Should a team still on TheHive 4 stay, upgrade or move?
If your team still runs TheHive 4, the decision is between staying on an archived release, upgrading to the licensed TheHive 5, or migrating case data to an open-source platform such as DFIR-IRIS. Staying is the option that carries the most unmanaged risk. The TheHive 4 repository is archived, and its last release, 4.1.24, was published on September 13, 2022. No fixes for the Cassandra, Elasticsearch or TheHive components are coming from the project, so every vulnerability disclosed since then is one your team must patch, mitigate or accept on its own. Before choosing anything, inventory the TheHive 4 hosts, the JVM and Elasticsearch versions in use, and which MISP and Cortex connections depend on them. That list defines the work for each path.
Upgrading means moving to TheHive 5, which is a licensed product. Installing it on-premises starts with a 14-day Platinum trial, after which the platform becomes read-only until a valid license is applied. The free Community plan covers 2 users, so a team larger than that must price Gold or Platinum, which are charged per user. Ask StrangeBee for a written quote that states the user count, the Cortex and MISP server counts, and the support tier, because paid prices are not published. Also confirm whether your TheHive 4 data and integrations can be carried into TheHive 5 without rework, and plan a test restore before cutover.
Moving to DFIR-IRIS replaces the licensed dependency with an LGPL-3.0 platform, but the cost shifts to migration work. You will need to map TheHive 4 cases, observables and tasks to IRIS objects, rebuild the alert intake and MISP or VirusTotal enrichment, and validate evidence hashes after transfer. Confirm that the IRIS version you target is the stable line, since the repository marks v3.0.0-beta.1 as not recommended for production. A scoped migration with a parallel run period is the safer route for a team that has a live caseload.
What changed between TheHive 4 and TheHive 5
TheHive 4 is an archived AGPL-3.0 release line that no longer receives updates, while TheHive 5 is a commercial product with a free Community plan and paid plans. The cards below cover the license model, the trial and read-only behavior, the Community license step, and what stays open source in the stack.
The license model moved
The archived TheHive 4 repository was licensed under AGPL-3.0, and its last release, 4.1.24, was published on September 13, 2022. TheHive 5 is distributed as a commercial product with Community, Gold and Platinum plans, and the on-premises plans are priced per user. Check whether your current deployment depends on any code or packaging that only the open-source release provided, because that code will not receive fixes from the project.
Community plan limits
TheHive 5 on-premises Community is free for 2 users. Teams that grow past that limit will need a Gold or Platinum plan, so the per-user cost becomes a recurring line item. Ask StrangeBee for the current Gold and Platinum pricing in writing, since prices are not published, and confirm how user counts are measured for your team.
Trial then read-only mode
A new on-premises installation includes a 14-day Platinum trial license. When the trial ends, TheHive switches to read-only mode until a valid license is applied. For an existing team, this means an unlicensed upgrade can stop case creation and updates during an active incident, so plan the license before the cutover and rehearse it in a staging environment.
Community license request
Since version 5.3, Community users must request a Community license from the StrangeBee license portal. Teams that ran TheHive 4 without any license step should add this request to their upgrade checklist, assign an owner for the portal account, and confirm that the license is tied to the correct instance. Without it, the Community deployment cannot be used as expected after installation.
Cortex remains open source
Cortex, the analysis and response engine used with TheHive, is fully open source under AGPL-3.0 and needs no license. Teams moving to TheHive 5 keep their Cortex analyzers and responders in the same open-source model, but they should confirm that their analyzer versions and any custom responders still run on the current Cortex release that accompanies TheHive 5.
Platform stack and storage
A TheHive deployment runs TheHive, Apache Cassandra and Elasticsearch, each on the JVM with its own heap configuration. StrangeBee recommends 100 GB of storage for most use cases. Upgrading from TheHive 4 is therefore not only a license decision: it also means reviewing heap sizing, storage capacity and the operating skills your team needs for three stateful components.
