How OpenClassrooms builds SOC analyst training around TheHive

OpenClassrooms is one of Europe’s most recognized online learning platforms, with a mission to make quality education accessible to everyone. When it set out to build its SOC analyst training programs, it interviewed SOC managers and practicing analysts to understand what tools actually matter on the job. TheHive came up consistently.

A tool that practitioners rely on every day is exactly what OpenClassrooms needed at the center of its cybersecurity curriculum. With it, students work in the same environment they will find when they walk into their first SOC.

OpenClassrooms runs its incident response training programs on TheHive Community Edition—the free, self-hosted version of the platform that StrangeBee keeps available to anyone who wants it.

That origin still shapes how StrangeBee thinks about the platform today. Even as the company has moved toward commercial development, Community Edition remains available. It comes with the same updates as other versions of TheHive, but with limited functionality.

For larger teams that need the full capabilities of the platform, the commercial offering is the right path. But for students, independent practitioners and anyone taking their first steps in structured incident response, Community Edition is a genuine starting point.

OpenClassrooms offers three cybersecurity programs featuring TheHive. Each of them targets a different stage of a professional’s career.

A nine-month French program for IT professionals transitioning into cybersecurity. Built in close collaboration with SOC managers and practicing analysts, it covers the full arc of the SOC analyst role: investigating and qualifying alerts, handling and containing incidents, continuously improving detection processes.

Students work with a professional-grade toolset (SIEM, EDR, TheHive, Cortex and other tools) in project-based scenarios modeled on real incidents. TheHive is introduced early and woven through the curriculum all the way to the final projects. Students progress through distinct stages:

• Case management fundamentals: reading alerts, enriching cases, working with IOCs and learning to prioritize and document investigations
• Incident containment: handling and containing incidents, with Cortex added to trigger automated responses directly from within TheHive
• End-to-end automation: combining TheHive, Cortex and other tools for IOC enrichment, disseminating indicators to other tools (such as web application firewalls) and handling incidents from end to end
• Continuous improvement: automating processes and enhancing detection and alert management via combining TheHive and Cortex with n8n and other tools

The sequencing is deliberate.

A typical project places the student as a SOC analyst for a simulated bank, with pre-filled cases, network scanning alerts, Windows Defender ATP events and malicious WAF requests. It then asks them to document, enrich and escalate each case through TheHive, producing comprehensive incident reports that reflect the full lifecycle of a real investigation.

Delivered through OpenClassrooms’ accredited university status in the United States, this program spans offensive security, defensive security and GRC (governance, risk & compliance). Such an approach reflects the US job market where junior hires are expected to operate across a broader scope before specializing.

TheHive features in the defensive security module, giving students hands-on grounding in case management and incident response within a broader curriculum that also covers offensive security and GRC.

To address the growing demand for shorter cybersecurity training formats, OpenClassrooms is introducing a new three-month bootcamp in late 2026. This leaner program targets IT professionals who want to move into cybersecurity without committing to a full reskilling program. The focus is on building the skills to detect and handle security incidents and to work effectively within a SOC, CSIRT or CERT team.

In such a condensed timeframe, TheHive serves as a practical accelerator, allowing students to bypass the educational “sandbox” phase. Students use TheHive to work through real-world incident scenarios, documenting cases, qualifying alerts and building the digital forensics skills that underpin solid incident response. The focus is on getting fluent with TheHive as a day-to-day working environment, rather than on extending it with automation.

OpenClassrooms continues to deepen its use of TheHive across programs. As automation becomes an increasingly central part of SOC work, the reskilling program is designed to grow with it.