TheHive is a security incident response platform. Its API exposes alerts, cases, observables, tasks, users, organizations and configuration actions. A product title can identify a web interface, but the risk model is dominated by account type, permission profile and organization membership.

On 2026-11-07, three count-only ZoomEye queries used sub_type=all, page 1 and pagesize=1. app="TheHive" returned 0, title="TheHive" returned 924 and http.body="TheHive" returned 1,736.

These are small populations compared with many web products, and the app field did not match. The body and title counts should be treated as discovery leads. A page can mention TheHive without being a live case-management server.

Account type changes the reachable API

TheHive documentation distinguishes normal accounts, service accounts and external accounts. Normal accounts support interactive login and can generate API keys if enabled. Service accounts are intended for programmatic access with an API key and cannot sign in to the web interface.

Review every account, profile and organization membership. A user with a read-only profile is not equivalent to an administrator with manageUser or managePlatform. Service accounts should have a clear owner and a duration. Remove keys that are no longer associated with an active integration.

The API documentation says most endpoints require authentication and permissions are checked against the user's role. Organization context can be selected with the X-Organisation header. Validate that a user cannot select an organization they do not belong to and that the application does not accept an organization header from an untrusted client without the corresponding membership check.

Review the external identity path

TheHive supports local accounts, LDAP or Active Directory, SAML, OpenID, API keys and HTTP header authentication depending on edition and configuration. Each option creates a different trust boundary. For header authentication, confirm that a trusted proxy overwrites the identity header and that the application cannot be reached directly with a forged value.

For SAML or OIDC, review issuer, audience, callback and account mapping. The same email address can map to different organizations under a bad provisioning rule. Test a user who belongs to two organizations and verify that case data, observables and API keys remain within the selected tenant.

Test case actions with least privilege

Use two test accounts with different profiles. Confirm that a read-only user cannot change case ownership, merge cases, add observables or read restricted case access. Test export and report endpoints because they can aggregate data across objects. Test API keys after a role change and after account disablement.

Protect the case database and attachment storage as sensitive incident evidence. A backup may contain credentials, malware samples, personal data and investigative notes. Restrict download and restore permissions and record who accessed the evidence.

Put the count in context

A title match is a prompt to verify the web interface, organization model and exposed API. It is not evidence of a public case. The body count is even less specific. The right output is an inventory item with an owner, authentication method and a permission review.

TheHive can hold the most sensitive incident context an organization has. A small ZoomEye count is not a small security question.

Query evidence

All observations used sub_type=all, page 1 and pagesize=1 on 2026-11-07.

References