Keep sensitive investigations private with Private Cases in TheHive

Until now, case access in TheHive was mostly managed through organizational boundaries and multi-tenant workspaces. But for particularly sensitive situations, like legal escalations, partner-specific cases or incidents involving HR data, teams needed a more granular way to restrict who can see what.

This is now possible with the Private Cases feature.

Follow our interactive demo to learn how to manage case-level access (click on the “Expand” button to zoom):

Big security teams can have dozens of analysts that share a common workspace in TheHive, and in such setups, it’s important to not expose all case data. Obligations like GDPR, NIS 2 or internal policies also require limiting access to sensitive investigations to maintain confidentiality and reduce risks.

Introduced in TheHive 5.5, the Private Cases feature allows case owners to define exactly who gets access to each case. Only selected users will be able to know about, see, open or interact with them. These cases remain invisible in dashboards, lists, search results and alerts for everyone else.

Whether you’re working under GDPR, NIS2 or internal confidentiality policies, this feature helps you enforce the Least Privilege principle without slowing down your operations.

• Protect sensitive investigations
  Limit access to a select group of analysts, reducing the risk of data leaks.
• Simplify compliance
  Align with data privacy regulations and internal governance controls.
• Enforce full restriction
  Control doesn’t stop at the case level: sub-elements like alerts, tasks and notes are hidden too.
• Preserve confidentiality across merges
  Merged cases inherit privacy settings to avoid accidental exposure.
• Limit access by role
  Give contributors access only to what’s relevant for their role.
• Enable secure collaboration
  Collaborate confidently in hybrid environments while keeping strict access boundaries in place.