Meet TheHive 5.6: collaboration, clarity and control—refined

TheHive 5.6 is here to make your daily incident response work even smoother.

This new release marks a step forward in collaboration and efficiency, introducing a collaborative portal, shared views and a powerful new search bar to better support analysts, managers and external contributors throughout incident response. Discover how below!

Third-party partners and MSSP clients, as well as executives, HR and legal teams often need updates or access to specific information from the cases you’re investigating.

That used to mean tiresome jumping between tools like email, Slack or Teams, spending extra time and effort to copy & paste fragmented information.

Now, there’s a better way: TheHive Portal allows direct, secure, restricted access to shared case data.

From a dedicated portal interface, external collaborators can:

• View cases that are marked as external
• Add observables and upload attachments
• Leave comments

SOC analysts keep full control over what’s shared, marking each case item explicitly for external access. Nothing is exposed by default: visibility of case content is controlled on a per-item basis.

Administrators can define external user profiles (e.g., Reader, Actor) and invite users. The result is structured and auditable collaboration, with lower risk of sensitive data leakage.

Until now, TheHive’s top-bar search was limited to case numbers. That often forced analysts and managers to navigate manually through different sections to find what they needed, resulting in a fragmented and time-consuming experience.

You can now search across all key entities (cases, alerts, observables, tasks) from a single entry point, while still benefiting from the familiar direct case number lookup.

Search results include icons, keyboard navigation support and a full “All results” page for deeper exploration. You can also open results in a new tab without losing your current view.

Global Search also respects private case permissions. Sensitive cases remain hidden unless you’re authorized to see them.

A view in TheHive is a configuration of list filters and sorting options. Previously, saved views were stored in the browser local storage, wiped out whenever it was cleared. This forced analysts and managers to lose time via manually recreating their preferred filters and layouts, which resulted in an overall frustrating experience.

Views are now stored in the database and persist across sessions. You can also share them with other analysts.

With Shared Views, users can:

• Access views across browsers and devices
• Choose view visibility (private or shared) across the organization

This makes it easier and faster for SOC teams to align. Everyone sees the same data, the same way, without having to rebuild their view from scratch.

Speaking of filters, Shared Views are not the only thing we’ve redesigned: TheHive 5.6 introduces an updated filter component!

Based on analyst feedback, we have revamped the filter user experience with:

• Granular filtering by data type: text, number, date, boolean, enumeration and custom fields.
• Dynamic interface: pop-ups, icons, tooltips and quick filters.
• User control: creating, modifying, removing and saving views.
• Integration across menus: all lists in the app, except widgets of the dashboard/report and search page.

The new filter UX is consistent across TheHive and supports custom fields. It’s a major step toward smoother, more focused investigations.

TheHive 5.6 brings improvements that can help teams triage alerts, communicate with external stakeholders and ensure view consistency for even smoother case management and collaboration.

Now, go explore the new release and tell us what you think in the customer support channel or here!

And as usual…