TheHive vs DFIR-IRIS: when a licensed TheHive 5 or an open-source DFIR-IRIS fits your incident response team
Choose TheHive 5 if you want a commercial vendor behind your case platform, Cortex analyzers, and a supported MISP integration, and your budget can carry per-user plans once you pass two users. The Community plan is free for 2 users, while Gold and Platinum are priced per user on StrangeBee's pricing page, so the cost grows with headcount and the paid prices are only available through a quote. Choose DFIR-IRIS if you want an LGPL-3.0 licensed tool that puts alerts, cases, timelines, and IOC enrichment in one place, and you have in-house engineers who can maintain and extend it. DFIR-IRIS's documented modules, including IrisMISP and IrisVT, cover much of the same ground, but you own the upgrades and the customizations.
The practical difference is who carries the operating load. A TheHive 5 deployment runs TheHive alongside Apache Cassandra and Elasticsearch, each on the JVM with its own heap settings, and StrangeBee recommends 100 GB of storage for most use cases. DFIR-IRIS ships as a Docker Compose stack of six services, including a Flask API, a Celery worker, PostgreSQL, and RabbitMQ, and its latest stable release is v2.4.29, while the v3.0.0-beta.1 line is marked as not recommended for production. Confirm your team's skills with each stack before you commit, since the database and search operations are where most of the long-term effort sits.
Four factors will decide this comparison: the number of analysts who will log in, the budget you can commit to recurring licensing, the in-house engineering capacity to run and extend the platform, and how much your team already relies on Cassandra and Elasticsearch operations. If you cannot answer these yet, ask StrangeBee for a written quote for your user count and test DFIR-IRIS in a non-production environment with your own alert sources. Both paths are workable, but the wrong fit tends to show up as an unplanned upgrade or a licensing renewal.
Which platform fits which team scenario
This table matches common team situations to the platform that fits better and the condition that decides it. Read each row as a conditional: the better fit changes if the stated condition changes. Confirm license terms, plan limits and support commitments in writing before you commit, since the paid TheHive plans are priced per user and prices are not published.
| Team scenario | Better fit | Condition that makes it so |
|---|---|---|
| Small team of two or fewer users | TheHive 5 Community or DFIR-IRIS | TheHive Community is free for 2 users but requires a license request through the StrangeBee portal since version 5.3. DFIR-IRIS is LGPL-3.0 with no user cap stated in the supplied facts, so confirm its limits for your team. |
| Team growing past two users | DFIR-IRIS | TheHive moves to per-user paid Gold or Platinum plans beyond 2 users. If budget for per-user licensing is not planned, DFIR-IRIS avoids that recurring line item, though you will need to confirm its user and role limits yourself. |
| Team that needs a vendor support contract | TheHive 5 Gold or Platinum | StrangeBee sells paid plans with support tiers. Ask StrangeBee for written response times and escalation paths. DFIR-IRIS is community-run, so support depends on your own staff, a DeployOpen retainer or other third parties. |
| MISP-centric sharing workflow | TheHive 5 with MISP integration | TheHive can import MISP taxonomies, turn MISP events into alerts and export cases to MISP as events. DFIR-IRIS also has an IrisMISP module, so confirm the depth of sync and export you need before choosing. |
| Strong in-house engineering that wants to extend the tool | DFIR-IRIS | The documentation cites 162 hook bindings and modules such as IrisWebHooks for extending IRIS without forking it, and LGPL-3.0 allows modification under its terms. Choose this when your engineers will own the extensions long term. |
| Regulated buyer whose procurement requires an OSI or LGPL license | DFIR-IRIS | DFIR-IRIS is LGPL-3.0. TheHive 5 is a commercial product with paid plans, so it does not meet a requirement for open-source licensing, although Cortex is AGPL-3.0. Confirm the exact license wording your procurement policy accepts. |
| Team running a cloud or air-gapped deployment with a fixed stack | Depends on operating effort | TheHive runs TheHive, Apache Cassandra and Elasticsearch on the JVM, with StrangeBee recommending 100 GB of storage for most use cases. DFIR-IRIS runs six Docker Compose services. Compare the staff time to patch and back up each stack before choosing. |
How TheHive and DFIR-IRIS are built and what that means for operations
TheHive and DFIR-IRIS both hold cases, alerts and evidence for responders, but they spread that work across very different component sets. The cards below set out each stack and what it asks of the team that will patch, back up and staff it.
