(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-WRBNM36X'); (function(ss,ex){ window.ldfdr=window.ldfdr||function(){(ldfdr._q=ldfdr._q||[]).push([].slice.call(arguments));}; (function(d,s){ fs=d.getElementsByTagName(s)[0]; function ce(src){ var cs=d.createElement(s); cs.src=src; cs.async=1; fs.parentNode.insertBefore(cs,fs); }; ce('https://sc.lfeeder.com/lftracker_v1_'+ss+(ex?'_'+ex:'')+'.js'); })(document,'script'); })('bElvO7322MM8ZMqj');
TheHive enters a new era with TheHive Flow, its native orchestration and automation layer! 
TheHive enters a new era with TheHive Flow, its native orchestration and automation layer! 
Learn more
Learn more
EN
Français English
Request a demo
EN
Français English
Products
Pricing
Company
Resources
Events
Request a demo

Let’s talk custom
TheHive pricing

TheHive is offered as an annual subscription license, starting at €26,000.

Your final custom price will depend on several key factors, including the deployment option and number of users and organizations you need to support.

Please fill in our short form, and we’ll reach out to discuss your tailored quote!

Trusted by 5,000+ SOC, CERT & CSIRT analysts in 50+ countries
Find a TheHive plan
that works best for you
On-premSaaS
TheHive Gold
Best for smaller internal incident response teams. Includes:
Advanced case, alert and user management
MISP, MITRE ATT&CK and IMAP integration
Webhooks, email notifications and Cortex actions
2FA, local authentication and LDAP
Expert email support
TheHive Platinum
Best for larger organizations with distributed teams. Includes everything in Gold, plus:
Case reports
Microsoft 365 and Google Workspace email intake
Slack, Teams, Kafka and custom HTTP requests
Custom functions
AD, OAuth2, SAML and GDPR capabilities
Live troubleshooting when needed
TheHive ONE
For teams ready to orchestrate and automate their SOC. Includes everything in Platinum, plus:
TheHive Flow, native automation and orchestration engine
Built-in AI capabilities
Downloadable workflow templates, ready to import into TheHive
Full run history and audit trail
Dedicated orchestration onboarding support
Need a tailored plan?
Tell us about your requirements, and we’ll help you find the right setup!
Request a discussion
Looking for a free Community version?
Learn more
TheHive
Cloud Platform
Full set of on-prem capabilities (TheHive Platinum), plus:
Dedicated AWS EC2 instances (multiple sizes available)
Hosting, maintenance and security by StrangeBee
Monitoring, backup and restore included
Yearly SOC 2 Type 2 evaluation
Uptime 99,9%
TheHive
Cloud Platform ONE
For teams ready to orchestrate and automate their SOC. Includes everything TheHive Cloud Platform can offer, plus:
TheHive Flow, native automation and orchestration engine
Built-in AI capabilities
Downloadable workflow templates, ready to import into TheHive
Full run history and audit trail
Dedicated orchestration onboarding support
Need a tailored plan?
Tell us about your requirements, and we’ll help you find the right setup!
Request a discussion
Testimonials

