TheHive Glossary

Key terms and concepts used in TheHive.

Terms are listed alphabetically.

Activities

See Task log.

Alert

A security event notification generated by external detection tools (SIEM, IDS, EDR, firewalls) or threat intelligence platforms that requires triage. During triage, alerts can be converted into cases for investigation, merged with existing cases, or closed if not actionable.

See About Alerts for more details.

Alert feeder

A connector that periodically retrieves data from an external HTTP REST API on a schedule and converts it into alerts using a TheHive function. Alert feeders enable pull-based data ingestion from services without requiring those systems to push data. In addition to alerts, feeders can also generate cases and tasks.

See About Alert Feeders for more details.

Analyzer

A Cortex component that performs automated analysis on observables to extract additional information, identify threats, or enrich data. Analyzers can query threat intelligence platforms, perform malware analysis, or execute other investigative tasks and return results to TheHive.

See About Cortex for more details.

Attachment

A file associated with an organization, a case, or an alert, including documents embedded in descriptions or manually uploaded. Attachments store evidence, reports, screenshots, and other files relevant to investigations.

See About Attachments for more details.

Audit log

A comprehensive record of all user actions performed within TheHive, including create, update, delete, merge, and function invocation operations. Audit logs ensure full traceability for compliance, security monitoring, and can trigger workflow automation in SOAR platforms like TheHive Flow.

See About Audit Logs for more details.

Case

An investigation container that organizes all information related to a security incident, including tasks, observables, TTPs, and attachments. Cases progress through statuses as investigations advance.

See About Cases for more details.

Case template

A predefined structure that streamlines case creation by automatically populating fields. Templates ensure consistency across investigations and reduce manual effort when responding to similar incident types.

See About Case Templates for more details.

Cassandra

A distributed NoSQL database used by TheHive to store application data. Cassandra provides scalability, high availability, and fault tolerance for production deployments across multiple nodes.

See TheHive Architecture to understand how it integrates with other services.

Cortex

An open-source security platform that integrates with TheHive to provide analyzers and responders for automated investigation and response actions.

See About Cortex for more details.

Custom field

A field extension that allows teams to record additional information beyond default case and alert attributes. Custom fields can be required or optional, free text or predefined values, and support various data types.

See About Custom Fields for more details.

Dashboard

A customizable interface that displays aggregated data and metrics using a collection of widgets. Dashboards enable teams to monitor security posture and track key performance indicators.

See About Dashboards for more details.

Elasticsearch

A search engine used by TheHive to index and enable fast full-text searching across application data. Elasticsearch powers the platform's search functionality and dashboard queries, and can also store audit logs for high-volume environments.

See TheHive Architecture to understand how it integrates with other services.

Endpoint

An entry point for system integration that can be configured at two levels: local endpoints are defined at the organization level for organization-specific integrations, while global endpoints are defined at the platform level and available across all organizations. Endpoints define connection details for specific notifiers, including webhook, HTTP requests, and messaging tools.

See About Endpoints for more details.

Function

A controlled JavaScript code block that runs securely within TheHive to automate operations, process data, and integrate external applications. Functions can be triggered by user actions, schedules, notifications, or external systems, and have access to TheHive API for creating and manipulating data.

See About Functions for more details.

Indicator of compromise (IOC)

An observable that has been identified as linked to suspicious or malicious activity.

See About Observables for more details.

Malware information sharing platform (MISP)

A threat intelligence platform that integrates with TheHive to retrieve security events and share threat data. TheHive includes MISP taxonomies by default and can automatically retrieve events from MISP servers, converting them into alerts. Users can also export cases to MISP, sharing observables marked as IOCs with the threat intelligence community.

See About MISP Integration for more details.

MITRE ATT&CK

A knowledge base framework that documents adversary tactics, techniques, and procedures based on real-world observations. TheHive includes the MITRE Enterprise Matrix by default and uses it to categorize TTPs.

Network file system (NFS)

A distributed file system protocol that allows TheHive nodes to share file storage across a network. NFS is one of the storage solutions for cluster environments, alongside S3-compatible object storage services like SeaweedFS.

See TheHive Architecture to understand how it integrates with other services.

Notification

An automation configuration that triggers actions when specific events occur within an organization. A notification consists of a single trigger that defines the activating event, such as case creation or alert assignment, and one or more notifiers that specify the actions to take, such as sending emails, making HTTP requests, or executing functions.

See About Notifications for more details.

Observable

An artifact or piece of evidence collected during an investigation, such as IP addresses, domain names, file hashes, email addresses, or URLs. Observables can be marked as IOC or sighted, analyzed for enrichment, and used to identify similar cases and alerts through automatic correlation.

See About Observables for more details.

Organization

A tenant within TheHive, such as a division or a business unit, that uses the platform independently. Organizations enable multi-tenancy by isolating data from other organizations, though they can be linked to enable data sharing when needed.

See About Organizations for more details.

Permissible actions protocol (PAP)

A classification system that defines what actions can be taken with shared information. PAP levels control how data can be processed and used, complementing TLP's distribution controls.

Profile

A set of permissions assigned to a user account within an organization that determines what actions users can perform.

See About Profiles for more details.

Responder

A Cortex component that performs automated response actions on cases, alerts, tasks, task logs, or observables. Responders can block IP addresses, send notifications, create tickets in external systems, quarantine files, or execute other remediation tasks.

See About Cortex for more details.

Sighted

A status applied to an observable when it has been observed in an environment, regardless of whether it's malicious.

See About Observables for more details.

Stage

A high-level lifecycle phase for cases and alerts. The four predefined stages—New, Imported, In progress, and Closed—are hard-coded and can't be modified. Each status is linked to one stage.

Status

The current state of a case or alert within a stage. Statuses can be customized, with each status linked to one of the four predefined stages: New, Imported, In progress, or Closed.

See About Statuses for more details.

Tactics, techniques, and procedures (TTPs)

Descriptions of the behaviors and methods commonly used by specific threat actors or groups. TheHive uses the MITRE ATT&CK framework by default.

See About TTPs for more details.

Tag

A label to categorize cases, alerts, and observables. Tags can be either taxonomy-based, which are standardized labels from imported taxonomies, or custom tags, which are free-text labels created manually by users or automatically by tools.

See About Tags for more details.

Task

An action item within a case that defines work that should be completed during an investigation. As work is performed, analysts document their progress in task logs. Tasks can be assigned to users, marked as mandatory or optional, and organize into groups.

See About Tasks for more details.

Task log

A recorded entry that documents work actually performed on a task, including actions taken, observations made, and decisions reached during an investigation. Task logs, also referred to as activities, create an audit trail of investigation progress and are required to mark mandatory tasks as completed.

See About Task Logs for more details.

Taxonomy

A structured classification system imported into TheHive to standardize tagging of cases, alerts, and observables. By default, TheHive includes MISP taxonomies that provide industry-standard labels.

See About Taxonomies for more details.

Timeline

A chronological view of all significant events during a case lifecycle, including alert creation, observable additions, task completions, and status changes. Custom events can be added to include additional entries in the timeline.

See About Case Timeline for more details.

Traffic light protocol (TLP)

A classification system that defines sensitivity and sharing restrictions for information. TLP levels control how data can be distributed and shared outside the organization, complementing PAP's action control.

Triage

The process of reviewing and prioritizing alerts to determine which require investigation. Triage outcomes include creating new cases, adding alerts to existing cases, or closing alerts as false positives or duplicates.

Webhook

An outbound HTTP callback mechanism configured as a notifier that sends real-time data from TheHive to external systems when specific events occur. Webhook notifiers require an endpoint that defines the destination URL and connection details for the external system.