https://cybertoolchain.io/tools/thehive New releases and features in TheHive, tracked by The Cyber Toolchain. en Fri, 23 Oct 2026 08:05:05 GMT https://docs.strangebee.com/thehive/api-docs/docs.yaml https://docs.strangebee.com/thehive/api-docs/docs.yaml Fri, 23 Oct 2026 08:05:05 GMT API surface changed: +2 endpoints, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v1/caseReportTemplate/{caseReportTemplateId}/export⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint POST /api/v1/caseReportTemplate/import Full history on Cyber Toolchain: https://cybertoolchain.io/tools/thehive https://docs.strangebee.com/thehive/api-docs/docs.yaml https://docs.strangebee.com/thehive/api-docs/docs.yaml Mon, 14 Sep 2026 14:36:11 GMT API surface changed: +2 endpoints, −18 endpoints, 16 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v1/responder-execution/{scope}/{rootId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v1/responder-execution/{scope}/{rootId}/count Breaking changes: • Removed endpoint GET /api/v1/admin/check/stats • Removed endpoint GET /api/v1/admin/index/status • Removed endpoint GET /api/v1/admin/stats • Removed endpoint GET /api/v1/caseReport/formats • Removed endpoint GET /api/v1/connector/cortex/action/{entityType}/{entityId} • Removed endpoint GET /api/v1/stream/{streamId} • Removed endpoint POST /api/v1/admin/check/cancel • Removed endpoint POST /api/v1/admin/check/{name}/dedup/trigger • Removed endpoint POST /api/v1/admin/check/{name}/global/trigger • Removed endpoint POST /api/v1/admin/index/{name}/rebuild • Removed endpoint POST /api/v1/admin/index/{name}/reindex • Removed endpoint POST /api/v1/admin/schema/info/{schemaName} • Removed endpoint POST /api/v1/admin/schema/repair/{schemaName} • Removed endpoint POST /api/v1/connector/cortex/job/_bulk • Removed endpoint POST /api/v1/stream • Removed endpoint POST /api/v1/user/{userId}/login/set • Removed endpoint PUT /api/v1/admin/check/_all/trigger • Removed endpoint PUT /api/v1/admin/check/{name}/trigger Full history on Cyber Toolchain: https://cybertoolchain.io/tools/thehive https://docs.strangebee.com/thehive/api-docs/docs.yaml https://docs.strangebee.com/thehive/api-docs/docs.yaml Tue, 04 Aug 2026 11:12:00 GMT API surface changed: 8 deprecated Breaking changes: • Deprecated endpoint DELETE /api/v1/user/{userId} (still works) • Deprecated endpoint GET /api/v1/alert/{alertId}/attachment/{attachmentId} (still works) • Deprecated endpoint GET /api/v1/alert/{alertId}/attachment/{attachmentId}/download (still works) • Deprecated endpoint GET /api/v1/case/{caseId}/attachment/{attachmentId} (still works) • Deprecated endpoint GET /api/v1/case/{caseId}/attachment/{attachmentId}/download (still works) • Deprecated endpoint GET /api/v1/case/{caseId}/links (still works) • Deprecated endpoint GET /api/v1/log/{caseId}/attachment/{attachmentId} (still works) • Deprecated endpoint GET /api/v1/log/{logId}/attachment/{attachmentId}/download (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/thehive https://github.com/TheHive-Project/TheHive/releases/tag/4.1.22 https://github.com/TheHive-Project/TheHive/releases/tag/4.1.22 Fri, 01 Jul 2022 15:00:56 GMT Adds user role checks to ensure proper authorization for actions • Adds runtime validation of the current user's role before allowing access to protected endpoints and actions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/thehive https://github.com/TheHive-Project/TheHive/blob/HEAD/CHANGELOG.md https://github.com/TheHive-Project/TheHive/blob/HEAD/CHANGELOG.md Mon, 16 May 2022 00:00:00 GMT TheHive 4.1.20 adds observable filtering by parent object and analyzer operation acceptance. • Add queries to filter observables based on the type of object it belongs to • Accept operations in analyzer reports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/thehive https://github.com/TheHive-Project/TheHive/blob/HEAD/CHANGELOG.md https://github.com/TheHive-Project/TheHive/blob/HEAD/CHANGELOG.md Thu, 07 Apr 2022 00:00:00 GMT TheHive 4.1.19 adds an SSL bypass option and improves logging. • Adds an SSL bypass option for migration from TheHive 3. • Improves logging. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/thehive https://github.com/TheHive-Project/TheHive/blob/HEAD/CHANGELOG.md https://github.com/TheHive-Project/TheHive/blob/HEAD/CHANGELOG.md Mon, 24 Jan 2022 00:00:00 GMT TheHive 4.1.17 enhances migration compatibility and resolves operational bugs • Improves the migration tool to accept older versions of TheHive, easing upgrade paths from legacy deployments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/thehive https://github.com/TheHive-Project/TheHive/releases/tag/4.1.16 https://github.com/TheHive-Project/TheHive/releases/tag/4.1.16 Mon, 20 Dec 2021 07:08:59 GMT TheHive 4.1.16 adds hash fallback for large observables and removes persistent filters on Similar Cases. • When observable data is too large to display inline, TheHive now displays the object's hash instead of the full content • Removes persistent filter state from the "Similar Cases" tab, resetting the view on navigation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/thehive https://github.com/TheHive-Project/TheHive/releases/tag/4.1.15 https://github.com/TheHive-Project/TheHive/releases/tag/4.1.15 Thu, 09 Dec 2021 10:20:06 GMT TheHive 4.1.15 adds audit query for objects and observable-based alert sorting • Adds the ability to retrieve the audit history for a specific object via a new query capability • Enables sorting similar Alerts by their Observables within the interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/thehive https://github.com/TheHive-Project/TheHive/releases/tag/4.1.14 https://github.com/TheHive-Project/TheHive/releases/tag/4.1.14 Mon, 22 Nov 2021 10:20:10 GMT TheHive 4.1.14 adds org/user params to Analyzers and an API endpoint for observable type changes • Adds `user` and `org` parameters to the Analyzers request interface so analyzers can operate within a specific user or organization context. • Adds sort capability on the `Profile` field in the organizations users list UI. • Adds an API endpoint to change an observable from one type to another. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/thehive https://github.com/TheHive-Project/TheHive/releases/tag/4.1.13 https://github.com/TheHive-Project/TheHive/releases/tag/4.1.13 Fri, 12 Nov 2021 10:05:06 GMT TheHive 4.1.13 adds an API endpoint to link alerts and cases after migration. • Adds an API endpoint to link an alert to an existing case • Allows slash characters in attachment filenames Full history on Cyber Toolchain: https://cybertoolchain.io/tools/thehive