What security teams say about TheHive
We have been using TheHive for many years for our internal needs and those of our customers. It is a tool we have seen evolve over time, which is simple to use and effective for our day-to-day operational activities. The SOAR component is quite relevant and efficiently allows for improving the operational load of SOC/CSIRT analysts. It facilitates our life and has a multitude of integration possibilities with third-party tools such as MISP.
Show more
Abdoulaye Fadiga
GM, Global Cyber Operations EU, BT Business
Thanks to the creative minds and community behind TheHive and Cortex, we can efficiently investigate alerts and threats at scale throughout our organization. Having TheHive allows the freedom to build, design, and integrate with all of our security analyst's tools.
Show more
Nicholas Penning
Cybersecurity architect, Bureau of Information and Telecommunications, State of South Dakota
CERT Arkéa has been using the TheHive/Cortex combo for several years. In addition to the monitoring of submitted cases, the analysis of IOCs and the automation of incident responses via Cortex are a huge added value to our daily activity. The ease of creating a responder allows us to interact with the various IS APIs (ticketing, proxy blacklisting, IP blocking, takedown of phishing sites). By industrializing and automating our processes via TheHive/Cortex, the analysts save precious time in resolving incidents.
Show more
Guillaume Roussel
CERT / CSIRT, ARKEA
My experience with TheHive platform was nothing short of exhilarating. It's like the turbocharged engine of our cybersecurity arsenal, accelerating our threatening message to new heights. TheHive’s sleek interface and top-tier customer support make it a true champion on the cybersecurity track. I am revved up to recommend it.
Show more
gartner.com
Software industry
TheHive is a very high-performance and scalable product, which is designed for different platforms, with a very good user-friendly interface.
Show more
gartner.com
Education industry
TheHive is incredibly adaptable to our workflow needs. Its alert management system and integration capabilities make it suitable for both small setups and large enterprises.
Show more
gartner.com
Manufacturing industry
TheHive is a pretty cool tool for dealing with cyber incidents. You can tweak it to fit your needs, and it plays well with other security tools. It's great for teamwork, helps you stay organized, and makes it easier to figure out which threats are serious.
Show more
gartner.com
IT services industry
Our experience with TheHive has been largely positive. It has become an integral part of our incident response and threat intelligence workflow.
Show more
gartner.com
IT services industry
TheHive is a powerful and versatile tool for security incident response. It has the ability to automate tasks very well. TheHive has a user-friendly and intuitive interface that makes it easy to create, manage, and analyze security incidents.
Show more
gartner.com
IT services industry
From the first deployment until today, it has proved itself to be a game-changer in cybersecurity, and the results are evident. It helps automate repetitive security tasks and workflows. It also reduces the overall work pressure on our threat analysts, who can, in return, focus more on critical tasks and thus improve response time. The UI is also smooth, and navigation is easy. Integration and deployment were done quickly as well.
Show more
gartner.com
Insurance (except health) industry
It boasts tight integration with MISP and has been specifically designed to streamline and accelerate the resolution of security incidents. The three most important things that I liked about it are: 1. The ability to facilitate collaboration among multiple SOCs and CERTs. 2. It simplifies the management of tasks and alerts originating from various sources. 3. It is user-friendly and cost-effective.
Show more
gartner.com
Transportation industry
I have had a positive experience utilizing TheHive, a product implemented by our parent company and has helped us easily navigate incident response cases.
Show more
gartner.com
Construction industry
Excellent speed. User-friendly UI. Excellent support: TheHive's support team operates like a well-oiled pit crew, consistently responsive and prepared to assist.
Show more
gartner.com
Education industry
[TheHive] facilitates the creation and consolidation of cases within your ongoing work. The alert management and flexible integration capabilities of TheHive enable seamless adoption across a spectrum of installations, ranging from small setups to expansive enterprise deployments.
Show more
gartner.com
Software industry
Ease of use, easy integration with various security tools, able to be used in big environments.
Show more
gartner.com
Miscellaneous industry
TheHive makes life easier for SOCs
Show more
gartner.com
Miscellaneous industry
A scalable Security Incident Response platform. Very powerful. Recommended.
Show more
gartner.com
IT services industry
A very good tool to manage incident response workflows, it helps create and maintain a structure for your security operations team.
Show more
gartner.com
Banking industry
TheHive helps us create and merge cases. You can integrate it with Cortex and Wazuh, which maintains a better security posture. TheHive also helps us solve the problem of tracking down incidents. You can assign tasks to your teammates and track down the case. Also, if your investigation is over, you can close this case with proper justification. You can also integrate the tool with different SIEMs, Threat Intel tools, etc.
Show more
g2.com
Miscellaneous industry
The best part of TheHive is its integration with multiple threat intelligence tools like Cortex and MISP. Best for SOC teams for their incident response and case management.
Show more
g2.com
Miscellaneous industry
Easy to use and configure. Various integrations with various threat intel tools. We get all alerts from our SIEM on TheHive and easily manage them. Immense benefits.
Show more
g2.com
Miscellaneous industry
The alert management and the openness of TheHive allow to easily integrate it with different enterprise installations, from small to large. We are able to use it in a very big environment with extremely complex use cases and operation processes, and it works really great. The native integration of MISP interface is really helpful. TheHive’s file system, multi-tenancy, sharing of cases, alerts and observables are outstanding features that make this product choice number 1.
Show more
g2.com
Miscellaneous industry
What I like the most about TheHive are maintained dockers, scalability, efficiency in CTI checks, ease of use, design, and connectivity to other tools, thanks to the strong contributions from the community.
Show more
Julien M.
Cybersecurity analyst, CERT Gemalto
TheHive is designed for different environments and provides a user-friendly application GUI. It is a great product with good support and is easy to implement. Very little training was needed to navigate and use it. The collaboration method and being able to use TheHive in various capacities.
Show more
g2.com
Miscellaneous industry
