logo
  • Home
  • TheHive
  • Cortex
  • Cortex Neurons
  • Resources
Initializing search
    • Home
      • Overview
        • Installation Methods
          • System Requirements
          • Software Requirements
        • Install on Linux
        • One-Command Install
        • Deploy with Docker
        • Deploy on Kubernetes
        • Set Up a Cluster on Linux
          • About Licenses
          • Request a Community License
          • Activate or Update a License
          • Upgrade from Version 5.x
          • Upgrade from Version 4.x
          • Migration from TheHive 3.x
        • Cortex Integration
        • MISP Integration
        • Service Configuration
        • Database and Index Authentication
        • Database and Index SSL
        • Akka (Version 5.3 and Earlier)
        • Pekko (Version 5.4+)
        • Docker Entrypoint Settings
        • JVM SSL Trust
        • HTTPS via Reverse Proxy
        • Outbound Proxy Settings
        • Log Configuration
        • GDPR Compliance Feature
        • Cassandra Cluster Operations
        • Cassandra Security Operations
        • MinIO Cluster Operations
          • Overview
            • Physical Server
            • Virtual Server
            • Docker Compose
            • Hot backups
            • Physical Server
            • Virtual Server
            • Docker Compose
            • Cloud Infrastructure
            • Restore hot backups
          • Deprecation Notice
          • Switch to Manual Download and Installation
        • Index Management
        • Troubleshooting Guide
        • Set Up Monitoring
        • First Start
          • About Organizations
          • About Organizations Sharing Rules
          • Create an Organization
          • Link an Organization
          • Lock an Organization
          • About User Accounts
          • Create a User Account
          • Manage User Accounts
          • Add or Remove An Existing User Account from an Organization
          • Delete a User Account
          • Lock a User Account
          • Export a List of User Accounts
          • Customize Branding
            • About Licenses
            • Request a Community License
            • Activate or Update a License
            • About Cortex
            • Add a Cortex Server
            • Remove a Cortex Server
            • About MISP Integration
            • Connect a MISP Server
            • Delete a MISP Server Connection
            • About Email Intake Connectors
            • Connect a Mailbox
            • Manually Fetch Emails
            • Delete a Mailbox Connection
            • Configure Authentication
              • Local
              • Active Directory (AD)
              • LDAP
              • OAUTH 2.0
              • SAML
              • OpenID
            • About SMTP
            • Configure an SMTP Server
            • About LDAP
            • Configure an LDAP Server
          • Add a Global Endpoint
            • About Profiles
            • Create a Profile
            • Add or Remove Permissions from a Profile
            • Delete a Profile
            • About Custom Fields
            • Create a Custom Field
            • Manage Custom Fields
            • Delete a Custom Field
            • Create an Observable Type
            • Delete an Observable Type
            • About Statuses
            • Create a Status
            • Change a Status Visibility
            • Change a Color Visibility
            • Delete a Status
            • About Analyzer Templates
            • Import Analyzer Templates
            • Customize an Analyzer Template
            • About Taxonomies
            • Add a Custom Taxonomy
            • Update MISP Taxonomies
            • Activate or Deactivate a Taxonomy
            • Delete a Taxonomy
            • About TTPs
            • Add a Catalog
            • Update a Catalog
            • Remove a Catalog
            • View Techniques
          • Fail2ban Configuration
          • Splunk Integration Guide
        • Flavored Markdown Syntax
        • Date Field Definitions
          • Manage your Account Settings
          • Manage your Password
          • Change your Account Theme
          • View your Account Profile and Permissions
          • Switch Between Organizations
          • Log Out of your Account
          • About the Knowledge Base
          • Create a Page
          • Delete a Page
          • View a Page
          • KPIs
          • Measure Case Management Performance
          • Measure Alert Management Performance
            • About User Accounts
            • Create a User Account
            • Manage User Accounts
            • Add or Remove An Existing User Account from an Organization
            • Lock a User Account
            • Export a List of User Accounts
              • About Case Templates
              • Create a Case Template
              • Delete a Case Template
              • Export or Import a Case Template
              • About Page Templates
              • Create a Page Template
              • Delete a Page Template
              • Export a Page Template
              • Import a Page Template
