Cortex

Connect AI agents to Cortex, the observable analysis and active-response engine from the TheHive Project. Agents run analyzers to enrich IOCs, collect structured reports and verdicts, and fire responders to block, notify, or ticket.

12 actions available

A suspicious observable arrives from an alert or upstream flow

Get Analyzers by Type finds analyzers that can process the observable

Run Analyzer starts enrichment with a TLP and PAP sharing level

Wait for Job Report blocks until the verdict is ready in one step

Agent reads the report's taxonomies, verdict, and extracted artifacts

The verdict and evidence are recorded on the incident

Analyst approves running a responder before the indicator is blocked

What This Integration Enables

Agents enrich a suspicious IP, domain, hash, or URL with one or more Cortex analyzers and act on the verdict, run a synchronous enrichment that starts an analyzer and blocks until its report is ready inside a single automation step, discover which analyzers can process a given observable type and pick one dynamically, trigger active responders to block an indicator, send a notification, or open a ticket in response to an event, and review recent analysis history to pull structured reports, taxonomies, and extracted artifacts for downstream flows. Reports include a summary with taxonomies, a full object with the analyzer's raw output, and any extracted artifacts. TLP and PAP sharing levels are provided as friendly labels mapped to Cortex's numeric codes, and file observables are out of scope because they require a multipart upload. The connector covers the analyzer and responder job surface; the surrounding flow decides which enrichment runs automatically and where an analyst confirms a responder before it acts.

Without FlowRunner

Manual enrichment An analyst copies each observable into a threat-intel portal and reads the result by hand

Analyzer guesswork Choosing which analyzer handles a given observable type is done from memory

Response without a gate Blocking or ticketing an indicator happens outside any recorded, reviewable flow

With FlowRunner

Automated enrichment Run Analyzer and Wait for Job Report return a structured verdict in a single step

Dynamic analyzer choice Get Analyzers by Type picks a compatible analyzer for the observable at runtime

Analyst-gated response Run Responder fires only after a human confirms the block or ticket action

Use Case Scenarios

Synchronous observable enrichment

An investigation flow reaches a suspicious observable. The agent calls Get Analyzers by Type to find a compatible analyzer, runs it with Run Analyzer, and uses Wait for Job Report to block until the verdict is ready in one step. It records the verdict on the incident in [TheHive](/integrations/thehive) as an observable or a case update. The analyst sees an enriched indicator with taxonomies attached instead of a raw value to chase down.

Alert-driven auto-enrichment

When [TheHive](/integrations/thehive) surfaces a new alert, the agent reads its observables, calls Get Analyzers by Type and Run Analyzer to enrich each one, then attaches the results before the alert is promoted to a case. The triage queue arrives pre-enriched, so the analyst spends attention on the judgment call rather than the lookups.

Verdict-driven response, gated

When an analyzer report flags a malicious indicator, the agent prepares a Run Responder action to block it and opens a tracked alert in [TheHive](/integrations/thehive) for the SOC team. It does not fire the responder on its own. The block waits for a human, because acting on a verdict is where a wrong call has real consequences.

Human-in-Loop Highlight

Running a responder is the moment to stop and ask, because a responder takes active action (blocking an indicator, opening a ticket, sending an external notification) that a wrong verdict would misdirect. The agent enriches on its own: it selects the analyzer, runs it, waits for the report, and reads the taxonomies and verdict. Before it calls Run Responder, it pauses and asks the analyst through their channel: "Analyzer [name] scored [indicator] as [verdict] with taxonomy [level]. Run responder [responder name] to block it, open a ticket instead, or hold pending review?" The analyst decides. The agent does the analysis; the person owns the response.

Agent processes routinely

Detects exception requiring judgment

Clear match Continues automatically

Ambiguous Routes to human via preferred channel

Human decides

Agent resumes with decision

Agent Capabilities

12 actions

Analyzers

List Analyzers Lists the analyzers available on the Cortex instance.
Get Analyzers by Type Discovers which analyzers can process a given observable type so an agent can pick one dynamically.
Get Analyzer Reads a single analyzer's configuration.

Run Analysis

Run Analyzer Starts an analyzer job on an observable value with a TLP and PAP sharing level, returning a job immediately.
Wait for Job Report Blocks until an analyzer job finishes and returns the report in a single step, ideal for synchronous enrichment.
Get Job Polls an analyzer job for its status.
Get Job Report Retrieves the structured report for a completed analyzer job.
List Jobs Reviews recent analysis history.
Delete Job Deletes an analyzer job.

Responders

List Responders Lists the active responders available on the instance.
Run Responder Fires an active responder to block an indicator, send a notification, or open a ticket. Typically human-gated.
Get Responder Job Reads the status and result of a responder job.

Start building with Cortex

$100 in credits. No card required. Connect in minutes.

Start Building Free Talk to us