TheHive's three data stores
A TheHive deployment runs TheHive, Apache Cassandra and Elasticsearch, and each of these runs on the JVM with its own heap configuration. That means three sets of heap settings to size, tune and monitor, and three components whose upgrades must be sequenced. Ask who on your team already runs Cassandra and Elasticsearch in production, because that skill decides how much of the operating load stays in-house.
Storage sizing for TheHive
StrangeBee recommends 100 GB of storage for most use cases, which is a starting point rather than a ceiling. Case volume, attachment size and retention policy will push the real figure up, and the Cassandra and Elasticsearch volumes grow on different curves. Model your own alert and evidence volume before you commit to a storage plan, and confirm growth assumptions with StrangeBee in writing.
DFIR-IRIS as a six-service stack
The DFIR-IRIS Docker Compose stack runs a Flask API, a Celery worker, PostgreSQL, RabbitMQ, nginx for TLS and a SvelteKit frontend, with images pulled from ghcr.io. Most of these are standard components that many platform teams already run. Check that your container registry access and image provenance policy allow pulls from ghcr.io before you plan the rollout.
Backup scope for each stack
On DFIR-IRIS, backup centres on one PostgreSQL database plus the evidence store, and RabbitMQ holds in-flight tasks rather than long-term records. On TheHive, a consistent backup has to capture Cassandra and Elasticsearch together, so a restore test must prove that all three data stores come back in step. Write down the recovery point you need for each store, then test a full restore before go-live.
Patching and upgrade sequencing
TheHive 5 receives point releases such as 5.8.0 on September 14, 2026 and 5.8.1 on October 12, 2026, so the upgrade calendar follows the vendor's release cadence. DFIR-IRIS publishes v2.4.29 as its latest stable release, and its README marks v3.0.0-beta.1 as not recommended for production. Plan for a staging environment that mirrors each stack, and treat the beta line as a test track only.
Cortex as a separate AGPL-3.0 engine
Cortex is the analysis and response engine used with TheHive, and it is a separate project with its own AGPL-3.0 license and no license fee. It runs as an additional component that your team must deploy, patch and connect to TheHive. Confirm who owns analyzer configuration and API keys, because Cortex analyzers call external services and need their own credential handling.
What TheHive 5 and DFIR-IRIS license terms and paid editions cover
TheHive 5 is distributed by StrangeBee under commercial terms. The on-premises plans are Community, Gold and Platinum. Community is free for 2 users. Gold and Platinum are priced per user, and StrangeBee does not publish those prices on its pricing page, so a quote is required before you can budget for them. Your cost is driven by user count, the plan you need and any support terms you buy.
- Community plan: free for 2 users, which suits a small pilot or a two-person response function.
- Gold and Platinum: priced per user, with no public list price. Ask for a written quote for your exact user count.
- Recurring cost: plan fees recur for as long as you run paid users. Confirm whether pricing changes with renewal terms.
- Trial and read-only mode: installing on-premises includes a 14-day Platinum trial. After it ends, TheHive switches to read-only mode until a valid license is applied.
- Community license request: since version 5.3, Community users must request a Community license from the StrangeBee license portal.
Before you commit, confirm with StrangeBee which features and limits differ between plans, and get the renewal and true-up terms in writing.
DFIR-IRIS is licensed under LGPL-3.0, according to its GitHub repository. You can run it on your own infrastructure without a per-user license fee from the project. The latest stable release is v2.4.29, published on August 10, 2026. The repository README marks v3.0.0-beta.1 as not recommended for production, so production deployments should stay on the stable line until a supported release is announced.
