Cortex

Run a specific Cortex analyzer against an observable—IP, domain, hash, or URL—and return structured threat intelligence from the configured analyzer module.

Retrieve the current status, input parameters, and metadata of a specific Cortex analysis job by its job ID.

Fetch the complete structured analysis report from a finished Cortex job, including taxonomies, artifacts, and analyzer-specific output fields.

Trigger a Cortex responder—block IP, quarantine host, revoke token—against a TheHive case, alert, or observable to take an automated defensive action.

Return all analyzers available on the Cortex instance, including their names, data-type support, and enabled status.

Return all responders configured on the Cortex instance, showing which defensive actions are available for each entity type.

Fetch the full configuration and metadata of a single Cortex analyzer, including accepted data types, version, and rate limits.

Retrieve the configuration, accepted entity types, and metadata for a specific Cortex responder.

Query Cortex job history for all past analyses run against a specific observable value, returning status and report links.

Check the current processing state—Waiting, InProgress, Success, Failure—of a Cortex job without fetching the full report payload.

Submit a new observable—IP, domain, URL, hash, or file—to Cortex along with the target analyzer name and return the resulting job ID.

Remove a completed or failed Cortex job and its associated report data from the platform to comply with retention policies.

Return a paginated list of Cortex analysis jobs filtered by status, analyzer, or date range.

Re-submit an observable to a specific analyzer even when a recent cached result exists, forcing a fresh analysis run.

Fetch the detailed analysis report for a specific analyzer job ID, returning the raw output and extracted taxonomies.

Fires when a Cortex analysis job transitions to Success, delivering the final report payload to the agent.

Fires when a Cortex analysis job reaches Failure status, including the error reason and the original observable submitted.

Fires when any Cortex analyzer returns a malicious or suspicious taxonomy tag for a submitted observable.

Fires when a Cortex responder finishes executing, providing the outcome, entity targeted, and any artifacts produced.

Fires when a Cortex responder fails to execute, including the error message and the entity it was targeting.

Fires when a new analyzer is registered on the Cortex instance, including its name, accepted data types, and version.

Fires when an observable accumulates a risk score above the configured threshold across multiple Cortex analyzers.