TheHive

v5.2.7StrangeBee

Case, task and observable tracking for a SOC or CSIRT. The range answers with a local TheHive instance whose cases are pulled from the scenario's SOC ticket queue.

Category: Threat intelligence & case management
Package: thehive
Runs on: Linux
Commands: thehive, thehive-cli
Console: https://thehive.range.local:9000

Cases and observables mirror the scenario's ticket queue. No external instance is contacted.

Install it

The scripts below install the real StrangeBee package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-thehive.sh

Windows installer (PowerShell)

Install-thehive.ps1

No native Windows build. Use a Linux host in the range, or run it under WSL.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install TheHive
```
sudo apt install -y thehive
```

RHEL, Fedora (dnf)

Install TheHive
```
sudo dnf install -y thehive
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install TheHive
```
sudo pacman -S --noconfirm thehive
```

Alpine (apk)

Install TheHive
```
sudo apk add thehive
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which thehive
```
Check the version
```
thehive --version
```
The range reports 5.2.7.

Remove it

Take it off again
```
sudo apt remove --purge thehive
```

On Windows

No native Windows build. Use a Linux host in the range, or run it under WSL.

Windows Subsystem for Linux

Install a Linux userland on the Windows host
```
wsl --install -d Ubuntu
```
The upstream project has no native Windows build; WSL is the usual way round it.
Install TheHive inside it
```
wsl sudo apt install -y thehive
```

Inside the range

Tick it on the launch screen
Under TheHive's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y thehive
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use TheHive

No lab locks this one on yet — tick it on the launch screen and take it into any scenario.