TheHive was integrated by Mindflow to enable users to automate their incident management and better protect their information system.

TheHive Overview

TheHive is an open-source Incident Response Platform, available on-premise. The solution is designed to be scalable and tightly integrated with MISP (Malware Information Sharing Platform) to ease the work for SOCs, CSIRTs, CERTs, and other SecOps by aggregating alerts from multiple sources (email reports, CTI, SIEMs).

SecOps can collaborate on investigations on the platform thanks to the built-in live stream that allows real-time information about new or existing cases, tasks, observables, and IOCs.

Benefits

• A dedicated and detailed Alert page where SecOps can make comments, identify similar Alerts, define custom statuses and fields, and decide if one alert should be escalated to investigations or incident response
• Improve your Incident Response Plan by using a template engine
• Add metrics on cases, tasks, observables, metrics, and more to generate KPIs through a dynamic dashboard engine
• Import IOCs by connecting TheHive with MISP
• Import MITRE ATT&CK Framework TTPs to TheHive Alert management