When TheHive Community is enough and when Gold or Platinum is needed
A team of two or fewer people can run TheHive 5 on-premises on the Community plan, which StrangeBee lists as free for 2 users. Gold or Platinum becomes necessary once more people need working access or once the team needs a paid feature set. Community suits a small response team still testing whether TheHive fits its workflow, a lab or training environment, and a proof of concept that will be replaced later. Cortex, the analysis engine that runs alongside TheHive, is fully open source and needs no license, so the plan choice does not change how you set up analyzers. Before you commit, confirm with StrangeBee which integrations and limits apply to each plan, because the pricing page does not itemize them for you.
Headcount is usually the trigger to move up. Gold and Platinum are priced per user, so the bill grows with every analyst, responder or stakeholder who needs an account. Count named users now, including on-call staff who open cases only occasionally. If you expect growth, price the plan for the number you will have in a year, not the number you have this week. Compare Gold and Platinum against a written list of the features you need, and ask StrangeBee to confirm which features differ between the two tiers. Then request a quote that states the per-user price, the billing period, the user count it assumes, and whether Cortex and MISP connections are covered. Paid prices are not published, so that quote is the only reliable number you will get before buying.
Plan for the end of the trial. Installing TheHive on-premises starts a 14-day Platinum trial license, and when it expires TheHive switches to read-only mode until a valid license is applied. Since version 5.3, Community users must also request a Community license from the StrangeBee license portal. Treat the trial as an evaluation window and avoid loading live incident data into an instance you have not licensed. Before the trial ends, decide which plan the instance will run on, add the license request or purchase to your change calendar, and name the person who can apply the license key. Read the TheHive 5 licensing documentation to confirm the exact steps for your version.
Which TheHive 5 capabilities differ between Community, Gold and Platinum
This table compares the TheHive 5 on-premises plans on the terms StrangeBee documents. Where a limit or response time is not published in the sources, the cell says to confirm it with StrangeBee before you size a deployment. Treat the confirmed items as the decision inputs, and the license behavior rows as the operational risk if a license lapses.
| Capability | Community | Gold | Platinum |
|---|---|---|---|
| Pricing model | Free, for up to 2 users | Paid, priced per user | Paid, priced per user |
| User limit | 2 users | Confirm the user ceiling with StrangeBee | Confirm the user ceiling with StrangeBee |
| Organizations | Confirm with StrangeBee | Confirm with StrangeBee | Confirm with StrangeBee |
| Cortex server connections | Confirm with StrangeBee | Confirm with StrangeBee | Confirm with StrangeBee |
| MISP server connections | Confirm with StrangeBee | Confirm with StrangeBee | Confirm with StrangeBee |
| Support response times | Confirm with StrangeBee | Confirm with StrangeBee | Confirm with StrangeBee |
| License to obtain | Community license requested from the StrangeBee license portal (version 5.3 onward) | Paid license applied to the installation | 14-day trial license at installation, then a paid license |
| Behavior without a valid license | Confirm grace period and read-only trigger with StrangeBee | Read-only until a valid license is applied | Read-only after the 14-day trial until a valid license is applied |
| Cortex licensing | No license needed; Cortex is AGPL-3.0 | No license needed; Cortex is AGPL-3.0 | No license needed; Cortex is AGPL-3.0 |
How the plans are licensed and what counts as a user
Community is free for 2 users, while Gold and Platinum are priced per user, so the first question is how many people will log in to TheHive and whether any of them will be counted in a way you did not expect. The Community plan covers a small team, and the paid plans scale with the user count. StrangeBee publishes the plan structure on its pricing page, but it does not publish paid prices in the sources reviewed here, so the exact per-user rate, any minimums and how service accounts or API-only integrations are counted must come from a written quote. Ask StrangeBee to state in the contract what a billable user is, whether analysts, read-only viewers and automation accounts are included, and how organizations are counted if you run more than one.
The license model applies to TheHive itself. Cortex, the analysis engine that runs analyzers and responders alongside TheHive, is open source under AGPL-3.0 and needs no license key, so the Cortex servers you add do not create a line item. The same is true of the open-source components in your stack, such as the Cassandra and Elasticsearch layers that a TheHive deployment depends on. Your paid spend therefore concerns the TheHive license, while the surrounding components carry their own operating costs, such as hosting, storage, patching and staff time. Confirm with StrangeBee whether any Cortex or MISP connection requires a TheHive license feature on a given plan, rather than assuming it does not.