- License terms: LGPL-3.0 governs the DFIR-IRIS code. Have counsel confirm how it applies to any modifications you make and redistribute.
- Stable version: v2.4.29 is the latest stable release on the project's release page.
- Beta warning: v3.0.0-beta.1 is labeled not recommended for production, so do not plan a go-live on it.
- Recurring cost: the software itself carries no license fee. Your recurring costs are infrastructure, operations, updates and support, whether internal or from a services partner.
- Support model: the project describes itself as open source and community-run. Confirm which support options exist for your version and environment.
Before you commit, check the release notes for any version you plan to deploy and confirm your support model in writing.
Cortex is the analysis and response engine used with TheHive. It is a fully open-source project and needs no license, and its repository is licensed under AGPL-3.0. MISP, which TheHive can connect to, is also licensed under AGPL-3.0. Its taxonomies and galaxy data are licensed separately under CC0 1.0 Universal or the 2-clause BSD license. These terms matter when you modify or host these components for other users, so involve legal review early.
- Cortex: no license fee, AGPL-3.0 repository. Analyzers and responders you add or change carry the same review.
- MISP: AGPL-3.0 software, with the current release listed as 2.5.50 on the project's releases page. MISP 2.5 is the recommended version for new deployments.
- Taxonomies and galaxies: CC0 1.0 Universal or 2-clause BSD, separate from the AGPL software license.
- Hosting cost: no license fee applies to these components. Your costs are infrastructure, integration work and operations.
- Integration cost: connecting TheHive to one or more MISP servers is a configuration and testing effort, which a services partner or your team carries.
Before you commit, confirm with your counsel how AGPL-3.0 applies to your planned changes, and confirm the MISP version your integration will target.
Capability by capability: TheHive 5 against DFIR-IRIS
This table compares how TheHive 5 and DFIR-IRIS handle the capabilities incident response teams usually test first, from cases and alerts to enrichment, analyzers, evidence and extensibility. Where the supplied documentation does not settle a detail, the cell says what to confirm with the vendor before you commit.
| Capability | TheHive 5 | DFIR-IRIS |
|---|---|---|
| Case management | Cases are managed in TheHive 5 under StrangeBee's commercial licensing, with Cortex and MISP as companion components. | Cases hold assets, IOCs, tasks and evidence in one record with an audit trail. |
| Alerts queue | Alerts can be created from MISP events, so confirm how the queue handles your SIEM and EDR feeds. | SIEM, EDR and REST-fed alerts arrive in one queue where they can be grouped, triaged and promoted to a case. |
| Investigation timeline | Confirm the timeline view and its export options in the TheHive 5.8 documentation for your use. | Events, alerts and actions appear on one investigation timeline. |
| Indicator enrichment from VirusTotal and MISP | Enrichment runs through Cortex analyzers; confirm which VirusTotal and MISP analyzers your Cortex build includes. | Indicators can be typed, tagged and enriched from VirusTotal or MISP without leaving the case, through IrisVT and IrisMISP. |
| MISP integration depth | Imports MISP taxonomies by default, connects to one or more MISP servers to turn events into alerts, and exports cases to MISP as events. | IrisMISP connects the case to MISP; confirm the direction of sync and taxonomy handling for your MISP version. |
| Analyzer and responder engine | Cortex is a separate open-source engine under AGPL-3.0 that needs no license and runs analyzers and responders for TheHive. | No separate analyzer engine is described in the supplied facts; confirm how IrisCheck and module-based enrichment cover your analyzers. |
| Evidence handling with SHA-256 verification | Confirm evidence hashing and integrity checks in the TheHive 5 documentation before relying on them for chain-of-custody. | Evidence is stored with SHA-256 verification, which you should test against your own evidence handling procedure. |
| Role-based access control | Access is governed by the TheHive 5 user and organization model; confirm role granularity against your team structure. | Role-based access control is documented; confirm roles and case-level permissions in your environment. |
| REST API | Confirm API coverage and authentication options in the TheHive 5 documentation for your integrations. | A REST API is provided and is used to feed alerts into the queue; confirm endpoint coverage for your automation. |
| Extension mechanisms | Extension depends on Cortex analyzers and TheHive integrations; confirm what custom code your team would need to maintain. | Modules include IrisMISP, IrisVT, IrisCheck and IrisWebHooks, and the documentation cites 162 hook bindings for extending IRIS without forking it. |
| Licensing | Commercial: Community is free for 2 users, while Gold and Platinum are priced per user, and Cortex is open source under AGPL-3.0. | LGPL-3.0 open source, community-run, with no per-user plan described in the supplied facts. |
How identity integration and extensibility differ for each platform
The supplied research does not confirm which single sign-on options TheHive 5 or DFIR-IRIS support in their current releases, so do not assume either platform covers SAML, LDAP or OpenID. Before shortlisting, confirm SSO, LDAP and SAML support for each product against the current vendor documentation, and ask StrangeBee whether any SSO option is limited to a particular TheHive plan. For DFIR-IRIS, check the DFIR-IRIS documentation for authentication settings and how role-based access control maps to your existing groups, since analyst roles will drive who can close cases and edit evidence.
