Self-hosted incident response case management compared

Self-hosted incident response case management compared: which option fits which team

If your SOC or CSIRT must run case management inside your own infrastructure, pick DFIR-IRIS when you want a self-run case tool under LGPL-3.0 with a single-stack Docker Compose footprint, pick TheHive 5 when a commercial vendor and paid per-user tiers are acceptable, and pick Tracecat when case management should sit inside a broader automation platform. Each choice carries a caveat. TheHive 3 and TheHive 4 are no longer maintained or distributed, so any TheHive plan starts at version 5. The DFIR-IRIS v3 line is still beta, and its README says v3.0.0-beta.1 is not recommended for production, so plan around the v2.4.29 stable line, released on August 10, 2026.

TheHive 5 needs more infrastructure than the other two. A deployment runs TheHive, Apache Cassandra and Elasticsearch, each on the JVM with its own heap settings, and StrangeBee recommends 100 GB of storage for most use cases. On-premises Community use is free for 2 users, while Gold and Platinum are priced per user. Ask StrangeBee which tier covers your analyst count, how the Community license request works under version 5.3 and later, and what happens to read-only mode if a license lapses. Cortex, the analysis engine used with TheHive, needs no license and is AGPL-3.0. If MISP is already your sharing platform, TheHive can import MISP taxonomies, pull MISP events as alerts and export cases back to MISP. Confirm how your MISP version and distribution settings behave with that flow before you commit.

Tracecat fits teams that want case handling next to webhook-triggered workflows, structured tables and AI agents, and it documents Docker Compose, AWS ECS Fargate, Kubernetes and air-gapped Kubernetes deployments. Its core is AGPL-3.0, but multi-tenant workspaces, Git version control and the documented authentication and single sign-on features are Enterprise features. Check whether your identity requirements and your air-gapped plan depend on those features before you assume the open-source edition covers them. Tracecat 1.2.0 was released on October 16, 2026. Because it is a general automation platform, expect more design work to define your case workflows than you would need with a purpose-built case tool.

Which case management platform fits which scenario

This table maps common team situations to the platform that fits best, with the supplied fact behind each choice. Read each row as a starting point, since licensing terms, existing tooling and support needs in your own environment can change the answer and should be confirmed before you commit.

Scenario	Best fit	Reason and what to confirm
Small SOC with no paid budget	DFIR-IRIS	IRIS is licensed under LGPL-3.0 and has no paid tier in the supplied facts, with notes, tasks, evidence and a REST API included. Confirm that the community project meets your support expectations.
Small team that needs TheHive features	TheHive 5 Community	The Community plan is free for 2 users, so it only fits a very small group. Confirm the license request process after version 5.3, and plan for read-only mode if the trial or license lapses.
Regulated CSIRT that wants vendor support	TheHive 5 Gold or Platinum	StrangeBee sells Gold and Platinum plans priced per user, which is the paid route to vendor backing. Ask StrangeBee which support terms apply to your tier and whether they cover your deployment model.
Regulated team that needs a community-run tool with in-house support	DFIR-IRIS	IRIS is community-run and open source under LGPL-3.0, so support depends on your own staff or a services partner. Confirm that your assessors accept that support model and that you can maintain the stack.
Team already running MISP	TheHive 5 or DFIR-IRIS	TheHive imports MISP taxonomies and can turn MISP events into alerts. IRIS ships an IrisMISP module and enriches indicators from MISP inside the case. Test each connector against your MISP version and sharing groups.
Team that wants case handling tied to automation	Tracecat	Tracecat combines case management with webhook-triggered workflows, structured tables and custom actions synced from Git. Confirm which features you need are in the open-source edition, since multi-tenant management, Git version control integration and single sign-on are listed as Enterprise features.
Team that needs air-gapped or Kubernetes deployment	Tracecat	Tracecat documents an air-gapped Kubernetes deployment with no runtime internet access, alongside Docker Compose and Helm options. Confirm the deployment fits your network policy and that you can operate Temporal and PostgreSQL.
Team that wants a lightweight single-host stack	DFIR-IRIS	The IRIS Docker Compose stack runs six services, including PostgreSQL, RabbitMQ and an nginx TLS layer. Confirm your host capacity covers these services and that you can run upgrades on the stable v2.4 line, since v3.0.0-beta.1 is not recommended for production.
Team that expects a heavy data footprint	TheHive 5	A TheHive deployment runs Cassandra and Elasticsearch on the JVM, and StrangeBee recommends 100 GB of storage for most use cases. Ask for sizing guidance based on your alert volume and retention targets before you choose.