Which capabilities are free, licensed or unavailable
This table compares TheHive 4, the archived AGPL-3.0 release line, with TheHive 5 Community and its paid per-user plans on the items that drive cost and effort. Read each row as a question to settle before you choose: where a cell says to confirm, the answer depends on plan-level terms that only StrangeBee can state for your deployment.
| Capability | TheHive 4 (archived) | TheHive 5 (Community and paid plans) |
|---|---|---|
| Licensing and distribution | AGPL-3.0 source, last release 4.1.24 on September 13, 2022, no maintained releases since 2023 | Commercial product, Community free for 2 users, Gold and Platinum priced per user |
| Trial and license enforcement | No license gate in the archived line; confirm your own build and support position before relying on it | 14-day Platinum trial on install, then read-only mode until a valid license is applied |
| MISP integration | Available in the archived line; confirm connector behavior and compatibility with current MISP releases yourself | Imports MISP taxonomies by default and links to one or more MISP servers; confirm which tiers include multiple servers |
| Cortex analysis engine | Used with the archived line; confirm version pairing with the last release | Cortex is AGPL-3.0 and needs no license; confirm which TheHive 5 plan limits Cortex server connections |
| Storage sizing | Plan storage yourself; no current StrangeBee recommendation applies to the archived line | StrangeBee recommends 100 GB of storage for most use cases; size higher for heavy evidence volumes |
| Stack components | Cassandra and Elasticsearch with a JVM heap per component | TheHive, Apache Cassandra and Elasticsearch, each on the JVM with its own heap configuration |
| Per-user cost | No per-user fee published for the archived line | Priced per user on Gold and Platinum; ask StrangeBee for a written quote tied to your user count |
| Vendor updates and security fixes | None published since 2023; you carry the patching risk | Current releases such as 5.8.0 (September 14, 2026) and 5.8.1 (October 12, 2026) |
How staying, upgrading and migrating each work
Staying on TheHive 4 keeps the current deployment and workflows in place, but the software no longer receives maintenance. The archived repository's last release, 4.1.24, was published on September 13, 2022, and TheHive 3 and 4 have not been maintained or distributed since 2023. Any vulnerability found after that point in TheHive, its JVM dependencies, Cassandra or Elasticsearch stays open unless your team patches it itself. This path can suit a short bridge period with a dated exit plan, where the team isolates the platform and limits who can reach it.
- Patch ownership: Your team, or a partner you hire, carries every fix for the application and its data stores.
- Exposure surface: Restrict network access, enforce single sign-on where possible, and review who holds administrator rights.
- Dependency drift: Operating system, Java and database updates can break a frozen TheHive 4 build, so test each change in a copy first.
- Compliance evidence: Auditors may ask how an unmaintained component is risk-accepted, so document the decision and its review date.
- Exit cost stays deferred: Every month on TheHive 4 postpones the same migration work, and the data volume usually grows.
Before choosing this path, confirm with your security lead which controls compensate for missing vendor patches and when the exit date is set.
Upgrading to TheHive 5 keeps the case model your analysts already know, but it moves the platform onto a commercial license and a different operating stack review. TheHive 5 on-premises plans are Community, free for 2 users, and Gold and Platinum, priced per user. Installing TheHive 5 on-premises starts a 14-day Platinum trial, after which the platform becomes read-only until a valid license is applied. Since version 5.3, Community users must request a Community license from the StrangeBee license portal. Cortex is needed alongside TheHive and is open source under AGPL-3.0 with no license fee.
- License decision: Choose Community, Gold or Platinum based on user count, and get the price in writing from StrangeBee, since paid prices are not published.
- Stack planning: A TheHive deployment runs TheHive, Apache Cassandra and Elasticsearch, each on the JVM with its own heap configuration, so capacity planning covers all three.
- Storage: StrangeBee recommends 100 GB of storage for most use cases, but size your own data growth and retention before sizing hardware.
- Integrations: Recheck MISP connections, Cortex analyzers and any custom scripts against the 5.x API and configuration.
- Recurring costs: Per-user licensing, infrastructure and staff time for patching and backups recur, while the initial data migration is largely one time.
Before committing, run a test upgrade on a copy of production data and confirm the license terms and read-only behavior with StrangeBee.
Moving to DFIR-IRIS replaces the platform rather than upgrading it, which makes it the heaviest change in effort and the most open in licensing. DFIR-IRIS is licensed under LGPL-3.0, and the latest stable release is v2.4.29, published on August 10, 2026. The README marks v3.0.0-beta.1 as not recommended for production. Its Docker Compose stack runs six services: a Flask API, a Celery worker, PostgreSQL, RabbitMQ, nginx for TLS and a SvelteKit frontend, with images pulled from ghcr.io. This path can suit teams that want to own the platform outright and can rebuild their case, alert and playbook workflows.
- Data mapping: Map TheHive case fields, observables, tasks, tags and attachments to IRIS assets, IOCs, tasks and evidence before moving anything.
- Alert migration: Decide which open TheHive alerts move as alerts and which are closed, since IRIS groups and triages alerts in one queue.