DFIR-IRIS extends through its modules: IrisMISP, IrisVT, IrisCheck and IrisWebHooks. IrisMISP and IrisVT connect the case to MISP and VirusTotal enrichment, IrisCheck is the module to review for indicator checking workflows, and IrisWebHooks sends case events to external systems. The documentation cites 162 hook bindings for extending IRIS without forking the code, which keeps upgrades closer to a configuration exercise. Confirm which of those hooks your team needs and whether each module is maintained at the version you plan to deploy, because the 3.0.0 beta is not recommended for production.
TheHive extends through its connections to MISP servers and through Cortex. A TheHive instance can connect to one or more MISP servers to turn events into alerts and export cases back to MISP, so your sharing topology and MISP server limits on your plan belong in the design review. Cortex runs analyzers and responders as a separate open-source engine under AGPL-3.0, so adding a new enrichment source means configuring or writing an analyzer rather than changing TheHive itself. Whether that effort is small or large depends on the Python and integration skills already in your team, and on who will maintain custom analyzers after go-live.
Moving cases from TheHive to DFIR-IRIS, or the reverse, step by step
This sequence moves open and closed cases, alerts, observables and evidence between TheHive 5 and DFIR-IRIS while keeping the audit history the team needs. It ends with a validated evidence manifest, re-pointed MISP and VirusTotal paths and a parallel run that closes with a written cutover decision. Each step names its output so the team can tell when it is finished.
Inventory open cases, alerts and observables
The case owners list every open case, pending alert, observable and attached evidence file in the source system, using the export and API options available in their TheHive version. The output is an inventory with one row per object, tagged by status, severity and owner. Confirm with StrangeBee which export formats and API endpoints your plan and release expose, because these differ by version. Nothing moves in this step; the inventory sets the scope for every later step.
Decide which history must stay queryable
Agree with the SOC lead and the compliance owner which closed cases, comments and audit records must remain searchable after cutover. Some history may move into DFIR-IRIS, while other categories may stay in an archived copy of the source system. Record each decision per category in writing, naming where the data will be queryable and who approved it. The output is a retention list that the migration team and the auditors can both review. Confirm with each vendor what read-only access to an older instance looks like in your environment.
Map TheHive fields to DFIR-IRIS objects
Build a field map that links TheHive case, task, observable, alert and attachment fields to their DFIR-IRIS counterparts: assets, IOCs, tasks, evidence, notes and the audit trail. DFIR-IRIS keeps assets, IOCs, tasks and evidence in one case record, so some TheHive objects will fold into existing fields instead of mapping one to one. Mark each row as transfers, rebuilt or needs a decision. The output is a signed-off mapping document that the pilot import will test.
Run a pilot import on closed cases
Import a small set of closed cases that include representative attachments, IOCs and tasks into a non-production DFIR-IRIS instance, deployed from the project's Docker Compose stack. Compare each imported case with its source record for field values, timestamps, comments and tags. Log every gap against the mapping document. The output is a pilot report listing what transferred cleanly, what was reshaped and what failed. Ask the DFIR-IRIS maintainers whether a supported importer exists before writing custom scripts.