              • About Case Report Templates
              • Widgets
              • Create a Case Report Template
              • Add or Remove Widgets
              • Delete a Case Report Template
            • About Custom Tags
            • Change the Color of a Custom Tag
            • Rename a Custom Tag
            • Delete a Custom Tag
            • View Custom Tag Statistics
            • UI Configuration Settings
            • Prevent Users from Creating Empty Cases
            • Prevent Users from Merging Alerts into Closed Cases
            • Select Similar Cases and Alerts Filters
            • Pause Dashboard Refresh
            • Remove the All Periods Option in a Dashboard
            • Hide KPIs
            • Allow Custom Link Schemes
            • About Notifications
            • Create a Notification
            • Turn Off a Notification
            • Delete a Notification
            • Variable Usage Examples
              • EmailToUser
              • EmailToAddr
              • HttpRequest
              • Mattermost
              • Slack
              • Teams
              • Webhook
              • Kafka
              • Redis
              • RunAnalyzer
              • RunResponder
              • Function
              • Write a FilteredEvent Trigger
              • Operators
              • About Endpoints
              • Add a Local HttpRequest Endpoint
              • Add a Local Mattermost Endpoint
              • Add a Local Slack Endpoint
              • Add a Local Teams Endpoint
              • Add a Local Webhook Endpoint
            • About Functions
            • Create a Function
            • Delete a Function
            • Invoke a Function
            • Functions Objects
            • About Alert Feeders
            • Create an Alert Feeder
            • Turn Off an Alert Feeder
            • Delete an Alert Feeder
            • About Attachments
            • Add an Attachment
            • Remove an Attachment
            • Download an Attachment
            • Share an Attachment
          • Tutorial: Automate Tracking of Pending Alerts
            • About Alerts
              • Find an Alert
              • Overview of Search Methods for Alerts
            • Create a Case from an Alert
            • Add an Alert to an Existing Case
            • Unlink an Alert and a Case
            • Change an Alert Status
            • Change Alert Classification Settings
            • Enrich Alert Details
            • Ignore Alert Updates from MISP
            • Start Working on an Alert
            • Assign an Alert
            • Run a Function on a Case or Alert
            • Run Responders and Review Reports for an Alert
            • Find Similar Alerts or Cases
            • Export a List of Alerts
              • About Observables
              • Add an Observable
              • Update the Status of an Observable
              • Edit Multiple Observables
              • Exclude an Observable From Similarity Checks
              • Delete an Observable
              • Find an Observable
              • Find a Job
              • Share an Observable with Other Organizations
              • Export Data from an Observable
              • Pin an Observable
              • Run Analyzers and Review Reports for an Observable
              • Import Observables from Analyzer Reports
              • Run Responders and Review Reports for an Observable
              • About TTPs
              • Export TTPs
              • About Attachments
              • Add an Attachment
              • Remove an Attachment
              • Download an Attachment
              • Share an Attachment
              • About Tags
              • Add or Remove Tags
              • Add Custom Fields
              • Remove Custom Fields
              • Enter Values in Custom Fields
            • About Audit Logs
            • Comment on Cases or Alerts
            • Close an Alert
            • Reopen an Alert
            • About Cases
              • Find a Case
              • Overview of Search Methods for Cases
            • Create a Case
            • Export a List of Cases
            • Export an Archived Case
            • Export a Case to MISP
            • Apply a Case Template
            • Find Similar Alerts or Cases
              • About Observables
              • Add an Observable
              • Update the Status of an Observable
              • Edit Multiple Observables
              • Exclude an Observable From Similarity Checks
              • Delete an Observable
              • Find an Observable
              • Find a Job
              • Share an Observable with Other Organizations
              • Export Data from an Observable
              • Pin an Observable
              • Run Analyzers and Review Reports for an Observable
              • Import Observables from Analyzer Reports
              • Run Responders and Review Reports for an Observable
              • Add Custom Fields
              • Remove Custom Fields
              • Enter Values in Custom Fields
              • Add a Link to a Case
              • Remove a Link from a Case