What TheHive's commercial shift means for a self-hosted team

TheHive 3 and TheHive 4 have not been maintained, distributed or publicly accessible since 2023, so a team running either version is running software without an upstream that will ship fixes. The archived TheHive 4 repository was licensed under AGPL-3.0, and its last release was 4.1.24 on September 13, 2022. Any self-hosted case management decision that starts from an existing TheHive 4 install is therefore a migration decision, not a configuration decision. Before planning it, confirm with StrangeBee which upgrade path to TheHive 5 applies to your data volume, and make sure your Cassandra and Elasticsearch backups are tested before anything changes.

TheHive 5 on-premises is sold in three tiers: Community, which is free for 2 users, and Gold and Platinum, which are priced per user. Installing TheHive starts a 14-day Platinum trial. When that trial ends, TheHive switches to read-only mode until a valid license is applied, so a SOC that treats the trial as a pilot can lose the ability to open or update cases on a fixed date. Since version 5.3, Community users must request a Community license from the StrangeBee license portal. Ask StrangeBee for current per-user pricing and the exact Community limits in writing before you size the team, since the tier you need depends on how many analysts will log in.

Not every component carries the same terms. Cortex, the analysis and response engine that TheHive uses for enrichment, is fully open source, needs no license, and is licensed under AGPL-3.0, so its licensing does not follow TheHive's commercial model. DFIR-IRIS is licensed under LGPL-3.0, which is a different set of obligations from TheHive's paid tiers, and you should have counsel confirm how it applies to your modifications. Tracecat is AGPL-3.0, but its enterprise features, including multi-tenant workspace management, Git version control integration and the authentication and single sign-on capabilities its documentation describes as enterprise features, sit under a separate paid Enterprise Edition license. If you need SSO on Tracecat, budget for that license rather than assuming it is in the open-source build.

How TheHive, DFIR-IRIS and Tracecat compare on capabilities

This table sets license, latest release, alert intake, enrichment, MISP integration, access control and deployment side by side for the three platforms. Read it as a starting checklist: where a cell says to confirm, the supplied research does not establish that capability, so ask the vendor before you decide.

Capability	TheHive 5	DFIR-IRIS	Tracecat
License	Commercial on-premises plans (Community free for 2 users, Gold and Platinum paid); archived TheHive 4 was AGPL-3.0	LGPL-3.0	AGPL-3.0; code in packages/tracecat-ee and enterprise feature gates under a paid Enterprise license
Latest release	5.8.1 (October 12, 2026)	v2.4.29 (August 10, 2026); v3.0.0-beta.1 not recommended for production	1.2.0 (October 16, 2026)
Alert intake	Alerts arrive as part of the TheHive case workflow; confirm supported sources with the vendor	SIEM, EDR and REST-fed alerts land in one queue for grouping, triage and promotion to a case	Webhook triggers drive workflows; confirm native SIEM and EDR connectors for your stack
Case model	Case-centric platform built on Cassandra and Elasticsearch; confirm task, observable and evidence handling in the current version	Assets, IOCs, tasks and evidence held in one case record with an audit trail	Case management and structured tables provided; confirm depth against your CSIRT process
Enrichment	Analyzers run through Cortex, which needs no license and is AGPL-3.0	IrisVT and IrisMISP modules enrich indicators from VirusTotal or MISP inside the case	Enrichment through workflow actions and custom actions synced from Git; confirm available integrations
MISP integration	Imports MISP taxonomies, connects to one or more MISP servers to turn events into alerts, and exports cases to MISP	IrisMISP module links indicators to MISP	Confirm MISP connector availability with the vendor
RBAC and SSO	Role separation available; confirm which SSO options each plan includes	Role-based access control provided; confirm SSO support in your version	Authentication and single sign-on are documented as enterprise features
REST API	Confirm API coverage and rate limits in the release notes	REST API provided for case and alert operations	Workflows and triggers exposed through webhooks; confirm the full API surface
Deployment options	On-premises install with TheHive, Cassandra and Elasticsearch on the JVM; recommended storage of 100 GB for most use cases	Docker Compose stack of six services: Flask API, Celery worker, PostgreSQL, RabbitMQ, nginx and SvelteKit frontend	Docker Compose on one host, AWS ECS Fargate via Terraform, Kubernetes via Helm, and air-gapped Kubernetes

What each platform needs to run in your infrastructure

TheHive 5 is a JVM-based deployment that runs TheHive alongside Apache Cassandra and Elasticsearch, and each of these components has its own heap configuration that you tune and monitor. That means three stateful services to install, upgrade and back up, not one application. StrangeBee recommends 100 GB of storage for most use cases, which is a starting point for capacity planning rather than a sizing guarantee, since case volume, attachments and retention policy will change the real number.

