TheHive

No entries match these filters. Clear filters

1. v6.0.0 Oct 23, 2026 · issue 117

   API surface changed: +2 endpoints, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +2 endpoints, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + GET /api/v1/caseReportTemplate/{caseReportTemplateId}/export
   • + POST /api/v1/caseReportTemplate/import
   • ~ PATCH /api/v1/caseStatus/{id}: request body changed
   • ~ POST /api/v1/caseStatus: request body changed; response schema changed
   • New endpoint GET /api/v1/caseReportTemplate/{caseReportTemplateId}/export⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint POST /api/v1/caseReportTemplate/import

   2 details in Everything

2. announced Sep 16, 2026 · issue 078

   TheHive 5.8 adds native SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. tracking for alerts, cases and tasks, custom fields in dashboards, and expanded global search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Adds native SLA tracking for alerts, cases, and tasks, with per-entity-type rules, configurable warning thresholds, and breach notifications via the existing notification system.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports per-organization SLA rules, letting MSSPs assign different response-time targets to each client organization.
   • Extends the Table widget in Dashboards to display custom fields and tags alongside built-in fields.
   • Expands Global Search (introduced in 5.6) to cover comments and knowledge base pages in addition to existing entity types.
   • Adds native SLA tracking for alerts, cases, and tasks, with per-entity-type rules, configurable warning thresholds, and breach notifications via the existing notification system.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports per-organization SLA rules, letting MSSPs assign different response-time targets to each client organization.

   2 more in Everything

3. v5.8.0 Sep 14, 2026 · issue 074

   API surface changed: +2 endpoints, −18 endpoints, 16 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +2 endpoints, −18 endpoints, 16 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + GET /api/v1/responder-execution/{scope}/{rootId}
   • + GET /api/v1/responder-execution/{scope}/{rootId}/count
   • ~ GET /api/v1/case/{caseId}/links: response schema changed
   • ~ GET /api/v1/permission: response schema changed
   • ~ GET /api/v1/tag/{tagId}: response schema changed
   • ~ GET /api/v1/taxonomy/{taxonomyId}: response schema changed
   • ~ POST /api/v1/case/import: response schema changed
   • ~ POST /api/v1/case/{caseId}/report: request body changed
   • ~ POST /api/v1/caseReport/render: request body changed
   • ~ POST /api/v1/connector/cortex/action: response schema changed
   • ~ POST /api/v1/connector/cortex/actions: response schema changed
   • ~ POST /api/v1/connector/email-intake/config: request body changed
   • ~ POST /api/v1/connector/email-intake/config/test: request body changed
   • ~ POST /api/v1/connector/email-intake/folders: request body changed
   • ~ POST /api/v1/taxonomy: response schema changed
   • ~ POST /api/v1/taxonomy/import-zip: response schema changed
   • ~ POST /api/v1/user: request body changed
   • ~ PUT /api/v1/connector/email-intake/config/{configId}: request body changed
   • − GET /api/v1/admin/check/stats (breaking)
   • − GET /api/v1/admin/index/status (breaking)
   • − GET /api/v1/admin/stats (breaking)
   • − GET /api/v1/caseReport/formats (breaking)
   • − GET /api/v1/connector/cortex/action/{entityType}/{entityId} (breaking)
   • − GET /api/v1/stream/{streamId} (breaking)
   • − POST /api/v1/admin/check/cancel (breaking)
   • − POST /api/v1/admin/check/{name}/dedup/trigger (breaking)
   • − POST /api/v1/admin/check/{name}/global/trigger (breaking)
   • − POST /api/v1/admin/index/{name}/rebuild (breaking)
   • − POST /api/v1/admin/index/{name}/reindex (breaking)
   • − POST /api/v1/admin/schema/info/{schemaName} (breaking)
   • − POST /api/v1/admin/schema/repair/{schemaName} (breaking)
   • − POST /api/v1/connector/cortex/job/_bulk (breaking)
   • − POST /api/v1/stream (breaking)
   • − POST /api/v1/user/{userId}/login/set (breaking)
   • − PUT /api/v1/admin/check/_all/trigger (breaking)
   • − PUT /api/v1/admin/check/{name}/trigger (breaking)
   • New endpoint GET /api/v1/responder-execution/{scope}/{rootId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /api/v1/responder-execution/{scope}/{rootId}/count

