Can Cortex trigger actions in MISP, and MISP in Cortex?

Yes — the integration works in both directions. Use each app's triggers to start a workflow and the other app's actions to update it.

Do I need to write code to integrate Cortex and MISP?

No. Cortex-to-MISP automations are built visually on the canvas. You can optionally add custom JavaScript with Functions when you need advanced logic.

Cortex + MISP Integration

Keep Cortex and MISP aligned: when developer tools events happen in one, update the other automatically.

Example: when MISP's "Watch Events" fires, WEXTL can "Delete Analyzer" in Cortex. Cortex has 13 actions (including Delete Analyzer, Delete Job, and Get Analyzer); MISP has 138 actions (including Add a Collection, Add a Feed, and Add Analyst Data).

Explore Documentation

GDPR
Data Encryption
2FA
Local Data Region

MISP triggersCortex actions

MISP workflow triggers

Cortex workflow actions

Frequently asked questions

Common questions about connecting Cortex and MISP.

Connect your Cortex and MISP accounts once, pick a trigger in one app and an action in the other, then map the fields so data flows automatically between them.

CortexBrowse all Cortex triggers, actions, and integrations.

MISPBrowse all MISP triggers, actions, and integrations.

Cortex + MISP Integration

Frequently asked questions

How do I connect Cortex and MISP?

What can I automate between Cortex and MISP?

Can Cortex trigger actions in MISP, and MISP in Cortex?

Do I need to write code to integrate Cortex and MISP?

Explore Cortex and MISP, or get started

Cortex + MISP Integration

Frequently asked questions

How do I connect Cortex and MISP?

What can I automate between Cortex and MISP?

Can Cortex trigger actions in MISP, and MISP in Cortex?

Do I need to write code to integrate Cortex and MISP?

Explore Cortex and MISP, or get started