We have been using TheHive for many years for our internal needs and those of our customers. It is a tool we have seen evolve over time, which is simple to use and effective for our day-to-day operational activities. The SOAR component is quite relevant and efficiently allows for improving the operational load of SOC/CSIRT analysts. It facilitates our life and has a multitude of integration possibilities with third-party tools such as MISP.
Abdoulaye Fadiga
GM, Global Cyber Operations EU, BT Business
Thanks to the creative minds and community behind TheHive and Cortex, we can efficiently investigate alerts and threats at scale throughout our organization. Having TheHive allows the freedom to build, design, and integrate with all of our security analyst's tools.
Nicholas Penning
Cybersecurity architect, Bureau of Information and Telecommunications, State of South Dakota
CERT Arkéa has been using the TheHive/Cortex combo for several years. In addition to the monitoring of submitted cases, the analysis of IOCs and the automation of incident responses via Cortex are a huge added value to our daily activity. The ease of creating a responder allows us to interact with the various IS APIs (ticketing, proxy blacklisting, IP blocking, takedown of phishing sites). By industrializing and automating our processes via TheHive/Cortex, the analysts save precious time in resolving incidents.
Guillaume Roussel
CERT / CSIRT, ARKEA
View source
My experience with TheHive platform was nothing short of exhilarating. It's like the turbocharged engine of our cybersecurity arsenal, accelerating our threatening message to new heights. TheHive’s sleek interface and top-tier customer support make it a true champion on the cybersecurity track. I am revved up to recommend it.
gartner.com
Software industry
View source
TheHive is a very high-performance and scalable product, which is designed for different platforms, with a very good user-friendly interface.
gartner.com
Education industry
View source
TheHive is incredibly adaptable to our workflow needs. Its alert management system and integration capabilities make it suitable for both small setups and large enterprises.
gartner.com
Manufacturing industry
View source
TheHive is a pretty cool tool for dealing with cyber incidents. You can tweak it to fit your needs, and it plays well with other security tools. It's great for teamwork, helps you stay organized, and makes it easier to figure out which threats are serious.
gartner.com
IT services industry
View source
Our experience with TheHive has been largely positive. It has become an integral part of our incident response and threat intelligence workflow.
gartner.com
IT services industry
View source
TheHive is a powerful and versatile tool for security incident response. It has the ability to automate tasks very well. TheHive has a user-friendly and intuitive interface that makes it easy to create, manage, and analyze security incidents.
gartner.com
IT services industry
View source
From the first deployment until today, it has proved itself to be a game-changer in cybersecurity, and the results are evident. It helps automate repetitive security tasks and workflows. It also reduces the overall work pressure on our threat analysts, who can, in return, focus more on critical tasks and thus improve response time. The UI is also smooth, and navigation is easy. Integration and deployment were done quickly as well.
gartner.com
Insurance (except health) industry
View source
It boasts tight integration with MISP and has been specifically designed to streamline and accelerate the resolution of security incidents. The three most important things that I liked about it are: 1. The ability to facilitate collaboration among multiple SOCs and CERTs. 2. It simplifies the management of tasks and alerts originating from various sources. 3. It is user-friendly and cost-effective.
gartner.com
Transportation industry
View source
I have had a positive experience utilizing TheHive, a product implemented by our parent company and has helped us easily navigate incident response cases.
gartner.com
Construction industry
View source
Excellent speed. User-friendly UI. Excellent support: TheHive's support team operates like a well-oiled pit crew, consistently responsive and prepared to assist.
gartner.com
Education industry
View source
[TheHive] facilitates the creation and consolidation of cases within your ongoing work. The alert management and flexible integration capabilities of TheHive enable seamless adoption across a spectrum of installations, ranging from small setups to expansive enterprise deployments.
gartner.com
Software industry
View source
Ease of use, easy integration with various security tools, able to be used in big environments.
gartner.com
Miscellaneous industry
View source
TheHive makes life easier for SOCs
gartner.com
Miscellaneous industry
View source
A scalable Security Incident Response platform. Very powerful. Recommended.
gartner.com
IT services industry
View source
A very good tool to manage incident response workflows, it helps create and maintain a structure for your security operations team.
gartner.com
Banking industry
View source
TheHive helps us create and merge cases. You can integrate it with Cortex and Wazuh, which maintains a better security posture. TheHive also helps us solve the problem of tracking down incidents. You can assign tasks to your teammates and track down the case. Also, if your investigation is over, you can close this case with proper justification. You can also integrate the tool with different SIEMs, Threat Intel tools, etc.
g2.com
Miscellaneous industry
View source
The best part of TheHive is its integration with multiple threat intelligence tools like Cortex and MISP. Best for SOC teams for their incident response and case management.
g2.com
Miscellaneous industry
View source
Easy to use and configure. Various integrations with various threat intel tools. We get all alerts from our SIEM on TheHive and easily manage them. Immense benefits.
g2.com
Miscellaneous industry
View source
The alert management and the openness of TheHive allow to easily integrate it with different enterprise installations, from small to large. We are able to use it in a very big environment with extremely complex use cases and operation processes, and it works really great. The native integration of MISP interface is really helpful. TheHive’s file system, multi-tenancy, sharing of cases, alerts and observables are outstanding features that make this product choice number 1.
g2.com
Miscellaneous industry
View source
What I like the most about TheHive are maintained dockers, scalability, efficiency in CTI checks, ease of use, design, and connectivity to other tools, thanks to the strong contributions from the community.
Julien M.
Cybersecurity analyst, CERT Gemalto
View source
TheHive is designed for different environments and provides a user-friendly application GUI. It is a great product with good support and is easy to implement. Very little training was needed to navigate and use it. The collaboration method and being able to use TheHive in various capacities.
g2.com
Miscellaneous industry
WANT TO KNOW MORE?