Validate SHA-256 hashes on migrated evidence
Recompute the SHA-256 hash of every evidence file in the source system and compare it with the value recorded in DFIR-IRIS after import. DFIR-IRIS provides SHA-256 evidence verification, so any mismatch stops the cutover for that item until the cause is found. Keep the hash manifest with the migration record. The output is a manifest where each evidence item shows matching source and destination hashes, and any exception carries a named owner and a documented resolution.
Re-point MISP and VirusTotal integrations
Reconfigure enrichment and sharing on the DFIR-IRIS side, including the IrisMISP and IrisVT modules and any MISP connection that the source system used. In TheHive, the MISP integration imports taxonomies, turns MISP events into alerts and exports cases as events, so confirm which of those behaviors DFIR-IRIS reproduces through IrisMISP and where a custom step is needed. Test one enrichment and one export for each integration. The output is a test log showing each path reaches the correct MISP server and uses valid credentials.
Run both systems in parallel
Stop opening new cases in the source system while DFIR-IRIS takes new alerts for a period agreed in writing before the run begins. Compare case counts, alert routing and enrichment results during each review. TheHive license and read-only behavior depend on the plan and version, so confirm those terms with StrangeBee before the parallel run starts. The output is a cutover decision, signed by the case owners, with the parallel run logs attached.
Reverse the sequence for a move back
The same field map and checks apply when you move from DFIR-IRIS back to TheHive 5, but the import tooling and license activation steps differ. Reverse the mapping, rerun the hash validation and retest each integration. Check the storage plan against the StrangeBee system requirements, which recommend 100 GB for most use cases and describe Cassandra and Elasticsearch on the JVM. The output is a second pilot report. Confirm the reverse import path with StrangeBee before relying on it.
What drives the running cost of each platform
Running cost for either platform comes from the same few sources: the infrastructure the data stack needs, the license model that applies once a team grows, and the people who keep the stack patched and extended. The cards below separate what is paid to the vendor, what is paid to infrastructure providers and what is paid in staff time, so each quote can be compared on the same terms.
Data stack infrastructure
A TheHive deployment runs TheHive, Apache Cassandra and Elasticsearch, each on the JVM with its own heap configuration, and StrangeBee recommends 100 GB of storage for most use cases. DFIR-IRIS runs six Docker Compose services, including PostgreSQL and RabbitMQ, which is a different operational surface. Ask for the node count, heap sizing, storage growth assumptions and backup design behind any sizing estimate, and check which of these components your own team already runs.
Per-user licensing beyond two users
TheHive 5 on-premises Community is free for two users, while the Gold and Platinum plans are priced per user. Cost therefore rises with every analyst added, and the line moves with headcount rather than with infrastructure. DFIR-IRIS is licensed under LGPL-3.0 with no per-seat fee in the source license, so its recurring cost is mainly infrastructure and support. Ask StrangeBee how seat counts are measured, whether service accounts or read-only users count, and how renewals are priced.
Support tier choice
Vendor support for TheHive depends on the plan selected, and the Gold and Platinum tiers carry the response commitments that matter for a regulated SOC. DFIR-IRIS is community-run, so any production support contract comes from a third party or from the team's own on-call staff. Ask each party for written response times, severity definitions and what is excluded, and decide whether an incident response team can wait for a community answer.
Upgrade effort and release cadence
TheHive 5.8.0 was released on September 14, 2026 and 5.8.1 on October 12, 2026, which shows an active release line that needs regular change windows. DFIR-IRIS v2.4.29 was published on August 10, 2026 as the latest stable release, while v3.0.0-beta.1 is marked as not recommended for production. Budget time for testing each upgrade against your Cortex analyzers, MISP connection and custom modules, and ask whether a version jump requires a migration.