              • View Links in a Case
              • View Alerts Linked to a Case
              • Unlink an Alert and a Case
            • Change a Case Status
            • Change Alert Classification Settings
            • Flag a Case
              • About Tags
              • Add or Remove Tags
            • Add Tasks to a Case
            • Merge Cases
            • Share a Case with Other Organizations
              • About TTPs
              • Add TTPs
              • Export TTPs
              • Remove TTPs
              • About Attachments
              • Add an Attachment
              • Remove an Attachment
              • Download an Attachment
              • Share an Attachment
              • About Case Timelines
              • Add a Custom Event
              • View a Case Timeline
              • Export a Case Timeline
              • Delete a Case Timeline
              • About Case Reports
              • Save and Download a Case Report
            • About Audit Logs
              • Restrict Case Visibility
              • Restore Case Visibility
            • Run a Function on a Case or Alert
            • Run Responders and Review Reports for a Case
            • Comment on Cases or Alerts
              • About Case Pages
              • Create a Page
              • Delete a Page
              • Share a Page
              • View a Page
            • Close a Case
            • Reopen a Case
            • Delete a Case
              • About Tasks
              • Create a Task
              • Start a Task
              • Change a Task Status
              • Manage Tasks
              • Export a List of Tasks
              • Delete a Task
                • Find a Task
                • Overview of Search Methods for Tasks
              • Run Responders and Review Reports for a Task
              • Share a Task with Other Organizations
              • Close a Task
              • About Task Logs
              • Create a Task Log
              • Delete a Task Log
              • Find a Task Log
              • Run Responders and Review Reports for a Task Log
            • About Dashboards
            • Widgets
            • Create a Dashboard
            • Add or Remove Widgets
            • Delete a Dashboard
            • Change Visibility of a Dashboard
            • Adjust Dashboard Refresh Frequency
            • Set a Dashboard Display Period
            • Export or Import a Dashboard
            • Download a Dashboard
          • Detail View vs. Preview
          • About Filtering and Sorting
            • About Views
            • Create a Custom View
            • Update a Custom View
            • Delete a Custom View
          • About Autorefresh
          • About Statistics
          • About the Live Feed
        • API Documentation
        • Python Client
        • Go Client
        • Release Notes for Version 5.0
        • Release Notes for Version 5.1
        • Release Notes for Version 5.2
        • Release Notes for Version 5.3
        • Release Notes for Version 5.4
        • Release Notes for Version 5.5
      • Home
        • Download Cortex
        • Authentication
        • Secret key configuration
        • Advanced configuration
        • Configure SSL
        • Step-by-Step Guide
        • Installation and Configuration Guides
        • Analyzers & Responders
        • Run Cortex with Docker
        • Proxy settings
        • Parameters for Docker
        • Database configuration
        • Deploy Cortex on Kubernetes
        • First start
        • User roles
        • Backup & Restore
        • Analyzers/Responders input and output
        • Upgrade to Cortex 3.1
        • Upgrade to Cortex 4.0
          • Deprecation Notice
          • Switch to Manual Download and Installation
        • API Guide
        • How to create an Analyzer
        • How to create a Responder
    • Cortex Neurons
      • Resources
      • TheHive Templates
        • How to download the VM
        • Use the Demo Virtual Machine
          • Main Features
          • Deploy TheHive AMI
          • Deploy Cortex AMI
          • AWS sample code
          • Create and manage the SecOps VPC
          • TheHive v5 and Cortex within a SecOps VPC
          • Main Features
          • Deploy TheHive Azure image
          • Deploy Cortex Azure image
          • Azure sample code
          • Creating a new SecOps Virtual Network
          • Deploying TheHive v5 and Cortex with Terraform
          • Upgrading your Azure instances
          • TheHive4py
          • TheHive4go
          • Cortex4py
          • Cortexutils
      • Security and Data Protection

    Cortex integration required

    Cortex integration required

    To use analyzers and responders within TheHive, you must connect at least one Cortex server to your TheHive instance.

    StrangeBee
    Empowering incident responders worldwide
    Company
    About usServicesContact us
    Products
    Request a demoTry TheHive On-premTry TheHive Cloud Platform SaaS
    Resources
    BlogSuccess storiesThird-party software licenses
    AICPA SOC certification
    Copyright 2025 StrangeBee. All rights reserved.