Configure the RunAnalyzer Notifier#
Configure the RunAnalyzer notifier in TheHive to automatically execute Cortex analyzers when specific triggers occur.
Notifier availability
The RunAnalyzer notifier is available only when you turn off the Send notification to every user in the organization toggle and use one of the following triggers:
- FilteredEvent
- AlertObservableCreated
- CaseObservableCreated
- ObservableCreated
Cortex integration required
To use analyzers and responders within TheHive, you must connect at least one Cortex server to your TheHive instance.
Procedure
-
Go to the Organization view from the sidebar menu.
-
Select the Notifications tab.
-
Select next to the notification where you want to add the notifier, then select Edit.
-
Select the RunAnalyzer notifier.
-
Select the analyzers you want to run.
-
Select Confirm.