Three JVM components: TheHive, Cassandra and Elasticsearch each need heap settings and JVM tuning, and memory pressure in one can affect the others.
Storage baseline: StrangeBee recommends 100 GB for most use cases. Plan for growth from evidence retention and alert volume.
Backup scope: Back up Cassandra and Elasticsearch together with the TheHive configuration so that restored cases and their indexes stay consistent.
Licensing on the same host: A 14-day Platinum trial applies on installation, after which TheHive is read-only until a valid license is applied, so plan the license step into the build schedule.

Ask StrangeBee and your platform team to confirm the current system requirements, the supported Cassandra and Elasticsearch versions for your TheHive release and the node count for your availability target.

Each option in brief, with its license

The five options split into a commercial product with a free tier, an archived predecessor, two open-source platforms under different copyleft terms, and a tool that mixes open-source and paid code. Check the license and release status of each before you put a case workflow on it, because the difference decides who can run it and what you must pay for.

TheHive 5 (Community plan)

TheHive 5 is StrangeBee's commercial case management platform. Its on-premises plans are Community, which is free for 2 users, and paid Gold and Platinum tiers priced per user. A fresh install starts with a 14-day Platinum trial, after which the platform goes read-only until a valid license is applied. Since version 5.3, Community users must request their license from the StrangeBee portal. Check the user limit against your analyst count and plan the license step into your install runbook.

TheHive 4 (archived)

TheHive 4 was licensed under AGPL-3.0, but its repository is archived and the project has not been maintained or distributed since 2023. The last release, 4.1.24, dates from September 13, 2022. Do not deploy it for new work. Existing TheHive 4 instances need a migration plan, because you will not receive security fixes from the upstream project.

DFIR-IRIS (LGPL-3.0)

DFIR-IRIS is a community-run incident response platform under LGPL-3.0, which is an OSI-approved license. Its latest stable release is v2.4.29, published August 10, 2026. The README marks v3.0.0-beta.1 as not recommended for production, so pin the 2.4 line for production. The Docker Compose stack runs six services, including PostgreSQL and RabbitMQ, so budget operating effort for upgrades and backups.

Cortex (AGPL-3.0)

Cortex is the analysis and response engine that TheHive uses for enrichment. It is fully open source, needs no license, and is distributed under AGPL-3.0. Cortex is a separate service with its own deployment, so plan for its hosting, analyzer configuration and API keys alongside TheHive. Confirm the Cortex version that your TheHive 5 release supports before you upgrade either component.

Tracecat (AGPL-3.0 with paid code)

Tracecat is a security automation platform under AGPL-3.0, with code in packages/tracecat-ee and enterprise feature gates under a separate paid Enterprise Edition license. Its documentation places authentication and single sign-on in the enterprise set. Confirm which SSO, multi-tenant and Git version control features your edition includes before you design identity integration, and treat its case management as an automation feature rather than a dedicated IR case system.

How to choose and pilot a case management platform

This sequence turns a shortlist of TheHive, DFIR-IRIS and Tracecat into a documented decision backed by tests on your own alerts, indicators and licensing terms. Each step ends with an artifact your security, legal and platform teams can review before anything goes into production.

