--- title: "Cortex Integration" description: "Connect AI agents to Cortex, the observable analysis and active-response engine from the TheHive Project. Agents run analyzers to enrich IOCs, collect structured reports and verdicts, and fire responders to block, notify, or ticket." url: https://flowrunner.ai/integrations/cortex date_modified: 2026-08-01T02:40:32-07:00 --- # Cortex [Identity & Security](https://flowrunner.ai/integrations/category/identity-security) Connect AI agents to Cortex, the observable analysis and active-response engine from the TheHive Project. Agents run analyzers to enrich IOCs, collect structured reports and verdicts, and fire responders to block, notify, or ticket. [Verified](https://flowrunner.ai/integrations/verified "What does verified mean?") · 12 actions · API key · available [Cortex website](https://thehive-project.org/) · [Platform Documentation](https://github.com/TheHive-Project/CortexDocs) · Capability data verified 2026-08-12 1. A suspicious observable arrives from an alert or upstream flow 2. Get Analyzers by Type finds analyzers that can process the observable 3. Run Analyzer starts enrichment with a TLP and PAP sharing level 4. Wait for Job Report blocks until the verdict is ready in one step 5. Agent reads the report's taxonomies, verdict, and extracted artifacts 6. The verdict and evidence are recorded on the incident 7. Analyst approves running a responder before the indicator is blocked ## What This Integration Enables Agents enrich a suspicious IP, domain, hash, or URL with one or more Cortex analyzers and act on the verdict, run a synchronous enrichment that starts an analyzer and blocks until its report is ready inside a single automation step, discover which analyzers can process a given observable type and pick one dynamically, trigger active responders to block an indicator, send a notification, or open a ticket in response to an event, and review recent analysis history to pull structured reports, taxonomies, and extracted artifacts for downstream flows. Reports include a summary with taxonomies, a full object with the analyzer's raw output, and any extracted artifacts. TLP and PAP sharing levels are provided as friendly labels mapped to Cortex's numeric codes, and file observables are out of scope because they require a multipart upload. The connector covers the analyzer and responder job surface; the surrounding flow decides which enrichment runs automatically and where an analyst confirms a responder before it acts. ### Without FlowRunner **Manual enrichment**: An analyst copies each observable into a threat-intel portal and reads the result by hand **Analyzer guesswork**: Choosing which analyzer handles a given observable type is done from memory **Response without a gate**: Blocking or ticketing an indicator happens outside any recorded, reviewable flow ### With FlowRunner **Automated enrichment**: Run Analyzer and Wait for Job Report return a structured verdict in a single step **Dynamic analyzer choice**: Get Analyzers by Type picks a compatible analyzer for the observable at runtime **Analyst-gated response**: Run Responder fires only after a human confirms the block or ticket action ## Use Case Scenarios ### Synchronous observable enrichment An investigation flow reaches a suspicious observable. The agent calls Get Analyzers by Type to find a compatible analyzer, runs it with Run Analyzer, and uses Wait for Job Report to block until the verdict is ready in one step. It records the verdict on the incident in [TheHive](https://flowrunner.ai/integrations/thehive) as an observable or a case update. The analyst sees an enriched indicator with taxonomies attached instead of a raw value to chase down. ### Alert-driven auto-enrichment When [TheHive](https://flowrunner.ai/integrations/thehive) surfaces a new alert, the agent reads its observables, calls Get Analyzers by Type and Run Analyzer to enrich each one, then attaches the results before the alert is promoted to a case. The triage queue arrives pre-enriched, so the analyst spends attention on the judgment call rather than the lookups. ### Verdict-driven response, gated When an analyzer report flags a malicious indicator, the agent prepares a Run Responder action to block it and opens a tracked alert in [TheHive](https://flowrunner.ai/integrations/thehive) for the SOC team. It does not fire the responder on its own. The block waits for a human, because acting on a verdict is where a wrong call has real consequences. ## Human-in-Loop Highlight Running a responder is the moment to stop and ask, because a responder takes active action (blocking an indicator, opening a ticket, sending an external notification) that a wrong verdict would misdirect. The agent enriches on its own: it selects the analyzer, runs it, waits for the report, and reads the taxonomies and verdict. Before it calls Run Responder, it pauses and asks the analyst through their channel: "Analyzer \[name\] scored \[indicator\] as \[verdict\] with taxonomy \[level\]. Run responder \[responder name\] to block it, open a ticket instead, or hold pending review?" The analyst decides. The agent does the analysis; the person owns the response. Agent processes routinely Detects exception requiring judgment Clear match Continues automatically Ambiguous Routes to human via preferred channel Human decides Agent resumes with decision ## Agent Capabilities 12 actions ### Analyzers 3 - **List Analyzers** Lists the analyzers available on the Cortex instance. - **Get Analyzers by Type** Discovers which analyzers can process a given observable type so an agent can pick one dynamically. - **Get Analyzer** Reads a single analyzer's configuration. ### Run Analysis 6 - **Run Analyzer** Starts an analyzer job on an observable value with a TLP and PAP sharing level, returning a job immediately. - **Wait for Job Report** Blocks until an analyzer job finishes and returns the report in a single step, ideal for synchronous enrichment. - **Get Job** Polls an analyzer job for its status. - **Get Job Report** Retrieves the structured report for a completed analyzer job. - **List Jobs** Reviews recent analysis history. - **Delete Job** Deletes an analyzer job. ### Responders 3 - **List Responders** Lists the active responders available on the instance. - **Run Responder** Fires an active responder to block an indicator, send a notification, or open a ticket. Typically human-gated. - **Get Responder Job** Reads the status and result of a responder job. ## Frequently Asked Questions ### What can FlowRunner do with Cortex? FlowRunner agents can run List Analyzers, Get Analyzer, and Get Analyzers by Type in Cortex, plus 9 more actions. ### Does connecting Cortex to FlowRunner require OAuth? No. Cortex connects to FlowRunner with an API key, no OAuth flow required. ### Can Cortex trigger a FlowRunner workflow automatically? Cortex doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger. **Work at Cortex?** This integration exposes Cortex to AI agents on every FlowRunner plan, including through MCP, at no cost to you. [See what FlowRunner offers integration partners](https://flowrunner.ai/integrations/partners), including how to keep this page current. --- Markdown version of https://flowrunner.ai/integrations/cortex. Site index: https://flowrunner.ai/llms.txt