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Removed endpoint GET /api/v1/admin/check/stats
   • !Removed endpoint GET /api/v1/admin/index/status
   • !Removed endpoint GET /api/v1/admin/stats
   • !Removed endpoint GET /api/v1/caseReport/formats
   • !Removed endpoint GET /api/v1/connector/cortex/action/{entityType}/{entityId}
   • !Removed endpoint GET /api/v1/stream/{streamId}
   • !Removed endpoint POST /api/v1/admin/check/cancel
   • !Removed endpoint POST /api/v1/admin/check/{name}/dedup/trigger
   • !Removed endpoint POST /api/v1/admin/check/{name}/global/trigger
   • !Removed endpoint POST /api/v1/admin/index/{name}/rebuild
   • !Removed endpoint POST /api/v1/admin/index/{name}/reindex
   • !Removed endpoint POST /api/v1/admin/schema/info/{schemaName}
   • !Removed endpoint POST /api/v1/admin/schema/repair/{schemaName}
   • !Removed endpoint POST /api/v1/connector/cortex/job/_bulk
   • !Removed endpoint POST /api/v1/stream
   • !Removed endpoint POST /api/v1/user/{userId}/login/set
   • !Removed endpoint PUT /api/v1/admin/check/_all/trigger
   • !Removed endpoint PUT /api/v1/admin/check/{name}/trigger
4. v5.7.5 Aug 4, 2026 · issue 035

   API surface changed: 8 deprecated

   API change

   API surface changed: 8 deprecated

   • ⚠ DELETE /api/v1/user/{userId}
   • ⚠ GET /api/v1/alert/{alertId}/attachment/{attachmentId}
   • ⚠ GET /api/v1/alert/{alertId}/attachment/{attachmentId}/download
   • ⚠ GET /api/v1/case/{caseId}/attachment/{attachmentId}
   • ⚠ GET /api/v1/case/{caseId}/attachment/{attachmentId}/download
   • ⚠ GET /api/v1/case/{caseId}/links
   • ⚠ GET /api/v1/log/{caseId}/attachment/{attachmentId}
   • ⚠ GET /api/v1/log/{logId}/attachment/{attachmentId}/download
   └──▷ BREAKING ON UPGRADE

   • !Deprecated endpoint DELETE /api/v1/user/{userId} (still works)
   • !Deprecated endpoint GET /api/v1/alert/{alertId}/attachment/{attachmentId} (still works)
   • !Deprecated endpoint GET /api/v1/alert/{alertId}/attachment/{attachmentId}/download (still works)
   • !Deprecated endpoint GET /api/v1/case/{caseId}/attachment/{attachmentId} (still works)
   • !Deprecated endpoint GET /api/v1/case/{caseId}/attachment/{attachmentId}/download (still works)
   • !Deprecated endpoint GET /api/v1/case/{caseId}/links (still works)
   • !Deprecated endpoint GET /api/v1/log/{caseId}/attachment/{attachmentId} (still works)
   • !Deprecated endpoint GET /api/v1/log/{logId}/attachment/{attachmentId}/download (still works)
5. 4.1.22 Jul 1, 2022 · release notes

   Adds user role checks to ensure proper authorization for actions

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.1.22 https://github.com/TheHive-Project/TheHive.git
   # already have the repo? check out this version:
   $ git checkout 4.1.22

   └──▷ HOW TO FIND IT
   Ensures that only users with specific roles (e.g., Alert, Project Manager) can trigger sensitive actions via the API or UI.
   📍N/A - This is an internal enforcement mechanism applied automatically to existing endpoints.
   • Adds runtime validation of the current user's role before allowing access to protected endpoints and actions.