Inventory intake sources and alert volume
The SOC lead and a platform engineer list every source that should open or feed a case: SIEM alerts, EDR detections, email reports, MISP events and manual submissions. For each source, record the expected daily volume, the format it arrives in and whether it must be deduplicated before a human sees it. DFIR-IRIS describes an alert queue fed by SIEM, EDR and REST sources, while TheHive ingests alerts through its own integrations and Tracecat relies on webhook triggers, so the mapping work differs by platform. Done means a signed-off intake table that the evaluation team uses for every test that follows.
Decide which license terms you can accept
Legal, procurement and the CISO review each candidate's license before any testing starts. TheHive 5 Community is free for 2 users, and Gold and Platinum are priced per user, while the archived TheHive 4 repository is AGPL-3.0 and no longer maintained. DFIR-IRIS is LGPL-3.0, and Tracecat is AGPL-3.0 with enterprise code under a separate paid license. Confirm whether your use triggers AGPL obligations for modifications you host for others and which features sit behind paid tiers. Done means a written acceptability decision per product, with the features you rely on named explicitly.
Test MISP and enrichment with real indicators
A threat intelligence engineer runs a controlled set of indicators, drawn from closed cases and sanitized where needed, through each candidate. For TheHive, confirm MISP event import into alerts and case export back to MISP, and check how taxonomies are imported. For DFIR-IRIS, test the IrisMISP, IrisVT and IrisCheck modules and their enrichment results. For Tracecat, build the same lookup as a workflow. Record which lookups succeed, which fail and how much manual work each path needs. Done means a comparison sheet of enrichment outcomes against the same indicator set.
Check RBAC, audit trail and evidence handling
The security governance lead and an incident responder define the roles that must exist, such as analyst, lead, read-only reviewer and administrator, and which actions must leave an audit record. Create test users in each candidate and attempt the actions each role should be blocked from. Upload a test evidence file and verify its hash is recorded and that case changes appear in the audit trail. Note where a capability requires a paid tier or an enterprise feature, and confirm it in writing with the vendor. Done means a role matrix with pass or fail results and a list of gaps that need a license or a compensating control.
Stand up a non-production instance
A platform engineer deploys each shortlisted product in a non-production environment that mirrors your target infrastructure. Record the components each one requires: TheHive runs with Apache Cassandra, Elasticsearch and Cortex, DFIR-IRIS runs as a six-service Docker Compose stack, and Tracecat offers Docker Compose, AWS ECS Fargate, Kubernetes and an air-gapped Kubernetes option. Capture heap settings, storage sizing, backup routines and who must patch each component. Done means a runbook per instance that lists the components, the hosting model and the operator tasks that recur after go-live.
Confirm license terms and support in writing
Procurement and legal request written answers from each vendor on subscription terms, renewal conditions, what happens to read-only or trial-licensed deployments, and the support scope for your version. Ask for the quote to itemize per-user fees, any module or enterprise charges, and what changes if your user count grows. Ask how each vendor handles security advisories for the version you will run. Because DeployOpen does not publish prices and fixed-scope work is agreed in writing, request the same written scope from any implementation partner you engage. Done means signed vendor responses and a quote that matches the scope tested in the pilot.
Record the decision and the exit plan
The evaluation team writes a decision record that cites the intake table, license decision, enrichment results, role matrix and runbook. The record also states how cases, indicators and evidence would be exported if you later switch platforms, and which fields would need mapping. Ask each vendor what export formats and API endpoints are available. Done means an approved decision record with a named owner, an exit note per platform and an agreed date for the first production review.

Questions buyers ask before choosing or hiring help

Can a small SOC run TheHive, DFIR-IRIS or Tracecat without outside help?

Yes, a capable internal team can install and run each platform, but the effort depends on the stack and the team's experience with it. DFIR-IRIS ships a Docker Compose stack of six services: a Flask API, a Celery worker, PostgreSQL, RabbitMQ, nginx for TLS and a SvelteKit frontend. TheHive on-premises runs TheHive with Apache Cassandra and Elasticsearch, each on the JVM with its own heap configuration. Tracecat documents Docker Compose on a single host, AWS ECS Fargate through Terraform, Kubernetes through a Helm chart, and an air-gapped Kubernetes option. Ask yourself who will patch, back up and upgrade each component, and who will be on call when one of them fails. If those answers are unclear, an outside implementation partner can help with scope, but the operating work stays with your team after handover.

What drives the cost of TheHive compared with DFIR-IRIS and Tracecat?

Licensing is the most visible difference. TheHive 5 on-premises plans are Community, which is free for 2 users, and Gold and Platinum, which are priced per user on StrangeBee's pricing page. DFIR-IRIS is licensed under LGPL-3.0, and Cortex, used with TheHive, needs no license. Tracecat's core is AGPL-3.0, while its enterprise code sits under a paid Enterprise Edition license. Beyond licenses, the main recurring costs are infrastructure (storage, memory and compute for each stack), integration work for SIEM, EDR and MISP feeds, and the internal or contracted hours to run upgrades. Ask any vendor or partner for a quote that separates one-time setup from recurring license, hosting and support lines, and that lists which integrations are included.

How long does a pilot of a self-hosted case management platform take?