Before you buy, run a short audit of your planned user base and ask StrangeBee to confirm the counting rules in writing. Check whether your 14-day Platinum trial license is the only route to test paid features, and plan for read-only mode when that trial ends without a valid license, since analysts would be unable to change cases until one is applied. Since version 5.3, Community users must request a Community license from the StrangeBee license portal, so each deployment needs that step built into its install runbook. Document who holds the license administrator role and where the license file is stored, because a lapsed or misassigned license can stop case work for the whole team.
What happens at the 14-day trial and after it ends
This sequence shows what a fresh on-premises TheHive 5 install does with its license state, from the 14-day Platinum trial through the switch to read-only mode and the Community license request. Each step ends with a check you can run, so you know which license state your instance is in before you plan capacity or users.
Install TheHive 5 on-premises
The platform team deploys TheHive alongside Apache Cassandra and Elasticsearch, each running on the JVM with its own heap configuration. StrangeBee's system requirements recommend 100 GB of storage for most use cases, so size the data volumes before the first start. Confirm the install by logging in as the administrator and reaching the main interface. Done means the application, database and search layers all respond and the admin account works.
Start the 14-day Platinum trial
On first installation, TheHive activates a 14-day Platinum trial license without any action from the administrator. During this window the instance has the full Platinum feature set, so the team can test Platinum-only behavior before choosing a plan. Record the install date in your change log, because the trial window is counted from installation. Done means the license status in the administration area shows an active Platinum trial with an end date.
Plan the plan decision inside the trial
Use the trial to test the features and limits that drive the choice between Community, Gold and Platinum, such as the number of users, organizations, and the Cortex and MISP connections you expect to run. Pricing for Gold and Platinum is per user and is not published, so the decision needs a written quote from StrangeBee. Confirm current user, organization and connection limits for each plan in the StrangeBee pricing page before the trial ends. Done means you have a written list of the limits your team needs and the plan that covers them.
Confirm the switch to read-only mode
When the trial ends without a valid license, TheHive switches to read-only mode until a valid license is applied. Read-only means existing cases can be viewed but the instance does not accept normal work, so plan the trial end around active investigations. Test this in a non-production instance first if possible. Done means you have seen the read-only state in a test environment and know who is notified and how.
Request a Community license from the portal
Since version 5.3, Community users must request a Community license from the StrangeBee license portal instead of running without one. Submit the request with the details the portal asks for, then retrieve the license file once it is issued. Community is free for 2 users, so this step applies to teams that stay within that limit. Done means the portal returns a license and the instance accepts it.
Apply the license to the instance
Load the license file into TheHive through the administration area, following the procedure in the StrangeBee license documentation for your version. Restart or reload only if the documentation for your release requires it. Check that the license type, user count and expiry shown match what you requested. Done means the license status reads as valid and the instance returns to normal write access.
Verify the license state against your version
Confirm the exact license steps for your version before you rely on this sequence, since the license procedure changed across the 5.x line. The current TheHive 5 reference is 5.8.1, released on October 12, 2026, and the 5.8.0 release on September 14, 2026 is the earlier one in that line. Read the release notes for your installed version and the StrangeBee license documentation. Done means you have written down the version, the license type and the steps you followed, and the record is stored with your deployment documents.
Which team sizes outgrow Community first
The documented threshold is the 2-user limit on the free Community plan, so the question is rarely about features first. The profiles below are illustrative, and each one shows which pressure, such as headcount, organization count, shared intelligence or formal support needs, usually moves a team toward a paid plan. Confirm every limit and price with StrangeBee before you decide.
Solo analyst on a lab or home setup
Illustrative: one analyst runs TheHive with Cortex and a single MISP connection to test workflows before a wider rollout. Two users fit inside Community, so the plan itself is rarely the blocker here. What to check is whether a second person, such as a backup analyst or an automation service account counted as a user, would push the deployment past the limit. Ask StrangeBee how service accounts and API users are counted before you plan around them.
Small SOC beyond two analysts
Illustrative: a three-person SOC rotates analysts across shifts, so the third seat is the first real pressure point. Once headcount exceeds the free allowance, Gold or Platinum becomes a per-user cost that grows with every analyst added. Ask StrangeBee for a quote built on your actual named-user count, and confirm whether on-call or read-only viewers need a seat.
Multi-organization MSSP
Illustrative: a managed security provider runs separate customer organizations inside one TheHive instance. Organization count and per-customer isolation drive the plan choice, so compare what each paid tier allows for organizations, users and Cortex and MISP server connections. Ask StrangeBee to put those limits in writing for your expected customer count before you sign a multi-tenant design.
Regulated enterprise with formal support needs
Illustrative: a bank or healthcare provider needs a contracted support response and a named escalation path for its incident response queue. Community offers no such commitment, so support response times become a procurement requirement. Compare the support terms of Gold and Platinum in writing, and confirm how the 14-day trial and read-only fallback would affect a production incident before go-live.
