From fragmented alerts to automated incident response: how Mews uses TheHive for hospitality security

Mews is a cloud-native hospitality operating system that runs property management, payments and guest-facing operations for thousands of hotels around the world. Founded in 2012 and based in the Netherlands, Mews works with hotels of every kind, from independent properties to large groups and chains, hostels and alternative accommodations.

As the company and its integrations have grown, so has the volume and variety of security alerts its Product Security team has to deal with. Today, eight people use TheHive daily, and the team is set to keep growing, which makes consistency across the team even more important.

Before adopting TheHive, the Product Security team at Mews was managing security alerts across a combination of a SIEM, a CNAPP and Jira. There was no single workflow, no automation and no consistent way to triage or escalate. When something suspicious happened, an analyst had to manually pull context from multiple sources and make decisions with incomplete information.

Without a shared platform, the same alert could be handled differently by different analysts at different times, and that kind of inconsistency is exactly what a well-run security team can’t afford.

Mews needed something purpose-built for security operations rather than a patchwork of general-purpose tools. TheHive won out because it came with capabilities that matter for security work specifically: evidence preservation, auditability and immutable records to support chain of custody. Just as important, TheHive could be self-hosted and run directly by the security team, without depending on another team’s tooling to make changes.

That’s what led the team to adopt TheHive and build a self-service platform called Stuart on top of it, to bring their hospitality security operations workflows closer to both technical and non-technical stakeholders.

Here’s how the typical day of a security analyst now looks at Mews thanks to the combination of TheHive and Stuart:

It all starts in the Analyst Queue, an AI-prioritized worklist pulled directly from TheHive and ordered by severity and urgency. Rather than a raw feed of hundreds of alerts, the queue scores and ranks incoming items based on severity, observable enrichment results and detection type, all automatically prefilled in TheHive. This way, analysts always start with the highest-signal cases first.

From the queue, analysts move to the Alerts view, a verbatim copy of every alert ingested from TheHive, filterable by stage, severity and assignee.

Stuart’s Security Dashboard surfaces SLA metrics, mean time to detect, acknowledge, qualify and respond, all fed from TheHive data. It is how the team catches a backlog building up or an SLA tier breaching before it becomes a real problem.

One of Mews’s detections triggers when a user exports hotel reservation data covering an unusually long date range, a signal associated with potential data exfiltration. The SIEM picks it up, and within seconds an alert lands in TheHive.

Before an analyst ever touches the alert, TheHive’s event system triggers Cortex analyzers to:

• Check the source IP against third-party threat intelligence feeds and an internal deny list
• Correlate the requesting property’s access activity against known patterns
• Check whether the source IP or account has already been seen in prior alerts or cases in TheHive
• Query the internal data platform to identify who owns the user account that triggered the export
• Automatically extract the account owner’s email and add it as a TheHive observable
• Re-run the original query scoped to that specific account and event window

By the time an analyst opens the alert in Stuart, all these Cortex analyzers have completed. Verdicts, enriched observables and a structured summary are ready to act on, and the runbook panel shows step progress. If everything is clean, the analyst marks it a false positive and moves on. If any analyzer flags something, TheHive automatically escalates the alert to a case, applies a case template and maps the relevant MITRE ATT&CK techniques.

One click on any analyzer opens its full Cortex report inline. For a flagged source IP, that means country, ISP, usage type, abuse score, Tor exit node check and resolved FQDN artifacts, all surfaced directly from Cortex without leaving Stuart.

When an alert crosses the threshold, when any analyzer returns a malicious verdict, or when an analyst decides to escalate, TheHive creates a case automatically, inherits all observables, applies the case template and pre-populates the Response Actions panel with the relevant Cortex responders for that detection type.

Three responders are available with a single click:

• Phishing Disclosure: automatically notifies the affected property and relevant stakeholders and kicks off the internal disclosure workflow
• Block IP via EDL: pushes the source IP to the deny list for immediate network-level blocking
• Reset User Password: initiates a forced password reset for the account that triggered the export

Thanks to these, the analyst doesn’t need to copy IPs into other tools or create tickets manually. They only need to review the evidence and pick the appropriate action—Cortex handles the execution, with a full audit trail living in TheHive.

Not every response action works the same way, though. Some run fully autonomously once an analyzer returns a clear verdict. Others, like resetting a user’s password, are kept on demand: available to the analyst in one click but only triggered when they choose to run it.

Mews doesn’t configure TheHive and Cortex by hand. Everything—custom fields, notification rules, case templates, analyzers, responders, Cortex report templates and even the runbooks (i.e., automation functions in TheHive)—is written as code and stored in version control.

Here’s how a change moves through the system:

1. A change is proposed as a pull request
2. Once approved, it deploys automatically to a test environment via GitHub Actions
3. A purpose-built validation agent runs two test alerts through it: one meant to look malicious, one meant to look harmless, and checks that everything behaves as expected (the right Cortex analyzers run, the observables get enriched, the runbook is executed, and sometimes it or a Cortex responder closes alerts or cases automatically)
4. Only if both tests pass does the change go live

This means that every change is tracked, tested and reviewed before it reaches production, and because it all lives in version control, there’s a clear history of who changed what and why.

Creating a new Cortex analyzer used to mean writing Python, JSON schemas and catalog entries by hand. The Analyzer Builder in Stuart removes that friction entirely: analysts answer a short series of questions (the analyzer name, observable type, description), and AI generates all the files automatically and opens a pull request in the strangebee-iac repository. From there, it follows the same review and deployment pipeline described above. No code, no manual file editing, no context-switching outside Stuart.

Before TheHive, Mews had detection capability but no response infrastructure. Alerts lived in a SIEM, context gathering was manual and escalation meant opening a Jira ticket. The tooling did not talk to each other, and the analyst was the glue holding it together.

Today:

• TheHive is the single source of truth for every security event the team handles. The alert-to-case model maps to how real incident response works, and its webhook event system powers the entire automation layer.
• With Cortex, the team writes an analyzer or responder once, and it’s instantly available to every runbook, across all detections.

• Stuart is the interface analysts actually work in, tailored to Mews workflows and encoding its runbooks, escalation logic, disclosure flows and analyst queue on top of TheHive’s data model.

The impact shows up in concrete cases. For example, when Mews spots a malicious domain set up to impersonate a company and target its guests, the team used to need around 2 days to request a takedown from its provider. With the automation set up via TheHive, that same process now takes 7 minutes.

What has changed the most is the time an analyst spends gathering context. That used to mean jumping between the SIEM, the data platform and external tools to piece together a picture that could take hours to assemble. Now it arrives pre-checked, in seconds, and the analyst’s job is to make the call rather than hunt for the data.