   1 detail in Everything

6. 4.1.20 May 16, 2022 · release notes

   TheHive 4.1.20 adds observable filtering by parent object and analyzer operation acceptance.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.1.20 https://github.com/TheHive-Project/TheHive.git
   # already have the repo? check out this version:
   $ git checkout 4.1.20

   • Add queries to filter observables based on the type of object it belongs to
   • Accept operations in analyzer reports

   2 details in Everything

7. 4.1.19 Apr 7, 2022 · release notes

   TheHive 4.1.19 adds an SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. bypass option and improves logging.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.1.19 https://github.com/TheHive-Project/TheHive.git
   # already have the repo? check out this version:
   $ git checkout 4.1.19

8. 4.1.17 Jan 24, 2022 · release notes

   TheHive 4.1.17 enhances migration compatibility and resolves operational bugs

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.1.17 https://github.com/TheHive-Project/TheHive.git
   # already have the repo? check out this version:
   $ git checkout 4.1.17

   └──▷ HOW TO FIND IT
   Migrate data from an older TheHive instance during an upgrade.
   📍Run the built-in migration tool which now accepts legacy version inputs
   • Improves the migration tool to accept older versions of TheHive, easing upgrade paths from legacy deployments

   1 detail in Everything

9. 4.1.16 Dec 20, 2021 · release notes

   TheHive 4.1.16 adds hash fallback for large observables and removes persistent filters on Similar Cases.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.1.16 https://github.com/TheHive-Project/TheHive.git
   # already have the repo? check out this version:
   $ git checkout 4.1.16

   • When observable data is too large to display inline, TheHive now displays the object's hash instead of the full content
   • Removes persistent filter state from the Similar Cases tab, resetting the view on navigation

   2 details in Everything

10. 4.1.15 Dec 9, 2021 · release notes

    TheHive 4.1.15 adds audit query for objects and observable-based alert sorting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.15 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.15

    • Adds the ability to retrieve the audit history for a specific object via a new query capability
    • Enables sorting similar Alerts by their Observables within the interface

    2 details in Everything

11. 4.1.14 Nov 22, 2021 · release notes

    TheHive 4.1.14 adds org/user params to Analyzers and an API endpoint for observable type changes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.14 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.14

    └──▷ USE IT
    Pass specific user and org context when invoking analyzers via API.
    code copy

    POST /api/analyzers/run
    {
      "observable": "...",
      "user": "analyst1",
      "org": "acme"
    }

    Use the new observable type change endpoint to reclassify data.
    shell copy

    curl -X PUT /api/observable/{id}/type \
      -H 'Authorization: Bearer <token>' \
      -d '{"type": "new_type"}'

    • Adds user and org parameters to the Analyzers request interface so analyzers can operate within a specific user or organization context.
    • Adds sort capability on the Profile field in the organizations users list UI.
    • Adds an API endpoint to change an observable from one type to another.

    3 details in Everything

12. 4.1.13 Nov 12, 2021 · release notes

    TheHive 4.1.13 adds an API endpoint to link alerts and cases after migration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.13 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.13

    • Adds an API endpoint to link an alert to an existing case
    • Allows slash characters in attachment filenames

    2 details in Everything

13. 4.1.11 Oct 7, 2021 · release notes

    Adds the ability to update an observable's type after creation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.11 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.11

14. 4.1.9 Jul 23, 2021 · release notes

    Adds a button to trigger index rebuilding in the UI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.9 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.9

15. 4.1.7 Jul 5, 2021 · release notes

    TheHive 4.1.7 adds a force flag to copy databases regardless of schema mismatches

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.7 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.7

    └──▷ TRY IT
    Perform a database copy despite schema version mismatches by specifying the force option.
    copy

    $ thehive copy-db --force

    • force flag allows copying the database even when schema versions do not match

    1 detail in Everything

16. 4.1.6 Jun 15, 2021 · release notes

    TheHive 4.1.6 adds an API to repair the database

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.6 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.6

17. 4.1.5 Jun 3, 2021 · release notes

    TheHive 4.1.5 adds alert updatable fields, org name in responders, database copy tool, and API/integrity enhancements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.5 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.5

    • Alerts now support an updatableFields array to control which fields can be modified via API/CLI
    • Responder responses now include the organisation name in their data structure
    • API v1 receives improvements for better stability and feature set
    • Integrity checks are improved to provide more reliable database validation

    4 details in Everything

18. 4.1.4 Apr 15, 2021 · release notes

    Adds sorting to case templates in alert Import dropdown and makes alert deletion more robust.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.4 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.4

    • Sort case templates in the alert Import drop down menu so they are easier to find

    1 detail in Everything

19. 4.1.3 Apr 12, 2021 · release notes

    TheHive 4.1.3 adds environment file support for service startup and optimises the Imported alert property index.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.3 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.3