Shared MISP community use
Illustrative: a team connects TheHive to several MISP servers so alerts flow from community feeds into cases. Multiple MISP connections raise the integration count, which the plan may limit. Check the number of MISP server connections each plan allows, and confirm whether sharing exports from cases back to MISP counts against any cap.
Cortex analyzer-heavy response team
Illustrative: a response team runs many Cortex analyzers and responders across several engineers. Cortex itself needs no license, so cost pressure comes from the TheHive user seats around it. Ask StrangeBee whether any Cortex server or analyzer limits apply on each plan, and budget for the TheHive seats that operate it.
What to ask StrangeBee for when paid prices are not published
What is the per-user price for TheHive Gold and Platinum?
StrangeBee publishes its pricing page, but the paid per-user figures for Gold and Platinum are not listed there, so you need a written quote for your user count. Ask for the annual price per user for each plan, whether it is billed yearly or on another cycle, and whether the quote includes Cortex and MISP integration at the level you need. Compare the total against the cost of your own staff time to run the platform, since that is the other large cost component. Ask whether the quote is for a fixed term and what happens to the price at renewal.
How does StrangeBee count users and organizations for licensing?
Ask StrangeBee to define in writing what counts as a billable user, including whether read-only accounts, service accounts and API-only integrations are included. Confirm how organizations are counted, because multi-organization setups can change the plan you need. Ask for an example calculation based on your current headcount and your expected growth. Your team can check its own user list against that definition before the quote arrives, which avoids surprises at the first audit of licensed seats.
What are the Cortex and MISP server limits on each plan?
The plan documentation and the pricing page do not give a complete list of server limits, so ask StrangeBee to state in writing how many Cortex analyzer servers and how many MISP servers each plan supports. Cortex itself is open source under AGPL-3.0 and needs no license, but the limits that apply to your TheHive plan still matter for how you connect it. Ask whether the limits apply per plan, per organization or per instance, and what the configuration looks like for a multi-site deployment. Confirm the answer against the release you plan to install.
What support response times does each TheHive plan include?
Ask for the response and resolution targets for each severity level, the support hours, and the channels offered on Gold and Platinum. Confirm whether Community users receive any vendor support at all, and whether help with the Cassandra and Elasticsearch layers is covered or left to your own team. Request the support terms as a document you can attach to the contract, not a verbal summary. If your operations team needs a guaranteed response window, ask whether the plan offers one and what it costs.
How do renewal and true-up terms work for TheHive licenses?
Ask how the license renews, whether the term is annual or multi-year, and how the price is set at renewal. A true-up clause adds users during a term and bills them at a pro-rated or fixed rate, so ask for the exact rule and the notice period. Confirm whether you can reduce the user count at renewal and whether unused seats are credited. Ask for these terms in the order form so the true-up rate is fixed before you add users.
What happens to TheHive if we downgrade from Platinum or Gold?
Ask what changes in the product, the data and the support terms when you move from a paid plan to Community. Confirm whether features used by your team, such as additional Cortex or MISP connections, stop working on downgrade, and whether any data or configuration needs to be exported first. Note that Community users must request a Community license from the StrangeBee license portal since version 5.3, so ask how that request is handled during a downgrade. Get the downgrade steps in writing before you sign.
What does the read-only mode after the trial mean for our data?
Installing TheHive on-premises includes a 14-day Platinum trial license, after which TheHive switches to read-only mode until a valid license is applied. Ask StrangeBee to confirm in writing that data stays accessible in read-only mode and that no data is deleted when a license lapses. Ask how to restore full write access after a renewal is paid, and whether there is any delay. Test this path in a lab before production so your team knows what users will see.
Can our team run TheHive ourselves without paid support?
Yes, Community is free for 2 users, so a small team can run it without paying StrangeBee, but you carry the operating work yourself. That work covers upgrades, backups, the Cassandra and Elasticsearch layers and the JVM heap settings for each component. Ask StrangeBee which documentation, upgrade notes and support channels remain available on Community, and compare that with the paid tiers. If you need outside help to install, harden or upgrade the stack, DeployOpen plans, implements and supports self-hosted platforms in your own infrastructure under a written, fixed scope.
Moving from Community to a paid plan and back
This sequence moves an existing TheHive 5 Community install onto a paid plan, then confirms that the new limits hold and that a lapse or downgrade will not leave analysts without write access. Each step closes with a check you can record before the next step starts.
