cortex_run_analyzer
Analyze security observables like IPs, domains, and URLs by submitting them to specific analyzers for threat investigation and automated response actions.
Instructions
Submit an observable to a specific analyzer for analysis
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| analyzerId | Yes | The analyzer ID to run | |
| dataType | Yes | The observable data type | |
| data | Yes | The observable value (IP, domain, hash, URL, etc.) | |
| tlp | Yes | Traffic Light Protocol level (0=WHITE, 1=GREEN, 2=AMBER, 3=RED) | |
| pap | Yes | Permissible Actions Protocol level (0-3) | |
| message | No | Optional context message for the analysis |