    • Adds environment file support in service to allow loading configuration from .env
    • Displays case templates in alphabetic order in New case menu

    2 details in Everything

20. 4.1.2 Mar 29, 2021 · release notes

    Adds case search by TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. via the case API

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.2 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.2

    └──▷ TRY IT
    Find all open cases involving lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. (Tactic: Lateral Movement)
    copy

    $ curl -X POST "http://thehive-host/api/case/_search" -H 'Content-Type: application/json' -d '{ "query": { "bool": { "must": [{"term": {"status": "open"}}], "filter": [{"terms": {"ttp": ["TA0008"]}] } } }, "size": 10 }'

    • POST /api/case/_search now supports a ttp filter parameter to search cases by MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tactics or techniques.

    1 detail in Everything

21. 4.1.1 Mar 23, 2021 · release notes

    TheHive 4.1.1 adds organisation ID to webhook payloads.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.1 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.1

    • Webhooks now include the organisationId field in their JSON payload.

    1 detail in Everything

22. 4.1.0 Mar 19, 2021 · release notes

    TheHive 4.1.0 adds case merging, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. support, authentication in webhooks, disk usage API, and bulk case actions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.0 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.1.0

    └──▷ TRY IT
    Check disk usage metrics programmatically.
    copy

    $ curl -H 'Authorization: Bearer <API_KEY>' https://<hive>/api/v1/disk/usage

    Configure webhooks with authentication credentials.
    📍Steps: In the UI, go to Settings › Webhooks and configure the new authentication fields for your webhook endpoints.
    • Adds merge functionality to combine cases, closing the newest as duplicated
    • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. support for tactical mapping
    • Enriches v1 API capabilities
    • Adds migration path from TheHive 3.5.1 to 4.1.0

    4 details in Everything

23. 4.0.5 Feb 8, 2021 · release notes

    TheHive 4.0.5 adds asterisk support to tag filtering and exposes schema update status via the status API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.5 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.0.5

    • Tag filtering now supports asterisks for wildcard matching (e.g., alert-*)
    • Status API includes schema update status information

    2 details in Everything

24. 4.0.4 Jan 12, 2021 · release notes

    TheHive 4.0.4 adds alert observables API endpoints and import duration properties

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.4 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.0.4

    • Adds new alert observable API endpoints
    • Adds importDate property to the Alert type for tracking when alerts were imported
    • Adds handling duration properties (handlingDurationStart, handlingDurationEnd) to the Alert type

    3 details in Everything

25. 4.0.3 Dec 22, 2020 · release notes

    Adds actionRequired flag to tasks and S3 attachment storage enhancements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.3 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.0.3

    • Added actionRequired field for tasks to distinguish urgent actions
    • Added pollDuration configuration option for the UI Stream polling interval

    2 details in Everything

26. 4.0.2 Nov 20, 2020 · release notes

    TheHive 4.0.2 adds a dedicated permission for TheHiveFS access and normalizes editable input fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.2 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.0.2

    • [feature] Add a dedicated permission to give access to TheHiveFS
    • [feature] Normalize editable input fields

    2 details in Everything

27. 4.0.1 Nov 13, 2020 · release notes

    TheHive 4.0.1 adds Cortex notifiers to the notification system, share properties, and API key access in user settings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.1 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.0.1

    • Adds properties related to share for cases and alerts
    • Updates user settings view to give access to API key

    2 details in Everything

28. 3.5.0-RC1 Prerelease Sep 15, 2020 · release notes

    TheHive 3.5.0-RC1 adds MISP sync and ElasticSearch 7 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.5.0-RC1 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.5.0-RC1

    • Adds MISP synchronization capability to integrate with MISP platforms
    • Adds support for ElasticSearch 7 as the underlying search engine

    2 details in Everything

29. 4.0.0 Jul 24, 2020 · release notes

    TheHive 4.0.0 adds bulk case editing, task inclusion in case creation API, and UI enhancements for user management.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.0 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.0.0

    └──▷ USE IT
    Create a new case and immediately attach initial investigation tasks in one API call.
    shell copy

    curl -X POST 'http://<host>:9000/api/case' \
      -H 'Authorization: Simple <token>' \
      -H 'Content-Type: application/json' \
      -d '{
        "title": "New Incident",
        "severity": 2,
        "tasks": [
          {
            "name": "Analysis",
            "description": "Initial triage"
          }
        ]
      }'

