Skip to content

Configure the RunAnalyzer Notifier#

manageConfig Platinum

Configure the RunAnalyzer notifier in TheHive to automatically execute Cortex analyzers when specific triggers occur.

Notifier availability

The RunAnalyzer notifier is available only when you turn off the Send notification to every user in the organization toggle and use one of the following triggers:

  • FilteredEvent
  • AlertObservableCreated
  • CaseObservableCreated
  • ObservableCreated

Cortex integration required

To use analyzers and responders within TheHive, you must connect at least one Cortex server to your TheHive instance.

Procedure

  1. When creating a new notification or editing an existing one, select the RunAnalyzer notifier.

  2. Select the analyzers you want to run.

  3. Select Confirm.

Next steps