Skip to content

Installation & configuration guides#


TheHive can be deployed on a standalone server or as a cluster. The application relies on:

Apache Cassandra to store data (Supported version: 4.x).

Elasticsearch as indexing engine (Supported version: 7.x).

A file storage solution is also required ; the local filesystem of the server hosting the application is adequate in the standalone server scenario ; S3 MINIO otherwise.

Using Lucene

Starting with TheHive 5.x we strongly recommend using Elasticsearch for production servers. TheHive 4.1.x embbeded Lucene to handle the data index ; this is still the case with the latest version with which we suggest to use it only for testing purpose.


Hardware requirements depends on the number of concurrent users (including integrations) and how they use the system. The following table diplays safe thresholds when hosting all services on the same machine:

Number of users TheHive Cassandra ElasticSearch
< 10 2 / 2 GB 2 / 2 GB 2 / 2 GB
< 20 2-4 / 4 GB 2-4 / 4 GB 2-4 / 4 GB
< 50 4-6 / 8 GB 4-6 / 8 GB 4-6 / 8 GB

Operating systems#

TheHive has been tested and is supported on the following operating systems:

  • Ubuntu 20.04 LTS
  • Debian 11
  • RHEL 8
  • Fedora 35

StrangeBee also provides an official Docker image.

Installation guides#

Too much in a hurry to read ?

If you are using one of the supported operating systems, use our all-in-one installation script:

  • Using Ubuntu or Debian
sudo -v ; wget -q -O /tmp/ ; bash /tmp/
  • Using RHEL or Fedora
sudo -v ; wget -q -O /tmp/ ; bash /tmp/

For each release, DEB, RPM and ZIP binary packages are built and provided. Discover how to install TheHive quickly by following our installation guides:

Use a dedicated server#

TheHive can be used on virtual or physical servers.

Our step-by-step guide let you prepare, install and configure TheHive and its prerequisites for Debian and RPM packages based Operating Systems, as well as for other systems and using our binary packages.

Use Docker #

An Official Docker image publicly available. Follow our installation guide for Docker to use it in production.

Use Kubernetes #

TheHive is now compatible with Kubernetes - follow the related guide here.

Configuration Guides#

The configuration files are stored in the /etc/thehive folder:

  • application.conf contains all parameters and options
  • logback.xml is dedicated to log management
├── application.conf
├── logback.xml
└── secret.conf

A separate secret.conf file is automatically created by DEB or RPM packages. This file contains a secret that should be used by one instance.

The configuration should only contain the necessary information to start the application:

All other settings are available in the application WebUI.

Advanced uses cases#

Upgrade from TheHive 4.x (standalone server)#


Can I upgrade from TheHive 4.0.x ?#

Yes, all TheHive 4.x can be updated to TheHive 5; the documentation is coming soon!

I use TheHive 3.x, can I upgrade my data to TheHive 5 ?#

TheHive 3 is out of support since 31 December 2021. Please contact StrangeBee for further assistance. __

TheHive as a cluster#

Install a cluster with 3 nodes#

If you are looking to install a cluster (fault tolerant, H.A., ...), the following guide details all the installation and configuration steps to make a cluster with 3 nodes working. In this example, the cluster is composed of:

  • 3 TheHive nodes
  • 3 Cassandra nodes
  • 3 Elasticsearch nodes
  • 3 Min.IO nodes

Upgrade a cluster#

Upgrade a cluster

Update from TheHive 3.x#

TheHive 3.x is not supported any more since 31st of December, 2021.

Contact StrangeBee for further assistance at

Back to top