TheHive Cloud Platform is the fully managed SaaS version of TheHive, a purpose-built security incident response platform trusted by 3500+ SOC, CSIRT, CERT and MSSP analysts in 50+ countries. It combines TheHive Platinum Edition and Cortex in your dedicated, hardened AWS environment.
No infrastructure to maintain, no updates to manage—everything is operated end-to-end by StrangeBee, the team that built it.
Collect, triage and manage alerts from your entire security stack in a single pane of glass.
Create cases from alerts, assign tasks, collect evidence and collaborate across your team to investigate every threat thoroughly.
Define separate organizations and teams, each with their own dedicated or collaborative environment.
Customize user roles and permissions, synchronize profiles via LDAP or AD and define exactly who can access what.
Invoke webhooks, send emails, Slack and Mattermost messages or call custom HTTP requests.
Generate actionable KPIs and MBOs with the dynamic dashboard engine.
Connect TheHive to your security stack with 300+ out-of-the-box integrations or build custom workflows using TheHive’s documented APIs.
Quickly import IOCs from other communities or share yours easily by connecting to MISP.
Import MITRE ATT&CK Framework TTPs directly into TheHive’s alert management.
Conclude an incident with a detailed report, available in either markdown or PDF file format.
Centralize all your policies, procedures, best practices and guidance within the in-app “wiki.”
Trace an incident’s progression from initial detection to resolution and recovery phases.
Collect, triage and manage alerts from your entire security stack in a single pane of glass.
Create cases from alerts, assign tasks, collect evidence and collaborate across your team to investigate every threat thoroughly.
Define separate organizations and teams, each with their own dedicated or collaborative environment.
Customize user roles and permissions, synchronize profiles via LDAP or AD and define exactly who can access what.
Invoke webhooks, send emails, Slack and Mattermost messages or call custom HTTP requests.
Generate actionable KPIs and MBOs with the dynamic dashboard engine.
Connect TheHive to your security stack with 300+ out-of-the-box integrations or build custom workflows using TheHive’s documented APIs.
Quickly import IOCs from other communities or share yours easily by connecting to MISP.
Import MITRE ATT&CK Framework TTPs directly into TheHive’s alert management.
Conclude an incident with a detailed report, available in either markdown or PDF file format.
Centralize all your policies, procedures, best practices and guidance within the in-app “wiki.”
Trace an incident’s progression from initial detection to resolution and recovery phases.
TheHive and Cortex come fully configured—analyzers, responders, MITRE ATT&CK taxonomies and templates included. Every new version is deployed automatically by StrangeBee.
TheHive Cloud Platform’s infrastructure is thoroughly hardened and hosted on dedicated AWS resources. All data is encrypted at rest (including live and backup versions) and processed exclusively in your dedicated environment.
StrangeBee adapts the platform to your existing infrastructure and SecOps tooling and migrates your on-prem data. Your instance includes API access, SSO, custom analyzers and responders, MISP integration, webhooks and much more.
StrangeBee handles all operations (monitoring, updates, backups and infrastructure maintenance) while your team stays focused on incident response. Deeper expert support is available for Premium service users.
GM, Global Cyber Operations EU, BT Business
Cybersecurity architect, Bureau of Information and Telecommunications, State of South Dakota
CERT / CSIRT, ARKEA
Software industry
Education industry
Manufacturing industry
IT services industry
IT services industry
IT services industry
Insurance (except health) industry
Transportation industry
Construction industry
Education industry
Software industry
Miscellaneous industry
Miscellaneous industry
IT services industry
Banking industry
Miscellaneous industry
Miscellaneous industry
Miscellaneous industry
Miscellaneous industry
Cybersecurity analyst, CERT Gemalto
Miscellaneous industry
StrangeBee is happy to help! Get the answers directly from our experts.
TheHive Cloud Platform is the fully managed SaaS version of TheHive—the security incident response platform specifically built for SOC, CSIRT, CERT and MSSP teams. It combines TheHive Platinum Edition and Cortex in a dedicated, hardened AWS environment, operated by StrangeBee.
TheHive Cloud Platform is based on the Platinum edition of TheHive—the most advanced tier, with full access to all features, including multi-tenancy, advanced user management, custom analyzers and responders and more.
TheHive Cloud Platform is a fully managed SaaS solution: StrangeBee handles all deployment, maintenance and operations. TheHive Cloud Images are pre-built IaaS images you deploy and manage in your own AWS or Azure environment. Cloud Images require a separate license (BYOL—Bring Your Own License) to activate your TheHive instance.
Yes. TheHive Cloud Platform is built for enterprise-scale incident response: it supports multi-tenancy, SSO, LDAP/AD synchronization, custom roles and permissions, data residency controls and direct access to expert support from the StrangeBee team.
TheHive Cloud Platform is hosted on AWS across multiple regions in Europe, the USA and APAC. All data is stored and processed exclusively in your dedicated environment, with encryption at rest for both live and backup versions.