    Use the UI to edit case statuses or tags for multiple selected cases simultaneously.
    📍In the Cases view, select multiple rows and click Bulk Edit in the toolbar.
    • Adds ability to include tasks during case creation via the POST /api/case API endpoint
    • Adds bulk edit functionality for cases directly from the cases list view
    • Replaces responder selection dropdown with a dedicated modal selector window in the UI
    • Adds pagination and username-based sorting to the user management list screen

    4 details in Everything

30. 4.0.0-RC3 Prerelease May 28, 2020 · release notes

    TheHive 4.0.0-RC3 adds multi-org support, case sharing UI, enriched API auth response, and query enrichment

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.0-RC3 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.0.0-RC3

    • Allow users to be part of multiple organisations
    • Show case sharing information on main case overview page
    • Authentication API returns user information in its response
    • Enrich queries with additional context or fields

    4 details in Everything

31. 4.0.0-RC2 Prerelease May 27, 2020 · release notes

    TheHive 4.0-RC2 adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. support, webhooks, shared case display, custom severities, responder output details, and case age info.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.0-RC2 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 4.0.0-RC2

    • Add support to multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.
    • Custom severity levels for alerts and cases
    • A (received) Shared Case is displayed as sender/owner
    • Providing output details for Responders

    4 details in Everything

32. 3.4.2 May 7, 2020 · release notes

    TheHive 3.4.2 adds output details for Responders via issue #962.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.2 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.4.2

    • Responders now provide output details to capture results.

    1 detail in Everything

33. 3.4.1 May 6, 2020 · release notes

    TheHive 3.4.1 adds OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. support and MISP to_ids mapping

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.1 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.4.1

    └──▷ TRY IT
    Configure MISP sync to preserve IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. status by mapping the correct field.
    copy

    $ Map MISP `to_ids` fields to TheHive's `ioc` observable type during synchronization

    • Improved support for OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. connect and OAuth2
    • Map MISP to_ids fields to TheHive's ioc observable type during synchronization

    2 details in Everything

34. 3.4.0-RC2 Prerelease Jul 11, 2019 · release notes

    TheHive 3.4.0-RC2 adds IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. sighting display and observable tag merging to the UI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.0-RC2 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.4.0-RC2

    • Adds visibility of sighted attributes for IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. in the Alert artifact list
    • Merges Observable tags with existing observables during alert import into a case

    2 details in Everything

35. 3.4.0-RC1 Prerelease Jun 5, 2019 · release notes

    TheHive 3.4.0-RC1 adds Cortex integration actions and ElasticSearch 6.x support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.0-RC1 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.4.0-RC1

    • Adds Cortex AddArtifactToCase and AssignCase actions
    • Supports connecting to Elasticsearch 6.x clusters via HTTP API port 9200
    • Allows importing files directly from Cortex reports

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The metrics module has been removed
36. 3.3.0-RC6 Prerelease Mar 27, 2019 · release notes

    Adds ability to append tags to alerts via Responder and adds text widget to Dashboards

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.0-RC6 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.3.0-RC6

    └──▷ HOW TO FIND IT
    Use the Responder to triage an alert and tag it for further investigation without leaving the response context.
    📍Steps: Open the Alert in TheHive UI › Click Respond › Locate the Tags field in the responder panel › Enter or select desired tags › Submit response.
    Customize a dashboard view by inserting explanatory text, instructions, or status updates using the new widget type.
    📍Steps: Navigate to Dashboard › Click Add Widget › Select Text from the widget list › Enter desired content in the editor › Save widget.
    • Allows responders to add tags directly when responding to an alert
    • Dashboards now include a text widget for adding custom content

    2 details in Everything

37. 3.3.0-RC5 Prerelease Feb 23, 2019 · release notes

    Adds mouseover tooltips to the alert preview for better context

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.0-RC5 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.3.0-RC5

    └──▷ HOW TO FIND IT
    View additional details about an alert without leaving the preview pane by hovering over the elements.
    📍Hover over any element in the TheHive alert preview UI
38. 3.3.0-RC3 Prerelease Feb 21, 2019 · release notes

    TheHive 3.3.0-RC3 adds a UI configuration admin section and MISP link integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.0-RC3 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.3.0-RC3

    • Adds a UI configuration admin section for managing instance settings directly in the dashboard.
    • Adds a Related Alerts link to the case details view for quick navigation to linked alerts.