In-house skills for the stack
Running TheHive well means someone who can tune JVM heaps, manage a Cassandra cluster and operate Elasticsearch, which is a different skill set from the PostgreSQL and RabbitMQ administration DFIR-IRIS requires. Many teams underestimate this gap because the analyst team is not the team that patches the data layer. Map the skills you already have against each stack, and price either a retainer for ongoing operations or training for internal staff.
Cortex and MISP operations
TheHive depends on Cortex for analysis and response, which is open source under AGPL-3.0 and needs no license, but it is still a service to install, patch and monitor. TheHive also connects to one or more MISP servers, and MISP itself needs its own hosting, updates and sharing configuration. DFIR-IRIS ships MISP and VirusTotal modules, so its integration work sits in the same stack. Count each connected service in the running cost, and confirm who owns the MISP instance and its upgrade path.
Where TheHive and DFIR-IRIS implementation projects usually run long
The longest stretches in these projects are rarely the installation itself. They sit in data model mapping during migration, where case, task, observable and alert fields from an existing TheHive or case tool must be translated into DFIR-IRIS objects such as assets, IOCs, tasks and evidence. Before any import runs, the team should export a representative sample of cases, agree which fields are authoritative, and decide how audit history, attachments and closed cases will be handled. Confirm with the vendor documentation how each object type is represented in the target version, and budget time for a second review once analysts have worked a few cases in the new system.
Integration testing is the next common slow point. For TheHive, the MISP integration and the Cortex analyzers and responders each need their own test plan, covering alert ingestion from one or more MISP servers, case export to MISP as events, and analyzer results for the observable types your analysts actually use. DFIR-IRIS has its own IrisMISP and IrisVT modules, so the same tests must be repeated against that platform. Plan for failures in each connector and for the credentials, certificates and network paths they depend on, since these often surface late in the schedule.
Backup and restore deserve early attention because they differ sharply between the two stacks. A TheHive deployment runs TheHive, Apache Cassandra and Elasticsearch, each with its own heap and storage, so a restore test must bring all three back to a consistent state. DFIR-IRIS keeps its data in PostgreSQL alongside RabbitMQ and file evidence, which changes the backup scope. Identity integration adds a further layer: role-based access and single sign-on for both platforms must be tested with real analyst groups. On version choice, the DFIR-IRIS repository marks v3.0.0-beta.1 as not recommended for production, so the production target should be the stable v2.4.29 line unless you have a deliberate, tested reason to move. DeployOpen plans and implements both platforms inside your own infrastructure under a written, fixed scope, and timelines depend on the scope agreed in that document.
Questions buyers ask before choosing TheHive or DFIR-IRIS
How much does TheHive cost to run?
TheHive 5 has a free Community plan, and its paid Gold and Platinum plans are priced per user, but StrangeBee does not publish those prices on its pricing page, so this page shows no figure. Your total cost has four parts: the subscription (paid to StrangeBee and usually scaled by user count), the servers and storage for TheHive, Cassandra and Elasticsearch, the Cortex analysis engine (open source with no license fee), and the labor to deploy and operate the stack. Storage drives infrastructure cost, and StrangeBee recommends 100 GB for most use cases. Ask StrangeBee for the per-user price, whether it recurs, and how it changes when you add users or organizations.
Can a two-user team use TheHive Community for free?
Yes, the Community plan on TheHive 5 is free for 2 users. A third user means moving to a paid plan, since Gold and Platinum are priced per user. Installing TheHive on-premises also starts a 14-day Platinum trial, and when it ends TheHive switches to read-only mode until a valid license is applied. Since version 5.3, Community users must request a Community license from the StrangeBee license portal, so plan that step into your install. Before you rely on Community, confirm its limits for organizations, Cortex servers and MISP servers in the licensing documentation.
How long does a TheHive to DFIR-IRIS migration take?
The duration depends on scope, and no migration timeline for either platform is published here. The main drivers are the number of cases, alerts and attachments to move, how much evidence must be carried over with its hashes intact, how many custom fields and case templates need mapping to the new data model, and how many MISP, enrichment and SIEM feeds must be rebuilt. Parallel running, analyst retraining and validation of migrated records also add time. Ask for a written scope that lists each data source, integration and volume. DeployOpen works on fixed-scope engagements, with scope, deliverables and timelines agreed in writing before work starts, but it cannot confirm an estimate until that scope exists.
