List all enabled analyzers, optionally filtered by data type

Get details about a specific analyzer by ID

Submit an observable to a specific analyzer for analysis

Run an analyzer by name instead of ID (convenience wrapper)

Submit a file to a specific analyzer for analysis. Provide a file path or base64-encoded content.

Get the status and details of an analysis job

Get the full report of a completed analysis job

Wait for a job to complete and return the full report (with polling timeout)

List recent analysis jobs with optional filters

Get artifacts (extracted observables/IOCs) from a completed analysis job

Delete a specific analysis job by ID. DESTRUCTIVE: requires confirm=true.

Delete multiple jobs by status or age. Useful for cleaning up failed or old jobs.

List all enabled responders, optionally filtered by data type

Execute a responder action against a TheHive entity (case, task, artifact, alert). DESTRUCTIVE: responders perform real-world side effects (blocking IPs, sending mail, isolating hosts). Gated behind the CORTEX_ALLOW_DESTRUCTIVE env var AND confirm=true.

Run applicable analyzers against an observable and collect aggregated results with taxonomy summary. Can auto-detect data type. By default only an explicit allowlist of analyzers runs; set fanOut=true to submit to every applicable analyzer (capped by CORTEX_MAX_FANOUT). Fanning out submits the observable to many third-party services (SSRF-by-proxy / IOC disclosure / quota burn), so it is opt-in.

List all available analyzer definitions (installed but not necessarily enabled). Filter by data type or find analyzers that require no API keys.

Enable an analyzer definition in the current organization. Provide configuration values for any required fields.

Disable (remove) an enabled analyzer from the current organization. DESTRUCTIVE: requires confirm=true.

List all available responder definitions (installed but not necessarily enabled). Filter by data type or find responders that require no API keys.

Enable a responder definition in the current organization. Provide configuration values for any required fields.

Disable (remove) an enabled responder from the current organization

Get Cortex instance health status, version info, and configuration

List all organizations (requires superadmin API key via CORTEX_SUPERADMIN_KEY)

Get details about a specific organization (requires superadmin API key)

Create a new organization in Cortex (requires superadmin API key)

Update an organization's description or status (requires superadmin API key)

List all users across organizations (requires superadmin API key via CORTEX_SUPERADMIN_KEY)

Get details about a specific user (requires superadmin API key)

Create a new user in an organization (requires superadmin API key)

Generate a new API key for a user (invalidates the previous key). Requires superadmin API key.

Get the current API key for a user. Requires superadmin API key.