Cortex icon

Cortex

Run TheHive Cortex analyzers and responders, and track their jobs.

6 searches7 actionsPollingAuth: API key

AI-assisted documentation4 min read

This documentation is compiled from our integration source code, internal specs for Cortex, its official API documentation and anonymized requests logs we collect from our support team[2].

Open Cortex on WEXTL →

Connecting Cortex takes an active account plus an API access token from your account settings — no other setup is required.[3]

  • API KeypasswordRequired
  • HostingselectRequired
  1. Log in to your WEXTL account, add the Cortex node module to your workflow, and click Create new credential.
  2. Optional: In the Credential name field, enter a name for the credential.
  3. Enter the authentication credentials you copied from your Cortex account, or follow the on-screen instructions to create the credential.
  4. If prompted, authenticate your account and confirm access.
  5. If you want to make changes to your credential in the future, follow the steps in Manage credentials →

Notes

Credentials are org-scoped; share them with teammates from the Credentials picker on any of its nodes.For detailed information on connecting an application, see Connect an application →

Get AnalyzerSearch
Input fields[3]
FieldType
Analyzer IDRequired
choice
Output fields[3]
FieldType
IDtext
Nametext
Get JobSearch
Input fields[3]
FieldType
Job IDRequired
choice
Output fields[3]
FieldType
IDtext
Statustext
Get Job ReportSearch
Input fields[3]
FieldType
Job IDRequired
choice
Output fields[3]
FieldType
Fulltext
List AnalyzersSearch
Input fields[3]
FieldType
Limitnumber
Output fields[3]
FieldType
IDtext
Nametext
List JobsSearch
Input fields[3]
FieldType
Data type filtertext
Data filtertext
Analyzer filtertext
Limitnumber
Output fields[3]
FieldType
IDtext
Statustext
List RespondersSearch
Input fields[3]
FieldType
Limitnumber
Output fields[3]
FieldType
IDtext
Nametext
Delete AnalyzerAction
Input fields[3]
FieldType
Analyzer IDRequired
choice
Output fields[3]
FieldType
IDtext
Delete JobAction
Input fields[3]
FieldType
Job IDRequired
choice
Output fields[3]
FieldType
IDtext
Make an API Calluniversal
Input fields[3]
FieldType
URLRequired
text
MethodRequired
choice
Headersarray
Headerobject
Query Stringarray
Parameterobject
Bodytext
Output fields[3]
FieldType
Bodytext
Headerstext
Status codenumber
Run AnalyzerAction
Input fields[3]
FieldType
Analyzer IDRequired
choice
Observable dataRequired
text
Data typeRequired
choice
TLPchoice
Messagetext
Analyzer parameterstext
Output fields[3]
FieldType
Job IDtext
Statustext
Run ResponderAction
Input fields[3]
FieldType
Responder IDRequired
choice
Object typeRequired
choice
Object IDRequired
text
Responder parameterstext
Output fields[3]
FieldType
Job IDtext
Submit JobAction
Input fields[3]
FieldType
Analyzer IDRequired
choice
FileRequired
text
Data typeRequired
choice
TLPchoice
Messagetext
Output fields[3]
FieldType
Job IDtext
Update Analyzer ConfigurationAction
Input fields[3]
FieldType
Analyzer IDRequired
choice
Configurationtext
Rate limitnumber
Rate unittext
Output fields[3]
FieldType
IDtext

Look for Cortex templates in the WEXTL template library.

Browse templates →
  1. WEXTL® Cortex Source Code connector implementation.
  2. Our users use cases and automations.
  3. Official API Documentation for Cortex.
  4. WEXTL® visual workflow builder data.

Last updated: Sep 3, 2026 08:02