    2 details in Everything

39. 3.3.0-RC1 Prerelease Feb 18, 2019 · release notes

    TheHive 3.3.0-RC1 adds MISP event tagging, alert sorting, bulk merge, and Java >8 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.0-RC1 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.3.0-RC1

    • MISP integration now supports Event Tag in addition to or instead of Attribute Tag for richer context association.
    • alerts list view gains configurable sorting capability to order alerts by fields such as created date or severity.
    • Bulk Merge Alerts into Case feature allows selecting multiple alerts and merging them directly into an existing case in one operation.
    • Support for Java versions higher than 8 is added, enabling deployment on modern JDKs.

    4 details in Everything

40. 3.1.1 Oct 12, 2018 · release notes

    TheHive 3.1.1 adds custom root context support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.1 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.1.1

41. 3.1.0 Sep 25, 2018 · release notes

    TheHive 3.1.0 adds CloseTask and AddTagToArtifact responder actions and new custom field support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.0 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.1.0

    • Adds CloseTask as a new responder operation to automatically close tasks upon execution

    1 detail in Everything

42. 3.0.10 Jun 8, 2018 · release notes

    TheHive 3.0.10 adds log rotation, Cortex caseId passing, connector status polling, and task time calculation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.10 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.0.10

    • Adds log rotation to reduce disk usage over time
    • Passes caseId to Cortex analyzer requests for better context
    • Polls for connector status and displays the result in the UI
    • Sorts related cases by the number of related artifacts amount
    • Calculates time for individual tasks

    5 details in Everything

43. 3.0.6 Apr 3, 2018 · release notes

    Adds Cortex 2 compatibility for TheHive

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.6 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.0.6

    • Add compatibility with Cortex 2

    1 detail in Everything

44. 3.0.7 Apr 3, 2018 · release notes

    TheHive 3.0.7 adds a new endpoint to delete cases and fixes case template saving

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.7 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.0.7

45. 3.0.4 Mar 23, 2018 · release notes

    TheHive 3.0.4 introduces OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and improved MISP integration filtering capabilities for cyber tooling workflows.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.4 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.0.4

46. 3.0.2 Mar 23, 2018 · release notes

    TheHive 3.0.2 adds multi-entity graphing to dashboards and ElasticSearch authentication configuration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.2 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.0.2

    • Adds support for multiline and multi-entity graphs in dashboards

    1 detail in Everything

47. 3.0.0 Dec 5, 2017 · release notes

    TheHive 3.0 adds case template import/export, dynamic dashboards, webhooks, and MISP TLP export

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0

    • Adds the ability to Import and Export Case Templates via API endpoints.
    • Introduces a sighted flag for Indicators of Compromise (IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself.).
    • Adds Webhooks as a new integration mechanism for event notifications.
    • Enables dynamic dashboards that update automatically based on case data.
    • Adds Export Statistics/Metrics capability with the ability to download dashboard data.

    +1 more show less

    • Integrates MISP export functionality that includes Traffic Light Protocols (TLP) tags.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The deprecated user property is removed from the API/response schema.
48. 2.13.0 Sep 15, 2017 · release notes

    TheHive 2.13 adds webhook support, Stream API auth, fine-grained API permissions, and MISP event export

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.13.0 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 2.13.0

    • Adds basic support for webhooks to send case updates to external systems
    • Adds basic authentication to the Stream API endpoint
    • Enables fine-grained user permissions for API access via group-based ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.
    • Supports multiple Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. servers in application.conf configuration
    • Adds ability to export existing cases as MISP events through the UI/API

    5 details in Everything

49. 2.12.0 Jul 5, 2017 · release notes

    TheHive 2.12.0 adds ability to reopen tasks, custom case template fields, and MISP import template selection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.12.0 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 2.12.0

