is performance, appearance, or analysis.

That was very easy. I deployed TheHive on-premises with just two or three commands and then everything was up and running. It was pretty easy and straightforward.

I had two vendors or two tools to evaluate: TheHive and DFIR-IRIS. I would choose TheHive any day, but the point is that it is expensive, and that is where everything revolves around the cost. If the cost was a bit less or if it was more accessible, there might be a high chance that everyone would go with TheHive rather than any other tool. The people at TheHive have made it very customizable, flexible, and very security-centric. They understand what a particular incident responder or security team needs and provide it quite well. This is the only reason that everyone will choose TheHive if the pricing were a bit less or if the free tier had some more users, as a two-user team is not ideal for many people.

My main use case for TheHive is incident response and tickets register for DLP.

A quick specific example of how I use TheHive for incident response or ticket registration is that we have many tools connected to TheHive like EDR, antivirus, and DLP, and we receive many tickets there, registering and using it to investigate, create some runbooks, and investigate some cases there.

The best features TheHive offers are that it is easy to use, and we used an open-source version that was free, so we could extract good value from the solution, even though we had some problems regarding performance.

The ease of use for my team with TheHive comes from the interface, the integrations, documentation, and everything being easy to use and to improve the solution. We actually use it as a SOAR solution with many tools integrated, such as VirusTotal, a MIP, and other solutions for incident response.

TheHive has positively impacted my organization because before that, we did not have a good solution to register the tickets. When we started the CSIRT department and began using it, it was really good to have measures to understand how many alerts we were getting at that point and to start improving our runbooks to be more assertive and remove false positives.

After implementing TheHive, we saw both a big reduction in false positives and the runbooks that we constructed helped the team to be more assertive and leveled.

TheHive can be improved because if you want to use it in a small or medium company, it will be really good, but for a really huge company like mine was, I believe that at least on the free version, you will have big issues regarding performance because the solution is not built for a huge company like mine was. The value you can extract from the solution depends on the case.

I encountered specific performance issues with TheHive, mainly regarding the many alerts we had, as it started to become slow and have some lags. Many times we had to restart the on-premises server many times to solve that problem, at least temporarily.

I have been using TheHive for more than six years.

TheHive is stable, more or less.

TheHive's scalability is good, I believe, but you really have to understand how to have a good infrastructure to support all the alerts that a company can have.

We did not have customer support for TheHive.

I did not previously use a different solution.

My experience with pricing, setup cost, and licensing for TheHive was that we did not have a license to use it, as it was the free version, but the main thing was the infrastructure needed to use it, which was acceptable, I believe.

We have seen a return on investment using TheHive, as we saved a lot of money mainly comparing with other enterprise solutions, but on the other side, we had some performance issues that I believe could impact the time saved to investigate some incidents.

Before choosing TheHive, I did not evaluate other options.

I rate TheHive an eight on a scale of one to ten.

I choose the number eight because it is a really good solution if you know how to configure it and if you know how to measure the infrastructure needed to make it really good for the company.

My opinion on TheHive's AI capabilities is that it is really good regarding its governance and security. I do not know exactly the AI capabilities, but I know the integrations that we can make, and these integrations with other tools that have AI solutions made the solution much better.

My advice to others looking into using TheHive is that if you do not have an enterprise solution to use in your company, I advise you to use it, but be aware that if you use an on-premises solution, you will have to make the sizing really well to avoid slow performance later. The overall rating I would give TheHive is an eight.

My main use case for TheHive is to work in our incident response team, where we manage the incident response process inside TheHive and alerts as well.

A specific example of how TheHive fits into my incident response process is when we receive an alert from our system, a ticket is opened inside TheHive, and we use TheHive to manage this ticket. If it becomes an incident, we use TheHive to register the steps, document the information, and manage the incident inside TheHive.

TheHive has positively impacted our organization because it is a free solution. During a time when we did not have the budget to contract another tool, it had a significant impact on our operations by providing us visibility related to our incidents, alerts, and KPIs.

I think the best features TheHive offers are the ability to automate actions based on alerts and information that we have inside the software.

Automation has helped my team as we monitor the alerts. For example, we had one case where we blocked some IP addresses that were attacking the infrastructure. We received the alert, identified the IP in the alert, and automatically blocked this IP in our security solution.

TheHive improved my visibility into incidents and KPIs by allowing us to manage our incidents, such as tracking how many alerts we received and how many incidents we had in the last week and in the next month.

I would rate it a seven because I think the design could be better in TheHive. The graphics need improvement.

When I used TheHive, the platform did not have AI governance and security options yet, but that was in the past.

I have been working in my current field for the last four years.

TheHive is stable.

Customer support for TheHive is handled by another team, where the infrastructure team is responsible for the infrastructure and the server system.

