Import Observables from Analyzer Reports

manageObservable

Cortex analyzers enrich observables with detailed contextual intelligence, generating a report with the results, which may include additional observables.

Import observables from analyzer reports in TheHive to add additional observables discovered during analysis to your case or alert.

Procedure

1. Locate the observable on which you ran the analyzer.

2. In the observable details, select the relevant report in the Reports section.

   

3. In the Analysis report drawer, under the Observables extracted from analysis report section, select next to the observables you want to import.

4. Select Import observables.

5. In the Adding an observable drawer, review the prefilled information.

6. Select Confirm.

Next steps

• Add an Observable
• Delete an Observable
• Update the Status of an Observable
• Edit Multiple Observables
• Pin an Observable
• Export Data from Observables
• Run Analyzers and Review Reports for an Observable
• Run Responders and Review Reports for an Observable
• Exclude an Observable from Similarity Checks