TheHive alternatives

Looking for an alternative tool to replace TheHive? During the review of TheHive we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. FIR (fast incident response tool)
  2. rastrea2r (threat hunting for IOCs)
  3. Bitscout (remote forensics meta tool)

These tools are ranked as the best alternatives to TheHive.

Alternatives (by score)

64

FIR (Fast Incident Response)

Introduction

FIR is an incident response tool written in the Django framework. It provides a web interface to deal with the creation and management of security-related incidents.

Project details

Strengths and weaknesses

  • + More than 10 contributors
  • + The source code of this software is available

    Typical usage

    • Incident response
    • Security monitoring

    FIR review

    64

    rastrea2r

    Introduction

    Rastrea2r is a threat hunting utility for indicators of compromise (IOC). It is named after the Spanish word rastreador, which means hunter. This multi-platform open source tool helps incident responders and SOC analysts to triage suspected systems. The hunt for IOCs can be achieved in just a matter of a few minutes.

    Project details

    64

    Bitscout

    Introduction

    Bitscout contains a set of popular tools to acquire and analyze disk images onsite. It saves engineers from traveling to the physical location. In other words, it is providing the option to do remote forensics. The project claims that everything is correctly implemented when it comes to digital forensics. One of these requirements is that no data is altered. For example, the remote security professional can obtain a disk image clone, but not alter the machine state.

    Project details

    Bitscout is written in shell script.

    Strengths and weaknesses

    • + Used language is shell script
    • + The source code of this software is available

      Typical usage

      • Digital forensics

      Bitscout review

      100

      GRR Rapid Response

      Introduction

      The goal of the GRR tooling is to support digital forensics and investigations. By using a fast and scalable model, analysts can quickly perform their analysis. One of the main features is the ability to search for particular information or details. This process is called hunting.

      Project details

      GRR Rapid Response is written in Python.

      Strengths and weaknesses

      • + More than 25 contributors
      • + More than 3000 GitHub stars
      • + The source code of this software is available
      • + Supported by a large company

        Typical usage

        • Digital forensics
        • Intrusion detection
        • Threat hunting

        GRR Rapid Response review

        97

        The Sleuth Kit

        Introduction

        The Sleuth Kit is a forensics tool to analyze volume and file system data on disk images. With its modular design, it can be used to carve out the right data, find evidence, and use it for digital forensics.

        Project details

        The Sleuth Kit is written in C.

        Strengths and weaknesses

        • + More than 50 contributors
        • + More than 1000 GitHub stars
        • + The source code of this software is available
        • + Well-known tool

          Typical usage

          • Criminal investigations
          • Digital forensics
          • File system analysis

          The Sleuth Kit review

          74

          Volatility

          Introduction

          Volatility is a well-known tool to analyze memory dumps. Interesting about this project is that the founders of this project decided to create a foundation around the project. This foundation is an independent 501(c) (3) non-profit organization that maintains and promotes open source memory forensics with The Volatility Framework.

          Project details

          Volatility is written in Python.

          Strengths and weaknesses

          • + More than 2000 GitHub stars
          • + The source code of this software is available
          • + Project is supported by a foundation

            Typical usage

            • Digital forensics

            Volatility review

            100

            radare2

            Introduction

            Radare2 is a popular framework to perform reverse engineering on many different file types. It can be used to analyze malware, firmware, or any other type of binary files. Besides reverse engineering, it can be used for forensics on filesystems and do data carving. Tasks can be scripted and support languages like JavaScript, Go, and Python. Even software exploitation is one of the functions it can be used in.

            Project details

            radare2 is written in C.

            Strengths and weaknesses

            • + More than 500 contributors
            • + More than 8000 GitHub stars
            • + Many releases available
            • + The source code of this software is available

              Typical usage

              • Digital forensics
              • Reverse engineering
              • Software exploitation
              • Troubleshooting

              radare2 review

              64

              dfis (Digital Forensic Investigative Scripts)

              Introduction

              This toolkit of scripts are made by Hal to help in forensic assignments. They make several parts of the job easier, like converting data to another format for further processing.

              Project details

              dfis is written in Perl.