Frequently asked questions
about TheHive’s pricing

Other
questions?

StrangeBee is happy to help!

Reach out to us
What is a “user”?

A user is a person who needs to have access to TheHive’s user interface. If you have a team of 10 people, you will need a license for 10 users. Users with read-only profiles and unlicensed permissions are free.

What is an “organization”?

In TheHive, organizations are dedicated workspaces that isolate teams, their alerts, cases, users and configuration settings from other teams or external customers.

Can I pay monthly?

All our plans are offered on a yearly subscription only.

Can I upgrade my package or infrastructure type during my subscription?

Yes, you can purchase licenses for more users and organizations or upgrade your dedicated infrastructure during an ongoing subscription while keeping all your data and configuration.

Can I downgrade my package or infrastructure type during my subscription?

No, ongoing subscriptions cannot be downgraded during their agreement period, but you can downgrade upon renewal.

Looking to join 5,000+ users worldwide?
Let’s see how we can adapt TheHive to your team’s needs!
Request a discussion
_stq = window._stq || []; _stq.push([ "view", {"v":"ext","blog":"234289117","post":"11944","tz":"0","srv":"strangebee.com","hp":"atomic","ac":"2","amp":"0","j":"1:16.4-a.7"} ]); _stq.push([ "clickTrackerInit", "234289117", "11944" ]); //# sourceURL=jetpack-stats-js-before