Inventory users and organizations
The platform administrator lists every active user and organization on the current install and records which Cortex and MISP servers are connected. Community is free for 2 users, so an install with more accounts needs either a paid plan or a reduction in accounts before it can stay compliant. Paid plans are priced per user, so ask StrangeBee for the figure that matches your count before anything changes. Done when the counts, the connected analyzers and servers, and the named owner of the license account are written in the change record.
Build a staging copy first
Stand up a non-production TheHive 5 instance on the same version, with Cortex and MISP connections configured the same way, and restore a recent backup of its data into it. Test every license step there first, so a wrong key, an unexpected limit or a connector problem appears where it costs nothing to fix. The platform owner does this work. Done when staging logs in with the same accounts and case and alert counts match production at the time of the copy.
Request the license from StrangeBee
Community installs request a Community license through the StrangeBee license portal, a requirement that applies from version 5.3. Gold and Platinum licenses come through StrangeBee's sales process and should be sized against your written user count, so do not start a paid install on an estimate. Store the license file or key in your secrets management process so it is recoverable without anyone's inbox. Read the About licenses documentation before requesting. Done when you hold a license record that names the plan, the user count and the expiry date you will track.
Apply and verify the license in staging
Follow the license steps in the TheHive 5 documentation for your install type and apply the key on the staging instance. Confirm that the plan the platform reports matches the plan you purchased and that the user limit reflects your current account count. Check that the Cortex and MISP connections still work after the change, since a licensing change is the wrong time to find a broken integration. Record the TheHive version, the license holder and the time of application. Done when a test analyst can open a case and run one Cortex analyzer on staging without errors.
Apply the same license in production
Repeat the verified steps on production during a maintenance window your team has agreed in advance, with a fresh backup taken just before the change. Keep the staging instance running until production has been checked, so you have a known-good reference if something differs. The platform owner runs the change, and the check matches staging: the plan, user count, organization count and connected Cortex and MISP servers all report the expected values. Done when a second administrator has confirmed those values from a separate session.
Plan for downgrade or lapse
A new install gets a 14-day Platinum trial, and once that ends without a valid license TheHive switches to read-only mode until one is applied. Ask StrangeBee whether a lapsed or expired paid license behaves the same way, and plan as if it does. For a downgrade to Community, reduce active users to 2 before the change, because Community is free for 2 users. Decide in advance who can request a renewal and how analysts will keep working, such as logging incidents in a holding location, if write access is lost. Done when the downgrade and lapse path is written down and approved by the platform owner.
Record the license and renewal owner
Write the plan, user and organization counts, license holder, expiry date and named renewal owner in your change record. Put the expiry date on a shared calendar with enough lead time to complete a renewal with StrangeBee before read-only mode could affect analysts. Keep a copy of the last working backup and the license file together so a rollback can be rehearsed on staging. Review the record after every license or user change. Done when a second person can read the record and find the renewal path without asking the platform owner.
How much does TheHive Gold or Platinum cost to run, and what does the work need?
What makes up the total cost of running TheHive Gold or Platinum?
The total is the StrangeBee license plus the infrastructure and people needed to run the platform. The license is priced per user on the Gold and Platinum plans, and StrangeBee's pricing page is the place to confirm current rates, because paid prices are not published on the page we reviewed. Infrastructure covers the TheHive server, Apache Cassandra and Elasticsearch, each running on the JVM with its own heap configuration, plus Cortex if you use analyzers and responders. Staff time covers installation, upgrades, backups, user administration and integration work. Cortex itself needs no license, so its cost is hosting and effort only.
How many users make Gold or Platinum cost more than Community?
Community is free for 2 users, so any team beyond two named users will need a paid plan to stay within the license model. Gold and Platinum are both priced per user, which means cost grows with headcount rather than with incident volume. A small team of three or four analysts should ask StrangeBee for a per-user quote for Gold and Platinum side by side, then compare the feature and support differences against its needs. Confirm how the license counts users, including read-only or occasional users, before you size the order.
How much storage should I budget for a TheHive deployment?
StrangeBee recommends 100 GB of storage for most use cases, according to its system requirements documentation. That figure is a starting point, not a sizing model. Case volume, attachments, observables and the number of Cassandra and Elasticsearch replicas all change the real footprint. Ask your team to estimate monthly case and attachment volume and retention, then test the storage growth in a pilot before committing to a production size. Storage cost recurs, because it grows with retention.
Can our own team install and run TheHive without outside help?
Yes, if you have engineers who already run JVM services, Cassandra and Elasticsearch in production. Installing TheHive on-premises is documented by StrangeBee, and the 14-day Platinum trial lets you test a full install before buying. The harder part is operations: heap tuning for each JVM component, backup and restore for both data stores, upgrades across TheHive 5.x releases, and monitoring. If none of these skills exist in-house, plan for training or outside help before go-live, not after the first incident.
