cortex_analyze_observable
Run security analyzers on an observable (IP, domain, hash, etc.) and collect aggregated results with taxonomy summary. Supports auto-detection of data type.
Instructions
Run applicable analyzers against an observable and collect aggregated results with taxonomy summary. Can auto-detect data type. By default only an explicit allowlist of analyzers runs; set fanOut=true to submit to every applicable analyzer (capped by CORTEX_MAX_FANOUT). Fanning out submits the observable to many third-party services (SSRF-by-proxy / IOC disclosure / quota burn), so it is opt-in.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pap | No | Permissible Actions Protocol level (0-3). Default: 2 | |
| tlp | No | Traffic Light Protocol level (0=WHITE, 1=GREEN, 2=AMBER, 3=RED). Default: 2/AMBER | |
| data | Yes | The observable value (IP, domain, hash, URL, email, etc.) | |
| fanOut | No | If true, submit the observable to ALL applicable analyzers (capped by maxAnalyzers / CORTEX_MAX_FANOUT). Default false: you must pass an `analyzers` allowlist. | |
| timeout | No | Timeout in seconds per analyzer (default: 300) | |
| dataType | No | The observable data type. If omitted, will be auto-detected from the value. | |
| analyzers | No | Explicit allowlist of analyzer names (substring match, case-insensitive) to run. Required unless fanOut=true. Only matching analyzers that also support the data type are submitted. | |
| maxAnalyzers | No | Hard cap on how many analyzers to run this call. Defaults to and is clamped by the server's CORTEX_MAX_FANOUT (default 10). |