No researched timeline is available for these platforms, so do not plan against a duration from this page. A pilot's length depends on the number of alert sources, whether MISP and Cortex are connected, how many analysts need access, and whether single sign-on is required. For TheHive, ask StrangeBee which license applies during evaluation, since a fresh on-premises install includes a 14-day Platinum trial license before read-only mode applies. For any option, ask the implementer to write down the pilot's entry criteria, exit criteria and the integrations in scope before work starts, and to state how the pilot converts to production.

What does the internal team need to supply for a self-hosted case management project?

The internal team supplies the people and decisions that no vendor or partner can make for you. You need an owner for each alert source, someone who understands your detection pipeline, and analysts who will define triage rules and case templates. Infrastructure staff must provide hosting, storage, backups, TLS certificates and network paths to SIEM, EDR and MISP. Security leadership should decide retention rules, access roles and who approves changes to playbooks or integrations. Ask an implementation partner to name these responsibilities in the written scope so that gaps appear before go-live rather than during an incident.

Can TheHive 4 still be used safely after it stopped being maintained?

Treat TheHive 4 as unsupported. According to the TheHive project, TheHive 3 and TheHive 4 have not been maintained, distributed or publicly accessible since 2023, and the TheHive 4 repository is archived. Its last release was 4.1.24, published on September 13, 2022. Running it means carrying your own security patching, dependency risk and compatibility problems. If you have a TheHive 4 instance, plan a migration to TheHive 5 and confirm with StrangeBee how your data, licensing and integrations will move. Ask the migration partner to document the rollback path and to test restores before any cutover.

What does a fixed-scope implementation from DeployOpen cover?

DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure. For this category, a fixed-scope engagement typically agrees in writing which platform is deployed, which alert sources and MISP or Cortex connections are built, which playbooks or workflows are delivered, what hardening and backup steps apply, and what documentation and handover you receive. Most engagements are fixed-scope, and scope, deliverables and timelines are agreed before work starts. DeployOpen does not publish a price list, so a quote follows from the written scope. Ask for the exclusions in writing too, such as licensed TheHive tiers or ongoing alert volume growth.

Do ongoing support and upgrades continue after a fixed-scope project ends?

They can, through a separate retainer. DeployOpen offers ongoing support, upgrades and continuous testing as retainers, which are distinct from the initial fixed-scope implementation. Upgrades matter in this category because each platform releases frequently. For example, TheHive 5.8.1 was released on October 12, 2026, and DFIR-IRIS v2.4.29 is the latest stable release as of its repository listing. A retainer should specify which versions are covered, how breaking changes are tested, and how security patches are applied. Ask whether the retainer includes Cortex analyzers, MISP connectors and workflow content, since those add their own update paths.

Which platform is simplest to hand over to a team with no incident response tooling experience?

It depends on the team's background, so the answer is conditional. DFIR-IRIS has a single application stack and provides cases with assets, IOCs, tasks and evidence in one record, which keeps the data model easy to follow. TheHive pairs with Cortex and MISP, so it suits teams that already plan to run that wider ecosystem. Tracecat combines case management with workflow automation, webhooks and AI agents, which benefits teams that want orchestration in the same tool but adds a Temporal-based runtime to learn. Ask each candidate to demonstrate the same three cases end to end in your environment before you decide.

How DeployOpen scopes and delivers a case management implementation

DeployOpen plans, implements, customizes, integrates, hardens, backs up, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For case management, that means agreeing in writing which platform, alert sources, enrichment services and MISP connections are in scope before any installation begins.

How we scope

Written scope covers which alert sources feed the case queue, such as SIEM, EDR or REST intake.
Scope names the enrichment services, Cortex analyzers and MISP connections to be built and tested.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

Installation covers the platform's own stack, including the database, search and queue services it requires.
Integrations are built and tested against your alert sources, enrichment services and MISP instances.
Role-based access, audit trail settings, evidence handling and backup procedures are configured and tested.

How we hand over

Documentation covers the architecture, configuration, integrations, licensing status and operating runbooks.
Handover includes a walkthrough of case intake, triage, escalation and evidence workflows with your analysts.
Compliance evidence for controls you own is organized for your auditors, who issue any report or attestation.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can cover platform upgrades, license-tier changes and integration updates as your alert sources change.
Ask in your quote which upgrade, patch and testing activities the retainer includes and how they are scheduled.

Self-hosted incident response case management compared