TheHive 5.4 is out: dark mode, better reporting and more

Who says bees take the summer off? Our team’s been busy bringing you the latest updates – bee-hold, TheHive 5.4.

We’ve introduced a small but awaited load of improvements, from Dark mode to a practical function notifier. These new features make incident response a little easier, not only on the eye.

Here’s a closer look at what we’ve been cooking for TheHive 5.4.

⚠️ Disclaimer ⚠️ The last part of this article, “Backend framework upgrade,” contains important info for our customers using TheHive in cluster mode.

For everyone who’s been asking for a break from those bright screens, Dark Mode is finally here! You can now switch between light, dark or a system mode that syncs with your computer’s appearance settings.

Imagine yourself in the late hours of a critical investigation. Dark mode lets you keep focus without tiring your eyes, making it less painful to analyze cases during those extended work sessions.

It’s not just a visual tweak. It’s about staying comfortable while staying sharp, especially when you’re pulling late-night shifts.

Path: Profile > Themes > Select Light | Dark | System

Creating detailed case reports just got a lot more intuitive with the new Report tab. It pulls everything together in one place, using customizable templates, so you’re not wasting time hunting down scattered info.

Now, everything you need is right there, helping you put together solid reports quickly.

Picture this: you’re presenting a tricky case to your team or stakeholders, and the new Report tab gives you real-time previews, making it simpler to refine as you go. Managers and analysts can make decisions faster and your reporting process stays smooth and efficient.

It’s not just quicker, it’s clearer too, cutting down on all the back-and-forth and making sure everyone’s on the same page.

Path: Case > Report > Select the Template

When it comes to case reports, context is everything. With the new Comment and Page widgets, you can now add specific discussions or detailed explanations directly into your reports, giving them the depth they need.

These widgets make it simple to include important conversations and content, so your reports are thorough but also clear. No more missing key details or digging through emails.

Think of it this way: everything your team needs to know is right there in the report, making collaboration lean and avoiding extra back-and-forth.

Path: Organization > Templates > Reports > Select any report once created

We all know that automation is a game-changer when it comes to speeding up workflows and cutting down on mistakes. This is why we have decided to bring in a Function Notifier that kicks off specific actions whenever things like case creation, updates or closures happen.

OrgAdmins can set it up to handle all sorts of routine tasks, keeping things running like clockwork.

What does that mean for you? Less time spent on manual updates and more time to focus on the important stuff.

Imagine tasks updating themselves in the background while you’re busy doing your thing. No more clicking the same settings over and over – the system’s got you covered.

Path: Organization > Notifications > “+” icon > Select Trigger > Select “Function” in “Notifiers”

Efficiency is crucial in managing cases and alerts. TheHive 5.4 now allows you to manually call a function directly from a case or alert—the same way you run responders—letting you execute predefined tasks with a single action.

This feature saves time by automating common actions like closing all associated tasks or modifying multiple fields at once.

Now you can skip the busy work and handle multiple changes in one go. Whether it’s cleaning up an alert or closing out a case, just hit a button and the function does the heavy lifting for you.

Less clicking, more solving—it’s that simple.

Path: Organization X > Case Y > Run responders (run actions)

Metrics are super important for understanding your cases and alerts, but too much data can get overwhelming fast. With TheHive 5.4, we’ve made some changes to the way time metrics are displayed and improved their precision.

OrgAdmins can now hide unnecessary metrics, making things clearer and more focused.

As an analyst, you’ll find the metrics easier to read and more accurate, so you can quickly spot what really matters. It’s all about cutting out the noise and giving you the right info at the right time, in a way that’s pleasant to work with.

Path: Organization > UI configuration > Time metrics (all the way down)

Templates are a lifesaver when setting up workflows and now, with TheHive 5.4, you can duplicate existing case templates to save time and effort. Whether you’re setting up a process for recurring incidents or tweaking a template for a specific case, this feature allows to reuse what already works.

No need to start from scratch anymore. Just grab a well-designed template, make a few adjustments, and you’re good to go.

It’s especially handy if you’re managing configurations, helping you keep things consistent while adapting to whatever new cases come your way.

Path: Organization > Templates > Cases > Select “duplicate” in 3 dots menu

Keeping your data safe is a big deal, especially when a lot of people rely on dashboards. To prevent any accidental changes, TheHive now restricts read-only users from making edits to dashboards. But don’t worry, they can still tweak non-critical settings like Refresh Rate, Period and cache.

Think of a shared workspace where multiple analysts are accessing the dashboard. Now, you don’t have to stress about anyone accidentally messing up the setup. For non-read-only users, even if they’re not admins, the right permissions are automatically assigned during the update, so everyone has the right level of access.

In short, your dashboard stays secure, tidy, and focused on giving you the insights you need, without any unintentional changes.

Path from an admin profile: Organization > Entities Management > Profiles > + > select Profile type organization > select permission “Manage dashboard”

When handling large volumes of data, speed and precision are key. That’s why, in TheHive 5.4, we now fully rely on Elasticsearch by default for complex queries to boost your searches and dashboards. These features first rolled out as optional upgrades back in January, but now they’re automatically set up for everyone, giving you faster, more efficient query responses and dashboard displays.

Think of those moments when you’re filtering through complex data or working with detailed dashboards—this update ensures everything runs smoothly without the lag. And don’t worry, if you ever need to, you can still deactivate these features, but with them on, you’re set for improved performance right from the start.

With TheHive 5.4, we’ve upgraded our backend framework from Play 2 (Akka) to Play 3 (Pekko).

While this change doesn’t introduce new functionality, it does affect users running TheHive in cluster mode. If you’re using a multi-node setup, you’ll need to update your configuration when upgrading to avoid potential disruptions.

This is a breaking change for some users, particularly those in cluster environments.

We highly recommend reviewing the upgrade guide to ensure your production environment continues running smoothly.

So there you have it, TheHive 5.4 is packed with features that make incident response easier, more efficient and, let’s face it, a bit cooler – looking at you, Dark mode.

Whether it’s automating routine tasks, generating clear reports faster, or fine-tuning your dashboards, this update is all about saving you time and reducing manual effort.

As you dive into these new features, we’re confident you’ll feel the difference in your day-to-day work. Less hassle, more focus and the tools you need right at your fingertips.

It’s all about helping you get to the heart of what matters—solving cases and keeping your operations on point.

Happy Hive-ing!