    └──▷ HOW TO FIND IT
    Resume an already-closed task within a case to continue investigation.
    📍steps: In the Task view, click the Reopen action button on the completed task card.
    Extend case templates with additional data fields for custom tracking.
    📍steps: In Case Template settings, add custom field definitions to your template schema.
    Select a specific case template when ingesting alerts from MISP.
    📍steps: During the MISP event import workflow, select your desired case template from the dropdown menu before confirmation.
    • Adds Ability to Reopen Tasks to manage task lifecycle in cases
    • Introduces Custom fields for case template to extend case structures
    • Enables Choose case template while importing events from MISP during ingestion

    3 details in Everything

50. 2.11.2 May 24, 2017 · release notes

    TheHive 2.11.2 adds observables status distinction, alert description preview, and case severity in lists

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.11.2 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 2.11.2

    └──▷ HOW TO FIND IT
    Quickly identify which observables have already been processed by Cortex analyzers when viewing an alert.
    📍In the case view, check the Observable list for visual cues distinguishing analyzed vs non-analyzed items.
    Review alert details before creation without navigating away from the preview screen.
    📍In the Alert Preview Modal, locate and read the new Description Field.
    Assess threat levels at a glance when browsing multiple cases.
    📍View the list of cases and observe the severity indicator now displayed in each row.
    • Adds visual distinction between analyzed and non-analyzed observables in the UI
    • Adds Description Field to Alert Preview Modal
    • Shows case severity directly in list views

    3 details in Everything

51. 2.11.1 May 17, 2017 · release notes

    Adds observable report counts and duplicate task merging to case merges

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.11.1 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 2.11.1

    └──▷ HOW TO FIND IT
    See how many reports are linked to a specific observable directly in the UI list.
    📍Navigate to an observable view in TheHive to see the report count displayed.
    When merging two cases, duplicate tasks are now consolidated automatically.
    📍Use the Merge Cases action in TheHive to combine duplicate task entries.
    • Show available reports number for each observable
    • Merge Duplicate Tasks during Case Merge

    2 details in Everything

52. 2.11.0 May 12, 2017 · release notes

    TheHive 2.11.0 introduces the alerting framework, .deb/.rpm packaging, Cortex proxy/basic auth support, and case template API

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.11.0 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 2.11.0

    • Implements the alerting framework feature to allow external event ingestion
    • Add support for .deb and .rpm package generation for easier deployment
    • Displays logos of integrated external services on the UI
    • Adds pagination component at the top of all data lists
    • Shows severity on the Cases Page UI

    +8 more show less

    • Improves logs browsing performance and UI
    • Refreshes the UI's skin
    • Updates datalist filter previews to display meaningful values
    • Sorts the list of report templates
    • Adds support for case templates in the back-end API
    • Allows filtering MISP import events
    • Disables field autocomplete on the login form
    • Enables autocomplete for tags

    13 details in Everything

53. 2.10.2 Apr 18, 2017 · release notes

    TheHive 2.10.2 adds bulk analyzer execution from observables view, CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. protection, and task viewing persistence.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.10.2 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 2.10.2

    └──▷ HOW TO FIND IT
    Bulk run analyzers on selected observables directly from the UI to accelerate triage.
    📍1. Navigate to an Observable list in TheHive console. 2. Select multiple observables. 3. Choose Run all analyzers from the context menu.
    • Add CSRF protection to prevent cross-site request forgerycross-site request forgeryCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. attacks
    • Persistence for task viewing options saves user UI preferences across sessions
    • Run all analyzers on multiple observables from the observables view

    3 details in Everything

54. 2.10.0 Feb 1, 2017 · release notes

    TheHive 2.10.0 introduces changeable case owners and externalized observable analysis

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.10.0 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 2.10.0

    • Allows changing the owner of an existing case via UI or API
    • Externalizes observable analysis logic for better modularity
    • Adds OTXOTXAlienVault's Open Threat Exchange, a community platform where researchers share indicators of compromise; cyber tools integrate it to pull live threat intelligence feeds without building their own collection infrastructure. (Open Threat Exchange) analyzer integration

    3 details in Everything

55. 2.9.1 Nov 28, 2016 · release notes

    TheHive 2.9.1 adds a MaxMind analyzer with Short Report support and prevents importing deleted/merged MISP cases

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.9.1 https://github.com/TheHive-Project/TheHive.git
    # already have the repo? check out this version:
    $ git checkout 2.9.1

    • Updates MISP integration logic to skip import for cases where the source event is deleted or merged

    1 detail in Everything