              Strengths and weaknesses

              • + The source code of this software is available
              • + Well-known author
              • - No updates for a while

              Typical usage

              • Digital forensics

              dfis review

              60

              libewf

              Introduction

              The libewf toolkit is useful for those who need to create a disk image or perform disk forensics.

              Project details

              libewf is written in C.

              Strengths and weaknesses

              • + The source code of this software is available

                Typical usage

                • Digital forensics

                libewf review

                60

                ThreatPinch Lookup

                Introduction

                ThreatPinch helps to speed up collecting information from common resources like CVE databases or public WHOIS data. As it works from the browser, it is a helpful addition for people who have to perform forensics, security monitoring, or system administration. For example, getting the owner of a domain and IP address becomes almost instant knowledge.

                Project details

                ThreatPinch Lookup is written in JavaScript.

                Strengths and weaknesses

                • + Many integration possibilities available
                • - Unknown project license

                Typical usage

                • Information gathering
                • Threat hunting

                ThreatPinch Lookup review

                74

                MIG (Mozilla InvestiGator)

                Introduction

                MIG provides a platform to perform investigative analysis on remote systems. By using the right queries, information can be obtained from these systems. This all happens in parallel, making intrusion detection, investigation, and follow-up easier.

                Project details

                Strengths and weaknesses

                • + More than 25 contributors
                • + More than 1000 GitHub stars
                • + The source code of this software is available
                • + Supported by a large company

                  Typical usage

                  • Digital forensics
                  • Intrusion detection

                  MIG review

                  93

                  Loki

                  Introduction

                  Loki is security tool to find so-called indicators of compromise (IOC). It does this by scanning files and then uses pattern matching.

                  Project details

                  Loki is written in Python.

                  Strengths and weaknesses

                  • + More than 10 contributors
                  • + Commercial support available
                  • + More than 500 GitHub stars
                  • + The source code of this software is available

                    Typical usage

                    • Digital forensics
                    • Intrusion detection
                    • Security monitoring

                    Loki review

                    64

                    Binary Analysis Next Generation (BANG)

                    Introduction

                    BANG is a framework to unpack files recursively and scan them. The files can be firmware, binaries, or malware. The main goal is to scan all files and perform classification and labeling. This way each file can be further analyzed based on the characteristics.

                    Project details

                    Binary Analysis Next Generation is written in Python.

                    Strengths and weaknesses

                    • + The source code of this software is available
                    • - No releases on GitHub available

                    Typical usage

                    • Binary analysis
                    • Malware analysis
                    • Malware scanning

                    Binary Analysis Next Generation review

                    56

                    bingrep

                    Introduction

                    Searches through binaries and highlights the most important areas with colors.

                    Supported binary formats:

                    • ELF 32/64, arm, x86, openrisc
                    • Mach 32/64, arm, x86
                    • PE

                    Project details

                    74

                    Cuckoo Sandbox (cuckoo)

                    Introduction

                    In a matter of seconds, Cuckoo Sandbox provides detailed results on what a file does within an isolated environment. This helps with malware analysis and understanding what it exactly tries to achieve. Further analysis can be done, based on the previous actions that were done.

                    Cuckoo Sandbox was created by Claudio Guarnieri as part of the Google Summer of Code project in 2010.

                    Project details

                    Cuckoo Sandbox is written in Python.

                    Strengths and weaknesses

                    • + More than 2000 GitHub stars
                    • + The source code of this software is available
                    • - Many provided pull requests are still open
                    • - Many reported issues are still open

                    Typical usage

                    • Digital forensics
                    • Malware analysis

                    Cuckoo Sandbox review

                    89

                    Cutter

                    Introduction

                    Cutter is a graphical user interface for radare2, the well-known reverse engineering framework. It focuses on those who are not familiar enough with radare2, or rather have a graphical interface instead of the command-line interface that radare2 provides.

                    Project details

                    Cutter is written in C++, Qt.

                    Strengths and weaknesses

                    • + More than 50 contributors
                    • + More than 3000 GitHub stars
                    • + The source code of this software is available

                      Typical usage

                      • Binary analysis
                      • Malware analysis
                      • Reverse engineering

                      Cutter review

                      74

                      LIEF

                      Introduction

                      LIEF is short for Library to Instrument Executable Formats.

