TheHive
TheHive is a collaborative security incident response platform for managing cases, tasks and observables (the 4.x line was open source; newer versions are offered by StrangeBee).
Legal & ethical use. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Track incident cases and tasks in a team
- Link observables to threat-intelligence lookups
Key features
- Case and task management
- Observables and templates
- Integrations
Installation
See the StrangeBee documentation for the current editions and licence terms before deploying.
Beginner usage guide
Create a case from a test alert, add tasks from a template and record observables.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Concept (UI)
New case → add tasks → add observablesUse case templates to standardise response steps.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Commands were written from the official documentation and have not been executed on this site; test them in your lab.