(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-WRBNM36X'); (function(ss,ex){ window.ldfdr=window.ldfdr||function(){(ldfdr._q=ldfdr._q||[]).push([].slice.call(arguments));}; (function(d,s){ fs=d.getElementsByTagName(s)[0]; function ce(src){ var cs=d.createElement(s); cs.src=src; cs.async=1; fs.parentNode.insertBefore(cs,fs); }; ce('https://sc.lfeeder.com/lftracker_v1_'+ss+(ex?'_'+ex:'')+'.js'); })(document,'script'); })('bElvO7322MM8ZMqj');
TheHive enters a new era with TheHive Flow, its native orchestration and automation layer! 
TheHive enters a new era with TheHive Flow, its native orchestration and automation layer! 
Learn more
Learn more
EN
Français English
Request a demo
EN
Français English
Products
Pricing
Company
Resources
Events
Request a demo

Welcome to the StrangeBee Blog!

Our latest insights about TheHive and incident response

Announcement
Announcement

Meet TheHive Flow: native orchestration for TheHive

TheHive Flow is now available in TheHive 6. Build workflows in a low-code editor to triage alerts, enrich observables and escalate cases, directly on the data your analysts already work with.

Martin Bridenne

Oct 20, 2026

5 min. read
Announcement
Announcement

TheHive 6: orchestration, built right into your investigation

TheHive 6 is available. Build automated workflows that run on your alerts and cases with TheHive Flow, and track every execution from the new Automation tab.

Oct 20, 2026

5 min. read
Incident response team working under cybersecurity regulations
Hands-on
Hands-on

Incident response under regulatory pressure: a practical look

NIS2, DORA and the new UK rules ask incident response teams for speed, documented procedures and proof of how each incident was handled. Here's what these cybersecurity regulations mean in practice.

Oct 09, 2026

5 min. read
Announcement
Announcement

TheHive MCP is now generally available!

After months of testing and hardening, TheHive MCP is finally ready to leave beta! Here's what we changed and tested, to ensure you are able to use it confidently, on your own data.

Jul 15, 2026

4 min. read

Articles

All No Category Announcement Hands-on Q&A Statement Food for thought Success Story Interactive Webinar
What is DFIR? How a police investigation explains modern incident response
Thought
Food for thought

What is DFIR? How a police investigation explains modern incident response

Broken windows, suspicious IPs and cold cases: a phase-by-phase guide to the DFIR lifecycle through the lens of detective work

Nabil Adouani, CEO of StrangeBee
Nabil Adouani

Jun 29, 2026

7 min. read
TheHive MCP Server webinar replay
Webinar

TheHive MCP Server in action: See how to fit AI into real incident response workflows

The webinar recording is now available!

Ekaterina Makhinova - StrangeBee blog author
Ekaterina Makhinova

Mar 23, 2026

2 min. read
TheHive 5.7: ready when you are!
Announcement
Announcement

TheHive 5.7: ready when you are!

Introducing the support of OAuth2 in Alert Feeder, case-insensitive observable types, MFA enforcement and bulk response on observables.

Martin Bridenne

Apr 13, 2026

7 min. read
Security incident prioritization: proven methods to improve alert triage
Thought
Food for thought

Security incident prioritization: proven methods to improve alert triage

Not every alert deserves the same urgency. Here's how SOC, CERT, CSIRT and MSSP teams can prioritize threats with context and confidence.

Ekaterina Makhinova - StrangeBee blog author
Ekaterina Makhinova

Apr 30, 2026

7 min. read
TheHive 5.8 release: SLA tracking, dashboards, API
Announcement
Announcement

TheHive 5.8: right on the clock!

TheHive 5.8 adds native SLA tracking for your alerts, cases and tasks, brings custom fields into dashboards, extends Global Search to comments and pages and introduces a brand new API documentation.

Martin Bridenne

Sep 16, 2026

1 min. read
Announcement
Announcement

Introducing TheHive MCP Server, a modern bridge between SOC workflows and LLMs

Empower case management, investigations and response in TheHive through AI capabilities!

Maëlle-Morgane Cartron, Product Marketing Manager at StrangeBee
Maëlle-Morgane Cartron

Jan 29, 2026

7 min. read
TheHive 5.6 release
Announcement
Announcement

Meet TheHive 5.6: collaboration, clarity and control—refined

Introducing TheHive Portal, Global Search, Shared Views and smarter filters

Maëlle-Morgane Cartron, Product Marketing Manager at StrangeBee
Maëlle-Morgane Cartron

Feb 03, 2026

7 min. read
StrangeBee Academy TheHive
Announcement
Announcement

Introducing StrangeBee Academy: the learning hub for TheHive

Learn how to use TheHive in our new centralized hub for structured and interactive learning!

Martin Bridenne

Jan 28, 2026

5 min. read
TheHive case templates InterCERT France
Announcement
Announcement

Meet 18 new case templates based on InterCERT France guidance

Create clear, actionable playbooks for today’s most frequent attack types

Lucas Burté

Dec 05, 2025

5 min. read
Announcement
Announcement

Release of Cortex 4.0: ready for Elasticsearch 8

We are pleased to announce the release of Cortex 4, with support of Elasticsearch 8!

Martin Bridenne

Nov 25, 2025

2 min. read

Blog categories

All Announcement Hands-on Q&A Statement Food for thought Interactive Webinar

Authors

Nabil Adouani, CEO of StrangeBee
Nabil Adouani

CEO
Jerome
Jérôme Léonard

COO
Beatrice Joucreau - StrangeBee blog author
Béatrice Joucreau

Security Officer
StrangeBee Blog author - Fabien Bloume
Fabien Bloume

Security Engineer
Ekaterina Makhinova - StrangeBee blog author
Ekaterina Makhinova

Content Manager
Alexandre Gohier - StrangeBee blog author
Alexandre Gohier

Cloud Engineer
Subscribe to
our newsletter
_stq = window._stq || []; _stq.push([ "view", {"v":"ext","blog":"234289117","post":"4727","tz":"0","srv":"strangebee.com","hp":"atomic","ac":"2","amp":"0","j":"1:16.4"} ]); _stq.push([ "clickTrackerInit", "234289117", "4727" ]); //# sourceURL=jetpack-stats-js-before