Use cases

Basic

Alert triage

TheHive’s automated triage optimizes alert management by integrating detection tools using custom JavaScript Functions. These Functions create alerts directly, eliminating middleware.
Predefined triggers run automated analyzers on observables like IPs and file hashes, delivering real-time threat reports.

Intermediate

Manage your cyber defense

TheHive boosts cyber defense management with powerful case and observable management tools:

• Cases are created instantly with predefined tasks that guide analysts, ensuring procedures are followed.
• Observables, like IPs and file hashes, are enriched with context for more precise analysis.
• Automated analyzers provide real-time threat assessments, and automated responders allow teams to take immediate action, such as isolating compromised hosts or blocking malicious IPs.

Intermediate

External communication

TheHive improves external communication and response by automating key processes.

• User-reported phishing alerts are automatically parsed and ingested.
• Alerts from SIEM, EDR and CTI tools are integrated, providing real-time updates.
• Responders take swift action, isolating compromised endpoints and blocking malicious IPs.
• Notifications inform stakeholders in real time, while MISP exports share IOCs with external partners.

Intermediate

Automated DFIR

TheHive automates Digital Forensics and Incident Response by transforming non-native alerts, like those from Cortex XDR, into actionable formats using custom Functions.

Advanced

Continuous improvement

TheHive supports continuous improvement by optimizing alert triage, case management and response.

• Alerts are quickly triaged, with true positives escalated to full cases for detailed analysis.
• Responders neutralize threats, applying relevant TTPs for incidents like phishing or malware.
• The internal Knowledge Base is updated with new findings, and case templates are refined based on lessons learned.

Advanced

Phishing

TheHive eases phishing incident response with automatic email ingestion, extracting key observables like sender details and links.