- Integrations: IrisMISP and IrisVT cover MISP and VirusTotal enrichment, but rebuild each custom connector and confirm coverage for your SIEM and EDR feeds.
- Parallel running: Plan a period where both platforms run, so analysts can finish open cases in TheHive.
- Support model: Community-run open source means in-house or contracted expertise carries upgrades, backups and hardening.
Before choosing this path, ask a migration partner to scope the case export and validate it against a sample of closed and open cases.
What an upgrade from TheHive 4 to TheHive 5 involves
The sequence turns an archived TheHive 4 deployment into a licensed TheHive 5 instance with its data, storage, MISP and Cortex connections checked before users are moved over.
Inventory the TheHive 4 deployment and its data
The platform owner lists the TheHive 4 version and host layout, the Cassandra and Elasticsearch footprint, the cases, alerts, observables and attachments held, the users and organizations, and every MISP server and Cortex instance that TheHive 4 talks to. The output is a written inventory that the migration plan and the vendor conversation can both refer to. Done means every integration and data set has an owner and a stated reason to keep it.
Confirm the supported migration path with StrangeBee
Before any installation, the team asks StrangeBee in writing whether a direct upgrade from TheHive 4 to the chosen TheHive 5 release is supported, which intermediate steps apply, and what tooling or guidance exists for moving data. Ask specifically how the archived 4.1.24 release, last published on September 13, 2022, is handled. Done means the answer, the target version and the support scope are on file, and any gap the answer reveals is added to the plan.
Select the target TheHive 5 release
The team chooses a TheHive 5 release from the current line, which includes 5.8.0 released on September 14, 2026 and 5.8.1 released on October 12, 2026, and reads the release notes for each version it considers. The choice should follow the migration guidance from the previous step, not the newest number alone. Done means a single target version is recorded with the reasons for it and a rollback point is defined.
Size Cassandra and Elasticsearch for the new instance
The platform team reviews the TheHive 5 system requirements, which describe TheHive, Apache Cassandra and Elasticsearch each running on the JVM with its own heap settings, and StrangeBee's recommendation of 100 GB of storage for most use cases. It then compares that guidance with the data volume from the inventory and the expected growth of the case load. Done means a sizing sheet exists for each component, reviewed against the current TheHive 4 hosts, and any shortfall is raised with the vendor or infrastructure owner before purchase or provisioning.
Apply the TheHive 5 license
A fresh installation starts with a 14-day Platinum trial, after which TheHive switches to read-only mode until a valid license is applied. Community users must request a Community license from the StrangeBee license portal since version 5.3. The team confirms which plan matches its user and organization count, since TheHive 5 on-premises plans are priced per user beyond the free Community allowance. Done means the license is applied to the target instance, the plan is recorded, and a test confirms the instance accepts writes.
Re-validate MISP and Cortex connections
The integration owner reconnects TheHive 5 to each MISP server and Cortex instance from the inventory and checks taxonomy import, the conversion of MISP events into alerts, and case export to MISP as events. Cortex analyzers and responders are tested against sample observables, since Cortex is open source and needs no license but its configuration is not carried over automatically. Done means each connection returns the expected results in a test case and the results are written down.
Test the migrated data and workflows
A named group of analysts works through migrated cases, alerts, observables, attachments and user permissions in a non-production copy, comparing counts and spot-checking records against TheHive 4. They also run one representative investigation end to end. Done means the test log shows no unexplained data loss, the access model matches the inventory, and the open issues list is either empty or each item has an owner and a fix date agreed with the vendor.
Cut over and keep a rollback path
The team schedules a cutover window agreed with its analysts, places TheHive 4 in read-only use for the final sync, moves the users to TheHive 5, and keeps the archived TheHive 4 environment reachable until the new platform has run through a full operating cycle. Done means users log in to TheHive 5 successfully, the rollback procedure has been rehearsed, and the old environment has a documented retirement decision rather than being left running by default.
What do teams ask before they upgrade or migrate off TheHive 4?
How much does it cost to upgrade from TheHive 4 to TheHive 5?
The cost has four parts: the TheHive 5 license, infrastructure, migration labor and the time your own team spends on testing and cutover. Community is free for 2 users, while Gold and Platinum are priced per user. StrangeBee does not publish paid prices in the supplied material, so request a written quote for your user count and plan. License fees recur, while migration, testing and infrastructure setup are mostly one-time. Infrastructure costs recur because TheHive runs with Apache Cassandra and Elasticsearch, each on the JVM. Ask the quote to separate license, support, and any services work, and state which Cortex and MISP integrations are in scope. See StrangeBee pricing for the published plan structure.
