The hero of this story is a multinational luxury group that owns numerous luxury brands. It is a major enterprise with a global footprint, where over 60,000 users work across over 40,000 endpoints—and a 15-person SOC team keeps the infrastructure secure.
The team receives around 30 security alerts per day, translating into roughly 900 every month. To manage them, analysts used to work with efficient but disjointed tools, and this process took a lot of time. The main pain point became clear: to establish a transparent, overall view of all the alerts across the information system.
To help solve the problem, the team adopted TheHive Cloud Platform in 2022.
Integration in a complex cybersecurity ecosystem
The client’s cybersecurity infrastructure consists of several specialized functions working together:
- Endpoint protection,
- Monitoring of local and internet-exposed assets,
- Threat intelligence,
- Vulnerability management.
Often, the SOC also needs to collaborate with security teams from different brands of the luxury group to solve issues.
When it comes to individual brands, they’re quite exposed. That includes a high volume of DDoS, phishing attempts and other types of threats.
With such a variety of separate tools and processes, it was really difficult to keep track of alerts: analysts had to check emails (if alerts came in that way) and monitor tickets in each separate tool.
The lack of centralization made it hard to stay on top of alerts efficiently. TheHive Cloud Platform became the tool that finally allowed it.
99% of the time we handle alerts through it. All of them are received there, and an analyst can connect to the platform and start processing incidents straightaway.
Facilitating alert handling and incident response
TheHive Cloud Platform is directly integrated with all the alert-generating tools in the client’s cybersecurity infrastructure. It automatically collects alerts as a single pane of glass, which gives analysts the opportunity to manage them from one central point.
TheHive Cloud Platform for centralized alert ingestion
Without a doubt, centralization is one of the most important features for us—having all alerts in one place makes a huge difference. The API is also a big advantage: it's powerful and easy to use, which allows us to extract very precise KPIs. That’s especially valuable for management and reporting.
Their main KPIs include the number of cases handled, the severity levels of those cases, various response times (such as MTTR) and the distribution of cases over time to track workload trends within the team. Thanks to TheHive’s open APIs, they can also extract data for further processing.
Vulnerability alert management workflow
Featuring TheHive Cloud Platform, the team has built a workflow to manage vulnerability alerts. It combines email automation, scripting and case management into a process that runs almost entirely without manual intervention.
The process starts with a dedicated vulnerability management platform, which scans in-scope assets and generates vulnerability alerts. These alerts are automatically sent to a shared security mailbox.
Email routing and automation
Based on asset tagging, incoming emails are automatically routed to one of two folders:
- Cases – if a technical owner (TechOwner) is already identified.
- Alerts – if no TechOwner is defined.
A Python script regularly retrieves emails from both folders and creates the corresponding records in TheHive.
When a TechOwner is identified
If the asset already has a tagged TechOwner, a case is automatically created in TheHive. Key custom fields are populated from the email, including the external reference to the vulnerability console and recipient details.
Depending on the asset scope, the case is either automatically assigned to the responsible team member or placed on hold (in which case, a special Mailer responder is triggered in TheHive to notify the TechOwner with the relevant details and a csv report).
No analyst action is needed.
Vulnerability alert management: case example in TheHive
When no TechOwner is identified
If the asset has no assigned TechOwner, an alert is created in TheHive instead.
At this stage, analyst involvement is required. The analyst:
- Converts the alert into a case,
- Identifies the correct TechOwner,
- Updates the asset information in the vulnerability centralization platform,
- Triggers the Mailer responder to notify the newly assigned owner.
This structured approach ensures vulnerabilities are either automatically routed to the right owner or quickly triaged when ownership is unclear—maintaining both speed and accountability in the remediation process.
Vulnerability alert management workflow featuring TheHive Cloud Platform
Enabling SOC automation and efficiency
Beyond that automation workflow, TheHive Cloud Platform has played a key role in eliminating other repetitive, manual tasks across the SOC’s operations.
Before adopting it, analysts frequently had to perform the same actions manually—like blocking malicious URLs via the WAF (Web Application Firewall), which involved logging into the platform, copying the URL, applying the block and validating the changes.
Thanks to various Cortex responders inside TheHive, many of these actions can be triggered automatically, saving precious analyst time.
A custom mail responder is among the most used, formatting and sending emails directly from a case or alert. Other integrations, like ZeroFox, also generate alerts automatically in TheHive Cloud Platform, further expanding the automation toolset.
Whether it’s for vulnerability scans, notifications or threat containment, automation is deeply embedded in our response workflows.
With analysts based in Europe, the Americas and China, the SOC operates around the clock.
With TheHive Cloud Platform, collaboration across time zones flows naturally. European teams lead incident response during their daytime hours, and once their shift ends, U.S. and Asia-based analysts pick up where they left off. Overall, around 15 analysts are working with the platform from around the world.
Daily syncs happen via Microsoft Teams, but TheHive Cloud Platform serves as the shared operational hub, where every incident is documented. Most updates and handovers are recorded in case comments, allowing the next team to understand the current status and continue investigations without missing a beat.
For reporting, dashboards are created internally by exporting case and alert data from TheHive. Those metrics are shared regularly with senior management.
What's ahead: enhancing TheHive Cloud Platform with automation and SOC integrations
With TheHive Cloud Platform serving as their unified interface, cybersecurity analysts at the luxury group now handle far more alerts and potential incidents than before—but not because threats have increased.
Previously, it was difficult to get a full view of our environment. Many alerts simply went unnoticed because there was no centralized way to capture and track them. With TheHive Cloud Platform now consolidating input from across our ecosystem, we see almost everything—bringing even hidden risks to light.
Looking ahead, the team is planning to expand their use of automation by adding more responders and analyzers to TheHive Cloud Platform—a key objective for the medium term.
The SOC is also exploring new integrations to further enrich its alert management capabilities. There are plans to connect an internal honeypot-style detection tool directly to TheHive. Similarly, the analysts are considering integrating alerts from a tool that scans their GitHub repositories to avoid secret information leaks.
TheHive is now an integral part of our processes. It’s used daily by our analysts and serves as the key tool for incident management.
Try TheHive Cloud Platform for free
Test our SaaS solution for a week, with no strings attached. See how it can empower your team!