A security case management platform trusted by 3500+ users in 50+ countries to centralize and speed up alert handling, collaboration, investigations and incident response.
Cybersecurity teams today are under constant pressure: threats evolve, alerts keep coming, investigations pile up, and coordination between analysts isn't always clear. TheHive is built to change that.
TheHive is a dedicated collaborative security case management platform designed for SOCs, CSIRTs, CERTs and MSSPs. It is a single pane of glass that helps analysts reduce alert fatigue, spend less time switching between tools and resolve incidents faster together, in a structured way and with full traceability.
Centralize alerts from multiple sources into a single view for faster triage and consistent management
Manage cases end-to-end: create and assign tasks, collect evidence and track incident timelines
Support multiple organizations with multi-tenancy and precise access control via customizable roles and LDAP/AD synchronization
Keep teams informed automatically via webhooks, email, Slack, Mattermost or custom HTTP requests
Track performance with dynamic dashboards and actionable KPIs; create detailed incident reports using customizable templates
Connect with over 300 security tools: SIEMs, EDRs, threat intelligence platforms, ticketing systems and more
Share threat intelligence natively with MISP and map techniques to MITRE ATT&CK for more context
Automate analysis and response actions through tight integration with the native Cortex engine
Deploy the way you need: on-premises, SaaS on AWS or IaaS images on AWS and Azure
Available in multiple languages to support distributed, global teams
Whether you're running a lean in-house SOC or managing security operations across multiple clients, TheHive adapts to your scale. Its flexible architecture, broad integration ecosystem and straightforward interface mean teams get up to speed quickly and stay effective under pressure. Audit-ready case records support compliance requirements out of the box, and when you need help, a strong user community and responsive support team have you covered.
Highlights
Centralized alert management and end-to-end case handling cut through the noise, helping SOC, CSIRT, CERT and MSSP teams respond to incidents faster
Over 300 integrations with SIEMs, EDRs, threat intelligence platforms and ticketing systems fit into the workflows your team already relies on
Flexible deployment (on-premises, SaaS or IaaS) gives you the freedom to choose what fits your organization's operational needs and growth trajectory
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
You buy TheHive as an annual contract license, priced by the number of users and organizations you need. The five options split across three deployment styles. TheHive Gold and TheHive Platinium cover on-premises use, where you run the software in your own infrastructure. TheHive Cloud Platform Large and X-Large cover the fully managed SaaS version, sized by scale. TheHive Platinium IAAS covers self-managed deployment on cloud infrastructure. All options include standard use. Your price rises as your user count and organization count grow.
Top-of-mind questions for buyers
What counts as one user for billing, and are read-only accounts included?
A user is any person who needs access to TheHive's interface. A team of 10 people needs 10 user licenses. Users with read-only profiles and unlicensed permissions are free and do not count toward your licensed user total.
What does an organization mean for pricing, and how does it affect cost?
An organization is a dedicated workspace that isolates a team's alerts, cases, users, and configuration from others. Your price is based on both user count and the number of separate organizations or teams you support, so adding organizations raises your cost.
What is the difference between the SaaS Cloud Platform options and the Platinium IAAS option?
TheHive Cloud Platform Large and X-Large are fully managed SaaS. StrangeBee handles deployment, maintenance, and operations in a dedicated environment. TheHive Platinium IAAS uses pre-built images you deploy and manage in your own cloud infrastructure, so you control the infrastructure yourself.
Tell us how we can improve this page, or report an issue with this product.
Give us feedbackReport a problem with this product or seller
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA).
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Buyers can expect help via email or through our website for general inquiries, troubleshooting, and product guidance.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Hive Platform is an all-in-one service that provides everything you need to develop and operate games. Experience the know-how of global game services experienced in more than 180+ countries with one Hive Platform.
This product has charges associated with it for deployment, configuration, and ongoing support. Docker-based security incident response platform with REST API and RBAC on EC2.
Be the first to review this product. We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.