TheHive is a Security Incident Response Platform (SIRP) designed for Security Operation Centers (SOCs), CSIRTs, CERTs, and MSSPs to centralize and standardize incident response. The platform ingests, normalizes, and filters security alerts, escalating them into structured investigation cases. Case management is guided by customizable templates that define tasks, tags, custom fields, and workflow statuses to align with organizational playbooks. It supports multi-tenant operations through isolated workspaces with role-based access control (RBAC), which can be synchronized via LDAP or Active Directory. The system also provides dashboards for tracking key performance indicators (KPIs) and manages security-specific data types including observables, IOCs, and TLP classifications.
The platform's technical architecture is built on the Play3/Pekko web framework with Elasticsearch as its backend index. It provides automation capabilities through native integration with the Cortex analysis engine, which executes analyzers to enrich observables and responders to trigger containment actions like endpoint isolation or traffic blocking. A built-in "Functions" feature allows for custom automation using JavaScript to process webhooks from external tools, ingest non-native alerts, and interact with the platform's API. TheHive supports multiple deployment models, including on-premises installations via package managers or containers, a dedicated SaaS environment, and Infrastructure-as-a-Service (IaaS) images on major cloud platforms.
