Cortex Review

If you run TheHive, you know where friction hits.

The case is open, observables are attached, and analysts are on it. Then, manual work piles up. Someone checks an IP in VirusTotal, someone else looks up a hash in MalwareBazaar. A domain gets checked in URLScan, Shodan, MISP. Once the team agrees it's malicious, the workflow often leaves TheHive. Blocklists get updated, notifications go out, and containment actions start. Other systems need manual syncing.

Operators do this, and it slows down response.

Cortex exists to close that gap.

TheHive's ecosystem gets a boost from this component. It turns case management into a workflow. You can enrich observables, take action, all within the case context. No need to leave the case to look up external information. The component simply functions as expected, making the process efficient.

What Cortex Is

Cortex is a standalone observable analysis and active response engine from TheHive Project. It handles IPs, domains, URLs, hashes, emails, and related indicators. These get dispatched to analyzers or responders.

Analyzers query external intel services, return structured reports. Responders act on results — block, notify, update, or take another controlled action. Cortex is more than a lookup tool.

Cortex runs as a REST API service or pairs with TheHive. TheHive manages cases and workflow; Cortex handles analysis and response.

Cortex supports multi-tenancy with organizations and users separated. MSSPs and shared security teams benefit from distinct analyzer access and credentials. API keys and configs stay private. Cortex handles

Analyzers: Observable Enrichment at Scale

The analyzer model solves daily pain. Most teams notice it first.

Each analyzer works alone. It takes an observable, like an IP address, and returns JSON.

The catalog is huge, with over a hundred integrations, VirusTotal, Shodan, AbuseIPDB.

Most SOCs and DFIR teams use these sources. They are likely already on the list.

The big win isn't just more sources. It's workflow change. No more manual visits to services; Cortex sends the observable to the right analyzer and brings results back.

Jobs run asynchronously. This allows for real-world use, where fast services respond quickly and slow ones take longer; the case doesn't block. Analysts review results as they arrive.

API keys are managed centrally and not exposed, which reduces friction and keeps keys clean. No more manual key management is required for every analyst and every site.

Responders: Active Response Actions

Responders turn Cortex into an operational platform. They don't just enrich data, they drive action.

Analyzers identify threats. Responders decide the response. You can block an IP, denylist a domain, send a Slack alert, or disable an account. You can integrate with other security tools based on analyst decisions.

This capability sets Cortex apart from enrichment-only tools. Many platforms can look up data. Fewer can guide analysts to action while keeping the case record intact.

Responders use scripts, just like analyzers. Teams can build custom integrations for internal APIs or tooling without public connectors. Extensibility is crucial. Automated response varies by environment. A useful response engine acts on your systems, not just generic ones.

The audit trail is another operational benefit. When responders are used in TheHive workflows, actions and outcomes are attached to the case record. The audit trail provides a history of what happened, when, and why. Teams often lose this history when actions are taken manually outside the incident platform.

Cortex as a Standalone Enrichment API

Introduction

Cortex pairs well with TheHive, not exclusively though.

Using Cortex as a Standalone Enrichment Backend

The REST API allows other tools to query Cortex, submit observables, request analyzers, check job status, and get structured results. Cortex can be used as an enrichment backend for SIEMs, DFIR tools, or internal apps that need observable analysis without TheHive.

Comparison with IntelOwl

IntelOwl provides multi-source enrichment over API, similar to Cortex. However, IntelOwl is geared more towards standalone enrichment with minimal platform context. Cortex, on the other hand, assumes use with TheHive, where it excels in responder actions and case integration. Cortex offers responder actions, case integration.

MISP Integration and Flexibility

MISP attributes also receive enrichment, not just formal case management, but also wider CTI workflows. Cortex offers more than just a plugin engine. TheHive users get the most value, but Cortex still provides benefits. MISP, TheHive, Cortex.

Deployment and Operations

Cortex runs on Docker, usually with TheHive, which is a straightforward path for teams already using TheHive. However, it's not zero-overhead.

Cortex uses Elasticsearch for storage of analysis results, logs, and historical data, adding infrastructure weight. It's not like a simple enrichment tool.

The tradeoff is better search and persistent results, which are worth it, but not free.

Maintaining analyzer and responder catalogs requires upkeep. Scripts are separate and need to be kept updated, and integrations refreshed to manage API changes.

Managing API keys is another chore, with one key per analyzer, requiring quota management and tuning. While centralized, it's not effortless. Too many analyzers can create noise.

Verdict

Cortex upgrades TheHive, changing the workflow from manual to integrated incident handling. TheHive is solid on its own, but with Cortex, analysts can enrich and act without leaving the case. Cortex's Responder capability sets it apart; many tools enrich, but fewer connect enrichment to action, tied to the incident. For TheHive users, Cortex is a major upgrade. Cortex still works without TheHive, but compared to IntelOwl and similar platforms, Cortex shines when you need action and tight case integration, operating within a larger platform.