StrangeBee is a French cybersecurity company that builds TheHive, a Cybersecurity Incident Response Management (CIRM) platform for SOC, CERT, CSIRT and MSSP teams. It gives analysts one workspace for alerts, cases and investigations, so they can move from a raw alert to a documented, closed incident without switching tools.
The problem it addresses is familiar to most security operations teams: alerts arrive from many tools, context is scattered, and response steps and evidence end up in chat threads and spreadsheets. StrangeBee’s platform puts that work in one place and automates the repetitive parts.
At A Glance
| Vendor | StrangeBee |
|---|---|
| Category | Security operations, incident response management |
| Deployment | On-premises, SaaS in a dedicated AWS environment, images on AWS and Azure |
| Agentic AI | TheHive MCP Server, bring your own LLM in TheHive Flow |
| Customers | Leiden University, University of St Andrews, Thales CERT, OpenClassrooms |
| Market classification | Security Operations |
What StrangeBee Does
StrangeBee organises incident response around the life of an incident rather than around individual tools. Alerts are triaged in one place and escalated into cases, analysts investigate with the full context in front of them, and response actions, tasks, deadlines and reports are tracked against the case with an audit trail. Analysis and enrichment run automatically in the background, repetitive steps are turned into workflows, and AI assistants can work inside the same platform under an analyst’s permissions. MSSPs and teams serving several clients keep each client in a separate organisation.
Products
TheHive
TheHive is the case management heart of the portfolio, for security teams that are drowning in alerts spread across many tools. It offers alert triage with an Alert Feeder, private cases, reusable case templates, custom fields, SLA tracking, dashboards and KPIs. It is also sold as TheHive Cloud Platform, a SaaS version run in a secure, dedicated AWS environment for each customer, for teams that want TheHive without running servers.
Cortex
Cortex is the analysis and response engine behind TheHive. It ships more than a hundred analyzers for popular services such as VirusTotal and Shodan, runs batch analysis on many observables at once, and lets teams write their own responders that mirror their response processes. Cortex is open source on GitHub, and other products can call it through its REST API or the Cortex4py library.
TheHive Flow
TheHive Flow is native orchestration for teams that want to automate repetitive steps. Workflows start from an alert, a case, a schedule or a webhook. Analysts build them in a visual editor and extend them with custom Python or JavaScript, and every run and step result is recorded. Teams can bring their own LLM into workflows for tasks such as alert summaries and observable classification.
TheHive MCP Server
The MCP Server connects LLMs such as Claude or ChatGPT, and any other MCP-compatible client, directly to TheHive. It is for analysts who would rather ask for an action in plain language than click through it: an assistant can create and update cases, add and enrich observables and run Cortex analyzers on an observable. It acts within the permissions of the configured user account, so an assistant sees and changes only what that analyst is already allowed to. The server is generally available.
How It Works
TheHive can be self-hosted on the customer’s own infrastructure, consumed as the Cloud Platform, or deployed from TheHive Cloud Images and automated templates on AWS and Azure. On the Cloud Platform StrangeBee maintains the service; in the other two models the customer runs it. Fully on-premises setups, including the MCP Server, keep all data inside the customer’s environment.
Cortex runs analyzers and responders on TheHive’s behalf. Analyzers can query the customer’s own legacy and third-party services using that customer’s settings and credentials. Cortex also supports multiple organisations, each with its own users and default analyzer and responder settings.
Integrations
| Area | Integrations |
|---|---|
| Threat intelligence sharing | MISP |
| Enrichment | VirusTotal, AbuseIPDB, Shodan |
| Malware analysis | VMRay |
| Network fingerprinting | JA4+ |
TheHive also connects to SIEM, EDR, ticketing and email tools, with more than 300 integrations in total.
Company Background
| Founded | 2018, by Thomas Franco, Nabil Adouani and Jérôme Léonard, the creators of TheHive and Cortex. |
|---|---|
| Headquarters | Paris, France. |
| Leadership | Nabil Adouani (CEO), Jérôme Léonard (COO), Thomas Franco (CTO). |
| Scale | More than 90 staff, and more than 5,000 reported analyst users of TheHive in more than 50 countries. |
| Compliance | SOC 2 Type 1 and Type 2 for TheHive Cloud Platform. |
Note: This overview is compiled from StrangeBee’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.