Today we use the Atlassian solution, and we switched to this solution because it was a company decision. Our company uses Atlassian today, which was not a decision from my sector or my team.

I would advise others looking into using TheHive to try to use the automation features, as they are very important.

I use TheHive mainly integrated with my SOAR solution, which is n8n, to solve investigations and sub tickets.

Normally, the SOAR, which is n8n, integrates a ticket with TheHive, and then in the ticket, it provides information about the alert. It has some decoders, and then I can correlate them with the SIEM that I use as well, so I can correlate the decoders from TheHive with the events from the SIEM.

TheHive has actually made the company work better because we use approximately ninety percent open source solutions, so having a really good software TheHive really helps the company.

When I entered the company, they were already using TheHive, but they were not using it with a SOAR integrated. We were using another solution for it, and then actually responding to alerts and investigations, everything in TheHive really worked with the operation.

Something that I really appreciate in TheHive is the filters; I think they are really useful and helpful in a way that they are really intuitive. I can use them, and I actually used them since the first day I was introduced to TheHive.

The best features TheHive offers in my opinion are the filters; the quick filters help me a lot on a daily basis.

The main two quick filters that I use on a daily basis are the open cases, because we are in an area that has a lot of alerts to investigate. I can filter for the open alerts and the title filter as well, because in the title filter, it can filter for a specific string using wildcards.

I do not have anything in mind that could make TheHive better; I actually think it is nearly perfect.

I have been using TheHive since I started working.

TheHive is stable in my experience.

By scalability, I mean as my organization grows or if the number of alerts increases, does TheHive handle the extra workload smoothly? TheHive handles it perfectly.

The customer support is perfect; we use responders for mail ticketing, and we have a responder that, when it is run, the customer receives an email with the ticket solved.

I rate the customer support as ten out of ten.

I only used TheHive myself; when I entered the company, we were already using TheHive.

We work with an SLA of one hour to send every alert to our customers, so TheHive actually helped out a lot with the SLA. When we used another solution, we actually used to take three or four times the SLA, which is one hour.

I rate TheHive overall as ten out of ten.

I choose ten for my rating because it really works out really well, and on a daily basis, it never gave up on me. It actually helps a lot.

I would strongly recommend using TheHive to others reading reviews on PeerSpot, considering it is an open source solution. It has so many features, and it helps a lot on a daily basis. Everyone agrees on it; there is no reason not to use TheHive.

I use TheHive for incident management and investigation in my day-to-day work. It is for collecting incident information, classifying it, entering it, and adding IOCs in the observables, which gives a broad view for our business.

I can provide a quick and specific example of how TheHive helped me in a real incident management or investigation case. Since it has classification for the registered incidents, we can enter the information collected during an investigation, classify it there, and compare it with other investigations that have already taken place. It provides a lot of information so we can have that general analysis of the scope.

TheHive is very useful specifically for incident management. Because of the logging, the ability to share the information collected with upper management, and being able to compare it with other alerts that have already occurred in the environment, it is very useful for that part.

TheHive has provided this platform that lets us measure the types of alerts that arrive in our environment. We have a global view of the types of alerts, their criticality, and their volume. We are able to make this measurement so we can address, point by point, what we can improve.

I have a concrete example of improvement or metrics that demonstrate this positive impact. For some alerts that were handled daily, through TheHive we saw that we had a lot of that type of alert being processed, and we managed to improve their classification, the trigger, and the response time for that kind of alert. TheHive helped in this area of checking the quantities.

The best features that TheHive offers include the part where we can enter TTPs and the IOCs, which is this registering of information and being able to compare it with other types of alerts that we register in the environment. This is something that helps us a lot to add maturity to our service here, to our SOC, and to have a broad view of the security scope we are dealing with.

Initially, the analyst needs to have some technology knowledge regarding TheHive, but once we start using the tool in our daily work, we manage to develop well with it. However, the initial part is a bit of a barrier at the beginning for an analyst who does not yet have that technology knowledge. It is a bit difficult initially for an analyst to work with it.

TheHive would benefit from an initial base for necessary improvements, something more practical for an analyst who is just starting out.

I have been using TheHive since I started working in cybersecurity, and the companies have always adopted this practice here of creating alerts on TheHive platform. I have been using TheHive for around four years.

TheHive is stable.

TheHive's scalability is very smooth concerning the volume of alerts. We can scale very easily. We have an analyst responsible for management, and he is able to handle the scalability when we need it.

I have always used TheHive.

I have seen a return on investment regarding time savings. We are able to measure alerts and handle them more quickly. Since we have already had similar alerts before, we are able to reduce the time needed for handling, and that is something quite impactful for our department.

