STEP 1
Connect Cortex and MISP
Save credentials in WEXTL once. We store them encrypted and reuse the authorization across every workflow [3]. No coding or API skills required.
Cortex and MISP Integration
Keep Cortex and MISP in sync by integrating their events and actions. When developer tools events happen in Cortex, update the MISP automatically - without any line of code in visual workflow builder.
3-day trialCancel anytimeUp to 10 minutes quick set up
- GDPR
- Data Encryption
- 2FA
- Local Data Region
Learn about Cortex and MISP
Detailed info you need to know about Cortex and MISP integrations in WEXTL. Explore which modules apps support and how you connect them.
How to connect Cortex to MISP
Set up your Cortex and MISP integration in 3 simple steps [2] — no coding required. Up to 10 minutes setup.
STEP 2
Build a workflow
Paste selected Cortex and MISP nodes onto the canvas [4], or describe what you want and WEXTL wires the flow together with AI Builder.
STEP 3
Map your data
Choose which fields need to sync between Cortex and MISP. Use filters or leverage a JS custom code step in between — everything is on the canvas.
How does the integration between Cortex and MISP work in WEXTL?
WEXTL exposes actions and triggers for Cortex and MISP that help you connect apps and automate repetitive tasks [1]. A trigger is an event that happens, an action — a step that performs when the event has occurred.
MISP triggersCortex actions
MISP modules
- Watch EventsTriggers when events are detected.
- Add a CollectionAdds a collection.
- Add a FeedAdds a feed.
- Add a Server to a Sharing GroupAdds a server to a sharing group.
- Add a Sharing GroupAdds a sharing group.
- Add an AttributeAdds an attribute.
- Add an Object to an EventAdds an object to an event.
- Add an Organisation to a Sharing GroupAdds an organisation to a sharing group.
- Add Analyst DataAdds analyst data.
- Add EventAdds event.
- Add Event ReportAdds event report.
- Add Event TagAdds event tag.
- Add Galaxy ClusterAdds galaxy cluster.
- Add OrganisationAdds organisation.
- Add ServerAdds server.
- Add Sighting of an AttributeAdds sighting of an attribute.
- Add Sightings of a List of ValuesAdds sightings of a list of values.
- Add TagAdds tag.
- Add Tag(s) to Attribute(s)Adds tag(s) to attribute(s).
- Add UserAdds user.
- Attach the Galaxy Cluster Tag a Given EntityAttaches the galaxy cluster tag a given entity.
- Cache FeedsCaches feeds.
- Check If a List of Values Matches Any WarninglistsRetrieves check if a list of values matches any warninglists.
- Delete a CollectionDeletes a collection.
- Delete a GalaxyDeletes a galaxy.
- Delete a Server from a Sharing GroupDeletes a server from a sharing group.
- Delete a Sharing GroupDeletes a sharing group.
- Delete a Tag from an AttributeDeletes a tag from an attribute.
- Delete an AttributeDeletes an attribute.
- Delete an Organisation from a Sharing GroupDeletes an organisation from a sharing group.
- Delete Analyst DataDeletes analyst data.
- Delete EventDeletes event.
- Delete Event ReportDeletes event report.
- Delete Event Report PermanentlyDeletes event report permanently.
- Delete Event TagDeletes event tag.
- Delete Galaxy ClusterDeletes galaxy cluster.
- Delete ObjectDeletes object.
- Delete OrganisationDeletes organisation.
- Delete ServerDeletes server.
- Delete SightingDeletes sighting.
- Delete TagDeletes tag.
- Delete UserDeletes user.
- Delete User Setting by IdDeletes user setting by id.
- Disable FeedDisables feed.
- Disable TaxonomyDisables taxonomy.
- Edit a CollectionEdits a collection.
- Edit a FeedEdits a feed.
- Edit a Sharing GroupEdits a sharing group.
- Edit an AttributeEdits an attribute.
- Edit Analyst DataEdits analyst data.
Cortex modules
- Delete AnalyzerRemoves a custom analyzer registration.
- Delete JobDeletes a job record.
- Get AnalyzerReturns a single analyzer.
- Get JobReturns a single job.
- Get Job ReportReturns the report for a completed job.
- List AnalyzersRetrieves available analyzers.
- List JobsRetrieves analyzer/responder jobs.
- List RespondersRetrieves available responders.
- Make an API CallPerforms an arbitrary authorized API call.
- Run AnalyzerSubmits an observable to an analyzer.
- Run ResponderRuns a responder against a TheHive entity.
- Submit JobSubmits a file-type observable to an analyzer.
- Update Analyzer ConfigurationUpdates org-level analyzer configuration.
Frequently asked questions
Common questions about connecting Cortex and MISP.
Connect your Cortex and MISP accounts once, pick a trigger in one app and an action in the other, then map the fields so data flows automatically between them. [3]
Example: when MISP's "Watch Events" fires, WEXTL can "Delete Analyzer" in Cortex. Cortex has 13 actions (including Delete Analyzer, Delete Job, and Get Analyzer); MISP has 138 actions (including Add a Collection, Add a Feed, and Add a Server to a Sharing Group). Add filters and transforms between steps when you need them. [1]
Yes — the integration works in both directions. Use each app's triggers to start a workflow and the other app's actions to update it. [2]
No. Cortex-to-MISP automations are built visually on the canvas. You can optionally add custom JavaScript with Functions when you need advanced logic. [4]
Yes. Trigger-based automations start the moment Cortex (or MISP) fires a new event — webhook-backed apps run within seconds, and polling-only apps re-check on a schedule you control. [7]
A first automation typically takes 5–10 minutes: connect each app's credential once, drop a trigger + action onto the canvas, map the fields, and turn the workflow on.
You can build your Cortex + MISP automation on a 3-day trial with every feature unlocked. Cancel anytime. For your protection, a small deposit is charged to your card when your trial starts. It counts toward your first payment and is non-refundable. [8]
References
List of sources used to gather information about the Cortex and MISP integration.
- Cortex and MISP integration source code, module specs and credentials implementation.
- Our Cortex and MISP integration documentation, structured input and output parameters, scopes, and authentication methods.
- Official vendor API documentation for Cortex and MISP — used to verify field meanings, authentication flows, and anything our own specs don't fully capture.
- WEXTL® visual workflow builder, anonymized data from our technical support team.
- Cortex integration information
- MISP integration information
- WEXTL® Scheduling
- WEXTL® Pricing and Trial
- WEXTL® Apps Library