Migrating from TheHive to OpenSOAR¶

TheHive was archived in December 2025. If you're one of the 3,900+ users looking for a new home, OpenSOAR is a natural fit — open-source, Python-native, and built for the same SOC workflows you already know.

This guide maps TheHive concepts to OpenSOAR, walks through the migration process, and is honest about what's different.

Concept Mapping¶

What You Gain¶

Moving to OpenSOAR isn't just a lateral move. You get capabilities TheHive never had:

AI-Powered SOC (Built-In, Free)¶

• Alert Summarization — LLM-generated plain-English summaries of any alert
• AI Triage — Automated severity and determination suggestions with confidence scores
• Auto-Resolve — Batch evaluation of alerts for automatic benign resolution
• Correlation Analysis — LLM-assisted grouping of related alerts into attack chains
• Playbook Generation — Describe what you want in English, get production Python code

Python-Native Playbooks¶

TheHive required Cortex (a separate Java service) with analyzers packaged as Docker containers. OpenSOAR playbooks are plain Python with decorators:

from opensoar import playbook, action, Alert

@playbook(trigger="webhook", conditions={"severity": ["high", "critical"]})
async def enrich_and_notify(alert: Alert):
    vt_result = await lookup_virustotal(alert.iocs)
    await send_slack_alert(alert, vt_result)

@action(name="virustotal.lookup", timeout=30, retries=2)
async def lookup_virustotal(iocs: list):
    # Full Python stdlib — no sandbox, no container overhead
    ...

No Docker socket mounts. No Cortex service. No analyzer versioning headaches.

Simpler Architecture¶

What You Lose (Gaps to Know About)¶

We believe in being honest. Here's what TheHive had that OpenSOAR doesn't — yet:

Many of these gaps are on the roadmap. Contributions welcome.

Migration Steps¶

Prerequisites¶

• A running TheHive instance (or access to its API/database backups)
• A running OpenSOAR instance (deployment guide)
• Python 3.10+ with requests installed
• API keys for both platforms

Step 1: Export Data from TheHive¶

The cleanest way to export is via TheHive's REST API. If your instance is still running:

# Install the export helper
pip install requests

# Run the export script (see scripts/migrate_from_thehive.py)
python scripts/migrate_from_thehive.py export \
  --thehive-url https://thehive.example.com \
  --thehive-api-key YOUR_THEHIVE_API_KEY \
  --output-dir ./thehive-export

This exports: - All alerts (with observables) - All cases (with tasks, observables, and task logs) - Case-alert links - Users (for reference — not imported directly)

If your TheHive instance is offline, you'll need to work from database backups: - TheHive 3: Export from Elasticsearch using elasticdump - TheHive ⅘: Export from Cassandra using cqlsh COPY or Spark

Step 2: Transform and Import to OpenSOAR¶

python scripts/migrate_from_thehive.py import \
  --opensoar-url http://localhost:8000 \
  --opensoar-api-key YOUR_OPENSOAR_API_KEY \
  --input-dir ./thehive-export

The import script handles:

1. Alerts — Maps TheHive alerts to OpenSOAR alerts:
2. severity 1-4 → low, medium, high, critical
3. status New/Updated → new, Ignored → resolved (determination: benign), Imported → new
4. source + sourceRef → source + source_id
5. tags → tags
6. artifacts → observables (created and linked)

7. Full original payload preserved in raw_payload

8. Cases → Incidents — Maps TheHive cases to OpenSOAR incidents:

9. title, description, severity, tags map directly
10. status Open → open, Resolved/Deleted → closed

11. Case-alert links preserved via incident-alert associations

12. Observables — Maps TheHive artifacts to OpenSOAR observables:

13. dataType → type
14. data → value
15. tags → tags

16. Cortex analyzer reports → enrichments

17. Activity — Task logs and case updates → OpenSOAR activity timeline

Step 3: Verify the Migration¶

# Check counts match
curl -s http://localhost:8000/api/v1/dashboard/stats | python3 -m json.tool

# Spot-check a few alerts
curl -s http://localhost:8000/api/v1/alerts?limit=5 | python3 -m json.tool

# Verify observables were linked
curl -s http://localhost:8000/api/v1/observables?limit=5 | python3 -m json.tool

Step 4: Reconnect Your Integrations¶

Step 5: Set Up Playbooks¶

Convert your Cortex analyzer + responder workflows into OpenSOAR playbooks:

Before (TheHive + Cortex): 1. Alert arrives → TheHive 2. Analyst runs VirusTotal analyzer on observable → Cortex → Docker container → result 3. If malicious, analyst runs "Block IP" responder → Cortex → Docker container → action

After (OpenSOAR):

@playbook(trigger="webhook", conditions={"severity": ["high", "critical"]})
async def auto_enrich_and_respond(alert: Alert):
    # Step 1: Enrich IOCs (replaces Cortex analyzers)
    for ioc in alert.iocs:
        vt = await virustotal_lookup(ioc)
        abuse = await abuseipdb_check(ioc)

    # Step 2: AI triage (new — TheHive didn't have this)
    triage = await ai_triage(alert)

    # Step 3: Respond (replaces Cortex responders)
    if triage.determination == "malicious":
        await block_ip(alert.source_ip)
        await send_slack_alert(alert, channel="#soc-critical")

Field Mapping Reference¶

Alert Fields¶

Case → Incident Fields¶

Observable Fields¶

FAQ¶

Q: Can I run OpenSOAR alongside TheHive during migration? Yes. Point your SIEM to send alerts to both platforms during the transition. OpenSOAR's webhook endpoint (POST /api/v1/webhooks/alerts) accepts the same JSON payloads — you may just need to adjust field names.

Q: What about my Cortex analyzers? OpenSOAR ships with VirusTotal, AbuseIPDB, Slack, Email, and Elastic integrations. For other analyzers, rewrite them as Python playbooks — it's typically less code than a Cortex analyzer since there's no Docker packaging overhead.

Q: I used TheHive4py extensively. Is there an OpenSOAR client? OpenSOAR exposes a standard REST API. Use httpx or requests directly. The API is documented via OpenAPI at /docs when running the server.

Q: Will my Elasticsearch alert feeders still work? Yes. OpenSOAR has a dedicated Elastic webhook endpoint (POST /api/v1/webhooks/alerts/elastic) that understands Elastic Security alert payloads natively.

Q: What about TheHive 5 (commercial) users? The same migration process applies. TheHive 5's API is backward-compatible with v0/v1. Export via the API and import to OpenSOAR.

Getting Help¶

• Issues: github.com/opensoar-platform/core/issues
• Discussions: github.com/opensoar-platform/core/discussions

If you're migrating a large TheHive deployment and hit edge cases, open an issue. We want to make this path smooth.