Since I am using version 4.1.1 of TheHive, I have not had much issue with pricing, setup costs, and licensing. I am looking to acquire the more complete version 5, which is still on the company's radar to implement this improvement.

Before choosing TheHive, I did evaluate other options, but TheHive was one of the first applications I looked at. I already knew about it from colleagues who had recommended it to me, and since I saw that it was a tool I could use in my daily work, it was the first one chosen.

On a scale from 1 to 10, I would rate TheHive overall a 10.

TheHive was one of the management tools for alerts that really helped my company, which is why I give the highest rating to TheHive. We are able to have a broad view of the overall scope of alerts and incidents that occur in the organization.

Regarding TheHive's AI features, the governance and security are interesting because I have not worked directly with the AI features, but the governance part is well aligned with the organization's scope.

Regarding TheHive's AI features, the accuracy and reliability of the results are very consistent. In line with the information we feed into it, it provides consistent information. We have had no issues in that respect.

My advice to others who are thinking about using TheHive is that they can use it. It is a tool that really adds value to the SOC environment and to other environments as well. It provides reporting capabilities that we can present to upper management for analysis. We ourselves can perform these analyses to improve our service.

As a stock analyst, I use it for the non-profits process to classify and resolve incidents.

We used another tool to aggregate alerts; we only used TheHive to manage incidents.

We have integrated TheHive with other security tools.

We integrated it with Microsoft Defender, Microsoft Sentinel, and the entire Microsoft suite, as well as with LogRhythm.

I didn’t integrate it myself, but we didn’t face any trouble using it; I don't remember experiencing any errors regarding miscommunication.

My favorite thing about TheHive is the interface; it was very easy to know what to do, where to click, and how to use the basic configuration.

Learning how to use TheHive was pretty easy due to the ease of the interface I mentioned before.

I think the assignment process is something I dislike about it; I don't know if the new version has corrected that, but the version I used to use had some troubles assigning the analysts with the incidents.

I have been using it for seven months in my career.

I experienced stability issues with TheHive as it would lag sometimes, especially around midnight during my shifts; we dealt with crashes at about two AM or three AM, and when we captured incidents, the system couldn’t process the capture.

I have only worked behind the last two alternatives that were similar to TheHive.

TheHive does require maintenance on my end, but I do not fully understand it.

Regarding updates, the analyst that worked with the infrastructure had to perform maintenance once, but I only remember one maintenance the whole time I was there for several months.

For my overall score of TheHive, I would give it a score of nine because as a technical analyst, I believe it’s nice, but I can't give a more precise score as I wasn't on the infrastructure shift.

My main use case for TheHive is to centralize all the alerts and cases across the company because we use many SIEM tools, so we rely on TheHive to centralize that.

A specific example of how I use TheHive to centralize alerts is that when alerts come to our API, we input them into TheHive so we can improve and provide a better view of the indicators of compromise and alerts, allowing us to do better work with TheHive.

I have added custom tools and plugins for TheHive that are used to communicate with our customers, clients, and tenants, making it a centralizer for our operations.

The best features TheHive offers are the custom tools and webhooks.

I appreciate the custom tools and webhooks because they are easy to use and very quick. Combined with Elasticsearch, this makes TheHive much faster with low latency. The custom tools allow me to create plugins for our specific needs.

TheHive has positively impacted my organization because before using it, all the analysts and team members needed many browsers and windows open in the system and had to click and move between them. With TheHive, we centralized everything, and now analysts only need to view one screen with all the features and tools to perform all actions through automations, APIs, and SMTP servers.

The two most important outcomes from this centralization are saving time and making the team more efficient. Before using TheHive, one analyst could handle support for five or six customers, and now we can handle ten to fifteen customers for each analyst.

I believe TheHive can be improved with the interface because it is somewhat visually unappealing. I think a more beautiful and visually appealing interface would be beneficial. Additionally, an integration with AI systems and MCP would be very helpful if possible.

Regarding TheHive's AI capabilities, I think both governance and security are important considerations. I see governance and security being handled by improving TheHive with AI to analyze indicators of compromise or mature SIEM capabilities. While this is not the primary purpose of TheHive, we currently accomplish this through plugins. If TheHive had an AI provider or something to configure an API key, that would be important. For governance, simplifying the logs would be beneficial.

I have been using TheHive since my first day at this company, which has been approximately two years.

TheHive is stable.

I would rate TheHive's scalability at nine out of ten.

TheHive's customer support is good. We have a Discord server to communicate, and everything works well.

I did not previously use a different solution before TheHive.

Before choosing TheHive, I did not evaluate other options.

I rate TheHive an eight out of ten. It is an eight rather than a ten because the interface improvements are very important to address.

TheHive is deployed in our organization on a private cloud with Hetzner for only company access.

The advice I would give to others considering TheHive is to read the documentation.