                      Project details

                      LIEF is written in Python.

                      Strengths and weaknesses

                      • + The source code of this software is available

                        Typical usage

                        • Binary analysis
                        • Malware analysis
                        • Reverse engineering

                        LIEF review

                        76

                        Malice

                        Introduction

                        Malice is a malware analysis that wants to provide a free and open source version of VirusTotal. The goal of Malice is to make it usable by both independent researchers up to fortune 500 companies.

                        Malice is useful for those that do malware analysis or deal with user-generated files that may contain malware. The framework allows scanning files and directories to see if they are infected.

                        Project details

                        Malice is written in Golang.

                        Strengths and weaknesses

                        • + More than 500 GitHub stars
                        • + The source code of this software is available

                          Typical usage

                          • Malware analysis
                          • Malware detection
                          • Malware research
                          • Malware scanning

                          Malice review

                          64

                          Mal Tindex

                          Introduction

                          Mal Tindex is a tool that performs binary analysis on malware samples. It analyzes the binaries it is provided to learn about the specifics of each malware sample that makes them unique. This way data can be gathered that may provide background information. For example, it could provide the attribution of a particular actor or malware campaign.

                          Project details

                          Mal Tindex is written in Python.

                          Strengths and weaknesses

                          • + The source code of this software is available

                            Typical usage

                            • Malware analysis
                            • Malware research

                            Mal Tindex review

                            76

                            MultiScanner

                            Introduction

                            MultiScanner helps malware analysts by providing a toolkit to perform both automated and manual analysis. The data extracted from the analysis can be easily stored together, including the relevant metadata and samples. It allows enriching the data further by retrieving information from external resources.

                            Project details

                            Strengths and weaknesses

                            • + More than 10 contributors
                            • + The source code of this software is available

                              Typical usage

                              • Malware analysis
                              • Malware detection
                              • Malware scanning

                              MultiScanner review

                              78

                              SSMA

                              Introduction

                              SSMA is short for Simple Static Malware Analyzer. The tool can perform a set of tests against a malware sample and retrieve metadata from it. SSMA can analyze ELF and PE and analyze its structure. For example, it can retrieve the PE file header information and its sections. Other pieces it can analyze is the usage of packers, anti-debugging techniques, cryptographic algorithms, domains, email addresses, and IP addresses. It can also check if the sample is already detected or blocked by using VirusTotal and the blocklist of malwaredomains.com.

                              Project details

                              SSMA is written in Python.

                              Strengths and weaknesses

                              • + The source code of this software is available
                              • - No releases on GitHub available

                              Typical usage

                              • Malware analysis
                              • Malware detection
                              • Malware scanning
                              • Reverse engineering

                              SSMA review

                              70

                              Viper

                              Introduction

                              Viper organizes the malware samples and exploits you found over time. It calls itself "Metasploit for malware researchers". Viper has a terminal interface to store, search and analyze files. As it is a framework, is also allows you to create your plugins.

                              Project details

                              60

                              YaraGuardian

                              Introduction

                              YaraGuardian provides a web-based interface that helps to manage Yara rules. It can be used to search, organize, and bulk-edit rules. The tool also prevents creating duplicate entries, which is a nice additional benefit of this management utility.

                              Project details

                              YaraGuardian is written in Python.

                              Strengths and weaknesses

                              • + The source code of this software is available

                                Typical usage

                                • Malware analysis

                                YaraGuardian review

                                60

                                yarGen

                                Introduction

                                The yarGen utility helps with creating YARA rules for malware detection. It can combine both 'goodware' and 'malware', to properly craft the right rules.

                                Project details

                                60

                                siemstress

                                Introduction

                                Siemstress is a lightweight security information and event management (SIEM) system. It uses a MariaDB database as backend and a set of command line interface tools to query and manage the data.

                                Project details

                                siemstress is written in Python.

                                Strengths and weaknesses

                                • + Very low number of dependencies
                                • + The source code of this software is available

                                  Typical usage

                                  • Event management

                                  siemstress review

                                  Some relevant tool missing as an alternative to TheHive? Please contact us with your suggestion.