cortex_run_analyzer_by_name
Execute a Cortex security analyzer using its name to analyze observables like IPs, domains, or files for threat detection and investigation.
Instructions
Run an analyzer by name instead of ID (convenience wrapper)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| analyzerName | Yes | The analyzer name to search for | |
| dataType | Yes | The observable data type | |
| data | Yes | The observable value | |
| tlp | No | Traffic Light Protocol level (default: 2/AMBER) | |
| pap | No | Permissible Actions Protocol level (default: 2) |