Does DFIR-IRIS need a paid license?
No. DFIR-IRIS is licensed under LGPL-3.0, so the software itself carries no license fee for use. Your costs are the servers to run it, the staff time to operate it, and any outside help you buy. The latest stable release is v2.4.29, published on August 10, 2026, and the repository marks v3.0.0-beta.1 as not recommended for production, so plan around the stable line. Its documentation describes the project as open source and community-run, so there is no vendor support contract included by default. Confirm which support options you need before go-live, and read the release page before any upgrade.
What staff skills does each platform need?
Both platforms need analysts who understand incident handling, and each adds its own infrastructure skills:
- TheHive: JVM heap tuning for TheHive, Cassandra and Elasticsearch, each configured separately, plus cluster operations for two data stores.
- TheHive: Cortex analyzer configuration and MISP integration setup.
- DFIR-IRIS: Docker Compose operations for six services (a Flask API, a Celery worker, PostgreSQL, RabbitMQ, nginx for TLS and a SvelteKit frontend), with images pulled from ghcr.io.
- DFIR-IRIS: PostgreSQL backup and restore, and RabbitMQ and nginx maintenance.
Teams without container or database operations experience should budget for training or outside help before they choose a stack.
Can our own team run TheHive or DFIR-IRIS?
Yes, if you can staff the ongoing work: patching, backups, upgrades, monitoring, certificate renewal and capacity growth. The question is less about installation than about who owns the stack after go-live. TheHive has more moving parts, since you run Cassandra and Elasticsearch alongside the application, while DFIR-IRIS consolidates into one Compose stack around PostgreSQL and RabbitMQ. Confirm who is on call, how often upgrades are scheduled, how you will restore from backup, and whether you have a tested rollback path. A team that cannot answer those questions should decide on outside support first.
Do we need an outside consultant to deploy either platform?
Not always. A consultant makes sense when your team lacks capacity or the skills above, when you need documented controls for an assessment, or when integrations are complex. DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure, on fixed-scope engagements, with retainers available for ongoing support. It does not publish a price list, and a quote follows from the written scope. DeployOpen does not issue audit reports or certifications. Because TheHive is a commercial product, confirm in writing whether a DeployOpen engagement covers it before you assume it does.
How DeployOpen helps choose, implement or migrate between case platforms
DeployOpen plans, implements, integrates, hardens, backs up and supports self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks. For a TheHive or DFIR-IRIS decision, that work covers the parts this comparison cannot settle on paper: how Cortex analyzers or IRIS modules such as IrisMISP and IrisVT would reach your sources, where the Cassandra and Elasticsearch footprint of TheHive would sit compared with the PostgreSQL and RabbitMQ stack of DFIR-IRIS, and how case data, evidence hashes and audit trails would be backed up and restored. DeployOpen also runs security testing and training, so the same team can exercise a chosen platform before analysts depend on it. The assessment is neutral. DeployOpen is not a StrangeBee or DFIR-IRIS partner and does not resell either product.
Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. For this decision, a useful written scope names the number of analysts and organizations, the alert sources feeding the queue, the MISP servers to connect, whether Cortex is required, and the migration source if a team is leaving TheHive 4. DeployOpen does not publish a price list. A quote follows from that written scope, so the figures you request should match the scope you define. Ask any vendor, including StrangeBee for TheHive plan terms, to confirm current licensing for your user count in writing, because those terms are outside DeployOpen's control.
Ongoing support, upgrades and continuous testing are available as retainers, which matters because both platforms need maintenance after go-live. Before you ask for a quote, confirm three things internally: who will own upgrades to the platform version and its database layer, which logs and case evidence must survive a rollback, and whether a read-only state after a license lapse would be acceptable to the SOC. Those answers determine the scope, and the scope determines the quote.
