Run Cortex analyzer through api

[alexgoedeke]

Request Type

Question/Feature Request

Problem Description

Is it possible to run an Cortex analyzer with an given observableID from a python script?

[nadouani]

Hello @alexgoedeke

What's the idea? do you want just to run analyzers on a given observable and just get it's report or, you want to have the report on TheHive?

Cortex has it own python library which is Cortex4Py but this will not add any data to TheHive.

That said, we can add the capability to run a job on a given observable, from TheHive.

[alexgoedeke]

@nadouani Yes I need the results in TheHive

[nadouani]

Se we have to add some methods to make that possible. Good feature request.

[nadouani]

Here is doc for how TheHive launches Cortex analyzers: https://github.com/CERT-BDF/TheHiveDocs/tree/master/api/connectors/cortex

Thanks to @srilumpa

[alexgoedeke]

@nadouani I have added the functionality to the API