What it does
TheHive is an incident-response management platform with on-premises and hosted options and integrations for analysis workflows.
TheHive gives a response team a shared place to manage an investigation instead of distributing case decisions across chat and spreadsheets. Its official site distinguishes on-premises, cloud and MSSP arrangements. Define a case's owner, evidence references and next actions before designing integrations. A case-management platform is useful only when the team agrees where decisions are recorded. Cortex is a related analysis engine with a different job, not simply another name for TheHive.
The free Community license is limited to two users and is described for individual and non-production purposes. It is not evidence of a free production team deployment. On-premises operation keeps infrastructure with your team; the managed cloud option uses a dedicated AWS environment maintained by StrangeBee.
Strengths
- Incident-response case coordination
- Several deployment arrangements
Best for
- Response teams coordinating evidence and tasks
Sources
- TheHive (Oct 26, 2026)