How long does a TheHive 4 to TheHive 5 migration take?
The duration depends mainly on data volume, the number of integrations and how much custom configuration you carry forward. No migration timeline is published in the material available here, so confirm estimates with StrangeBee before you plan a cutover. Volume matters because StrangeBee recommends 100 GB of storage for most use cases, and your existing case history may be larger or smaller than that. Integrations such as MISP server connections, Cortex analyzers and custom scripts each add test cycles. Note that a fresh TheHive 5 installation starts a 14-day Platinum trial, after which the instance becomes read-only without a valid license, so plan test and cutover work within that window or request a license in advance.
Can our own team upgrade TheHive without outside help?
A team can do it alone if it already runs Apache Cassandra and Elasticsearch in production and can tune JVM heap settings for each service. The stack has three stateful components, TheHive, Cassandra and Elasticsearch, each with its own heap configuration, so a failure in one affects the others. Your team also needs to handle backup and restore for both data stores, certificate and TLS setup, and Cortex connectivity. If those skills are thin, budget for outside help or training before the migration starts. DeployOpen plans, implements, upgrades and documents self-hosted open-source platforms, but TheHive 5 is commercial, so confirm in writing whether a services engagement covers this platform before you assume it does.
What does the migration need from our team?
The migration needs an accurate inventory, a test environment and named owners for each decision. Start by listing cases, alerts, observables, users, organizations, custom fields, analyzers and every MISP and Cortex connection. Decide which historical data you must keep, how long it stays searchable and who approves the retention decision. Your team then needs a staging instance to validate case history, alert ingestion and sharing workflows before production cutover. Plan for a rollback point, a documented cutover window and post-migration checks by analysts, not only engineers. Assign a sponsor to sign off the license purchase, because a read-only instance can stop case work. Put each item in the written scope so the quote and the timeline match it.
Can we keep running TheHive 4 safely?
You can keep running it for a time, but only as a documented risk acceptance, because TheHive 4 no longer receives maintenance. The archived repository's last release is 4.1.24, published on September 13, 2022, and TheHive 3 and 4 have not been maintained or distributed since 2023. Any vulnerability found in TheHive 4 or its dependencies will not be patched by the project. If you keep it, restrict network access to analysts and integrations, isolate the host, limit exposed interfaces, keep backups tested and record compensating controls with an owner and review date. Treat the decision as a time-limited bridge to a supported platform, and confirm the exposure with your security team and your auditor if you operate under a compliance program.
How has TheHive licensing changed from version 4 to version 5?
TheHive 4 was open source under AGPL-3.0, while TheHive 5 is a commercial product with a free Community plan. The on-premises plans are Community, free for 2 users, and Gold and Platinum, which are priced per user. Installation starts a 14-day Platinum trial, and after it ends the instance goes read-only until a valid license is applied. Since version 5.3, Community users must request a Community license through the StrangeBee license portal. Cortex, the analysis engine used with TheHive, is open source under AGPL-3.0 and needs no license. Read the about licenses page and confirm terms with StrangeBee and your legal team before you commit.
How does DFIR-IRIS compare with TheHive on license and cost?
DFIR-IRIS is licensed under LGPL-3.0, so its core can be deployed without a per-user subscription, while TheHive 5 charges per user on Gold and Platinum. The latest stable release is v2.4.29, published on August 10, 2026, and the README marks v3.0.0-beta.1 as not recommended for production. Its Docker Compose stack runs six services, including PostgreSQL and RabbitMQ, so your cost is hosting, administration and migration effort rather than a license fee. Confirm whether your legal team accepts LGPL-3.0 for your use, and confirm the support model you need, since community-run projects differ from commercial support. Check the DFIR-IRIS repository for current release notes before planning.
What staying on an archived release costs in risk
Staying on TheHive 4 means accepting that the vendor will not fix what you find. The last TheHive 4 release, 4.1.24, was published on September 13, 2022, and the TheHive README states that TheHive 3 and 4 have not been maintained, distributed or publicly accessible since 2023. Any vulnerability disclosed after that point in the application, in the bundled JVM, or in the Apache Cassandra and Elasticsearch layers your deployment depends on will stay open unless your own team patches it or builds the fix. Run your vulnerability scanner against every TheHive 4 component, record which findings have no upstream fix, and assign an owner to each one.