How long does setting up TheHive take, and what changes the timeline?
The timeline depends on scope, and no duration is published in the documentation we reviewed, so ask StrangeBee and any implementation partner for a written estimate. The main drivers are the number of integrations (MISP servers, Cortex analyzers and responders, ticketing or SIEM links), the state of the existing infrastructure, the amount of data to migrate, and how many teams need separate workflows. A pilot with a small group of analysts usually runs before a full rollout, and that pilot should be scoped in writing.
When is outside help worth paying for with TheHive?
Outside help is worth considering when the team lacks Cassandra or Elasticsearch operations skills, when the deployment must meet a compliance or audit requirement that needs documented controls and evidence, or when integrations with MISP, Cortex and existing security tools must be built and tested. DeployOpen plans, implements, integrates, hardens, backs up, upgrades and documents self-hosted platforms inside the client's own infrastructure. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen does not publish a price list, so the quote follows from the written scope. Ongoing support and upgrades are available as retainers.
What should I ask StrangeBee and our partner for in a quote?
Ask StrangeBee for the per-user price for Gold and Platinum at your headcount, the support response times for each plan, and the terms that apply after the trial, including the read-only behavior that starts when no valid license is applied. Ask whether Community users need to request a Community license from the StrangeBee license portal in your version. Ask any implementation partner for a fixed-scope written proposal covering deliverables, the environments in scope, the integrations, handover documentation and what is excluded. Compare quotes on the same scope, and ask what recurs each year, such as licenses, support and retainers.
How DeployOpen scopes and supports TheHive on your infrastructure
TheHive 5 on-premises runs in your own environment, so the plan choice is only one part of the work. DeployOpen plans, implements, hardens, backs up and supports the platform there, under fixed-scope engagements with written deliverables and optional retainers. The cards below set out what that covers and what you should confirm with StrangeBee before you commit.
Fixed-scope engagement and written deliverables
Most DeployOpen engagements are fixed-scope, so the scope, deliverables and timelines are agreed in writing before work starts. For a TheHive decision, the scope should name the TheHive, Cassandra and Elasticsearch components, the number of users and organizations in use, and whether Cortex and MISP are included. Ask for the written scope to list what is excluded, such as license purchases, which remain your responsibility. DeployOpen does not publish a price list, so a quote follows from that written scope.
Licensing stays with StrangeBee
DeployOpen does not issue TheHive licenses. Community, Gold and Platinum are sold and licensed by StrangeBee, and DeployOpen is not a StrangeBee partner unless that is stated in a fact supplied with the topic. Confirm the plan, user count and license terms directly with StrangeBee, then ask DeployOpen to build the installation and license workflow around them. Gold and Platinum are priced per user, so the number of named users should be fixed in the scope before the license request.
Trial expiry and read-only planning
A 14-day Platinum trial starts with the on-premises install. After it ends, TheHive switches to read-only mode until a valid license is applied. For a production rollout, the implementation plan should set a license date ahead of the trial end, test the license application on a staging copy, and document who owns that step. Since version 5.3, Community users must request a Community license from the StrangeBee license portal, so that request belongs in the runbook too.
Hardening and backup of the stack
A TheHive deployment runs TheHive, Apache Cassandra and Elasticsearch, each on the JVM with its own heap configuration. DeployOpen hardens these components and designs backup and restore for the data they hold, within the environment you provide. Ask for the backup scope to cover Cassandra and Elasticsearch together, a tested restore procedure and the retention period you need. Storage sizing should start from StrangeBee's system requirements, which recommend 100 GB for most use cases, and be adjusted for your case volume and attachments.
Cortex and MISP integration work
Cortex is open source and needs no license, so its cost sits in deployment and maintenance rather than in plan fees. MISP integration is a separate work item: TheHive can import MISP taxonomies and connect to one or more MISP servers to turn events into alerts. Each MISP server, analyzer and responder adds configuration and testing. Confirm which Cortex analyzers and MISP servers your team needs before the plan is chosen, because those counts drive both the scope and the Community versus paid decision.
Upgrades and ongoing support through retainers
Ongoing support, upgrades and continuous testing are available as retainers, separate from the initial fixed-scope build. TheHive 5 has had point releases such as 5.8.0 and 5.8.1, so an upgrade calendar should be part of the retainer scope. Ask DeployOpen to test each upgrade against your Cassandra and Elasticsearch versions, your MISP connections and your license state before it reaches production. Retainer terms, response expectations and included hours are set in writing, not assumed here.
