An open-source, scalable security incident response platform tightly integrated with MISP. It provides case management, alert triage, and collaborative investigation tools for SOC, CSIRT, and CERT teams.
What is The Hive?
TheHive is an open-source security incident response platform designed for SOC, CSIRT, and CERT teams that need a collaborative, scalable case management system without a commercial licensing dependency. It provides a structured environment for managing security incidents from initial alert through investigation to resolution, with each case containing a timeline of analyst actions, evidence attachments, observables, and task assignments. TheHive integrates natively with MISP for indicator sharing and with Cortex, its companion analysis engine, which can automatically enrich observables by running them through dozens of analyzers covering threat intelligence, sandbox analysis, and passive DNS. Its multi-tenancy support makes it suitable for MSSPs managing security operations for multiple client organizations, and its API-first architecture allows deep integration with other security tools and automation platforms.
How does The Hive work with Qevlar?
Qevlar integrates with TheHive to create cases and update investigation records as part of automated triage workflows. When Qevlar completes an automated investigation, it can push the findings, enriched observables, and recommended actions into a TheHive case, giving the analyst a structured record of the investigation to review, validate, and act on.
Want to help your analysts focus on the most critical alerts?
Frequently asked questions
What is TheHive?
TheHive is an open-source incident response platform for SOC, CSIRT and CERT teams, tightly integrated with MISP. It provides case management, alert triage and collaborative investigation tools.
What can you do with TheHive in Qevlar?
Qevlar can create and update cases in TheHive as part of automated triage — pushing findings, enriched observables and recommended actions into a case so the analyst has a structured record to review and act on.
Does Qevlar reduce manual case building in TheHive?
Yes. When Qevlar completes an investigation, it populates the case with evidence and context, removing the manual write-up that usually falls on analysts.
Is this suitable for MSSPs?
Yes. TheHive's multi-tenancy pairs well with Qevlar's autonomous investigation, helping MSSPs scale investigation across multiple client environments.
Other integrations
