TheHive
French incident response case platform with Cortex analysers and a native Flow engine
Quick Overview
| Company | StrangeBee SAS |
|---|---|
| Category | SOAR and Security Automation Platforms |
| Headquarters | France, France |
| Founded | Not stated |
| EU Presence | Yes - France (EU) |
| Data Location | On-premises, or a dedicated AWS cloud environment for the SaaS version (region not stated on pages read) |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | Yes, on-premises edition |
| Main Features | Case, alert and user management, MISP and MITRE ATT&CK integration, Cortex actions, webhooks, TheHive Flow, AI capabilities, MSSP multi-client use |
| Pricing | Annual subscription from EUR 26,000 (Gold, Platinum, ONE); Community Edition free for non-commercial use with limited capabilities |
| Best For | CERTs, CSIRTs and SOC teams whose main need is structured case handling with automated analysis |
| Replaces | Palo Alto Cortex XSOAR (case management), Splunk SOAR |
Detailed Review
TheHive is the case management half of many security automation setups: alerts become cases, observables go to Cortex for analysis, and responders act on the results. StrangeBee's site says the platform is used by 5,000+ SOC, CERT and CSIRT analysts in 50+ countries.
Until now automation was delegated to Cortex and to external tools. The homepage now announces TheHive Flow as a native orchestration and automation layer, available on the top plan.
Plans
The pricing page states an annual subscription starting at EUR 26,000, depending on deployment option and number of users and organisations. Gold covers advanced case, alert and user management with MISP, MITRE ATT&CK and IMAP integration, webhooks and Cortex actions.
Platinum adds case reports, Microsoft 365 and Google Workspace email intake, Slack, Teams and Kafka connectors, custom functions and SAML. ONE adds TheHive Flow, built-in AI capabilities and downloadable workflow templates.
Cortex and deployment
Cortex is described as the automated analysis and response engine behind TheHive. Deployment options listed on the site are on-premises, a TheHive Cloud Platform on a dedicated AWS environment, and cloud images.
A free Community Edition exists for non-commercial use with limited capabilities.
Fit against Cortex XSOAR
TheHive centres on cases and collaboration. Teams that want a generic workflow canvas next to it can look at Shuffle or Tines, while TheHive Flow is the vendor's own answer.
Limitations to Consider
The entry price of EUR 26,000 a year is high for small teams. The SaaS runs on AWS and the pages read do not state the region. Native automation only arrives on the ONE plan, and the Community Edition is limited and non-commercial. Smaller teams may find Shuffle cheaper to start with.
Who Should Use TheHive
CERTs, CSIRTs and MSSPs that need collaborative case handling with analysers, and are ready for a subscription priced in the tens of thousands of euros.
Pros and Cons
Pros
- Mature case and alert model
- Cortex analysers and responders
- TheHive Flow native automation on ONE
- On-premises edition available
- French company with published pricing floor
Cons
- Starts at EUR 26,000 a year
- Native automation only on top plan
- SaaS hosted on AWS, region unstated
- Community Edition limited to non-commercial use
Alternatives to TheHive
Other European soar and security automation platforms worth comparing before you decide:
Shuffle
Norway · Open source SOAR for security teams and MSSPs
SecureVisio
Poland · SIEM, SOAR and UEBA in one platform from Rzeszow
Tines
Ireland · No-code workflow automation used by security and IT teams
Guardsix (formerly Logpoint)
Denmark · SOAR that runs inside the same self-hosted sovereign platform
See all European soar and security automation platforms or compare them directly against Palo Alto Cortex XSOAR (case management) on our alternatives page.
Frequently Asked Questions
The pricing page says annual subscriptions start at EUR 26,000, with the final price depending on deployment and number of users and organisations. A free Community Edition with limited capabilities exists for non-commercial use.
It is described on the StrangeBee site as the native orchestration and automation layer of TheHive, included on the ONE plan together with built-in AI capabilities and workflow templates.
The site footer names StrangeBee SAS, and the company presents itself as a French vendor.