The second cost is support and evidence. Without a maintained release, there is no vendor advisory channel, no supported upgrade path from the vendor, and no answer to a customer or regulator question about a current fix. Auditors reviewing patch management and vulnerability management controls will ask for dated records showing that software is supported and that exceptions were approved. A TheHive 4 instance with no exception record will usually be treated as an unmanaged gap. Ask your assessor, before the next review, what form of documented risk acceptance they expect, and whether a compensating-control narrative will be sufficient for an unsupported application.
Some teams can accept this for a short, controlled period while they plan a move, provided the exception is written down with compensating controls such as network isolation, restricted administrator access, and monitoring of the backing data stores, along with a fixed end date. The decision is then between upgrading to licensed TheHive 5, where StrangeBee's pricing page lists Community for 2 users and paid Gold and Platinum plans priced per user, or moving to an open-source case manager such as DFIR-IRIS. Either path needs a data migration plan for cases, observables and attachments, and a quote that covers both the license and the implementation effort.
License, support and update terms for each path
The four paths differ more in license, support and update terms than in features. TheHive 4 is archived and no longer receives updates, TheHive 5 is licensed by tier and user count, and DFIR-IRIS is open source with a community release model. Each card names the term you must confirm before you commit to a path.
TheHive 4 archived line
TheHive 4 was published under AGPL-3.0, and its last release, 4.1.24, dates from September 13, 2022. The project states that TheHive 3 and 4 have not been maintained, distributed or publicly accessible since 2023, and their repositories are archived. A team that stays on it receives no upstream security fixes, so the exposure has no end date. Inventory the Cassandra, Elasticsearch and JVM versions in your build, and treat any migration as a project in its own right.
TheHive 5 Community license
The Community plan is free for 2 users. Since version 5.3, Community users must request a Community license from the StrangeBee license portal, so a new installation needs that step before normal use. Installing on-premises also starts a 14-day Platinum trial, and when it ends TheHive switches to read-only mode until a valid license is applied. Count the analysts who will log in before go-live, because the free seat limit applies to users, not to cases.
TheHive 5 Gold and Platinum
Gold and Platinum are priced per user, and the StrangeBee pricing page does not publish amounts, so the figure comes from a written quote. Ask what the quote covers: user count, Cortex and MISP server limits, and whether support response times are part of the tier. Confirm the support terms, upgrade rights across 5.x releases and what happens to access if the subscription lapses. The latest release, 5.8.1, came out on October 12, 2026, so ask which versions the license covers.
DFIR-IRIS license and status
DFIR-IRIS is licensed under LGPL-3.0 and describes itself as open source and community-run, so there is no license key and no per-user fee for the software. The latest stable release, v2.4.29, was published on August 10, 2026. Your costs are hosting, the six services in its Docker Compose stack, and the staff who patch and upgrade it. Confirm where support will come from, whether the project community or a paid partner, before you commit.
IRIS v3 beta is not production
The repository README marks v3.0.0-beta.1 as not recommended for production. A move to DFIR-IRIS should therefore target the stable v2.4.29 line unless your team accepts beta risk in writing. Fix the target version before you export cases, and test the import against a copy of your data. Confirm the release date of any v3 stable build with the project, since no date is supplied here. Keep the TheHive 4 instance read-only for evidence until the import is verified.
How DeployOpen scopes and delivers a TheHive move
DeployOpen plans, implements, migrates, hardens, backs up and documents self-hosted platforms inside the client's own infrastructure, and a TheHive move follows the same pattern. The work covers the TheHive application, its Cassandra and Elasticsearch data stores, Cortex, and any MISP connection, all running in the client's cloud account, data center or air-gapped network. Most engagements are fixed-scope, so the scope, deliverables and timelines are agreed in writing before any migration work starts. Ongoing support, upgrades and continuous testing can follow under an optional retainer.
DeployOpen does not publish a price list. A quote follows from the written scope, so the useful preparation is an inventory the scope can be built from: the TheHive 4 version in use, the number of users and organizations, which Cortex analyzers and MISP servers are connected, the Cassandra and Elasticsearch sizes, and the case and evidence volume to migrate. Ask whether the quote covers the licensing decision for TheHive 5, since StrangeBee licenses are a separate cost from DeployOpen's work, and confirm the Community license request path described in the TheHive 5 documentation if the team plans to stay on the free plan.
DeployOpen is not a StrangeBee or DFIR-IRIS partner, reseller or certified provider, and no partner status should be assumed from this page. Ask any implementation partner, including DeployOpen, to state in the written scope which parts are performed by the client's own staff, which are performed by DeployOpen, and which depend on decisions made by the vendor. A written scope that names the cutover window, rollback point and evidence to be kept is the clearest signal that a move is being managed rather than hoped for.
