cortex_disable_analyzer
Remove an enabled analyzer from your organization to deactivate its use in security investigations.
Instructions
Disable (remove) an enabled analyzer from the current organization
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| analyzerId | Yes | The enabled analyzer's ID (the internal ID from cortex_list_analyzers, not the definition ID) |
Implementation Reference
- src/tools/analyzer-definitions.ts:176-207 (registration)Registration of the 'cortex_disable_analyzer' tool with the McpServer, defining its name, description, and input schema.
server.tool( "cortex_disable_analyzer", "Disable (remove) an enabled analyzer from the current organization", { analyzerId: z .string() .describe("The enabled analyzer's ID (the internal ID from cortex_list_analyzers, not the definition ID)"), }, async ({ analyzerId }) => { try { await client.deleteAnalyzer(analyzerId); return { content: [ { type: "text" as const, text: `Analyzer "${analyzerId}" has been disabled and removed from the organization.`, }, ], }; } catch (error) { return { content: [ { type: "text" as const, text: `Error disabling analyzer: ${error instanceof Error ? error.message : String(error)}`, }, ], isError: true, }; } }, ); - Handler for 'cortex_disable_analyzer'. Calls client.deleteAnalyzer(analyzerId) and returns success/error content.
async ({ analyzerId }) => { try { await client.deleteAnalyzer(analyzerId); return { content: [ { type: "text" as const, text: `Analyzer "${analyzerId}" has been disabled and removed from the organization.`, }, ], }; } catch (error) { return { content: [ { type: "text" as const, text: `Error disabling analyzer: ${error instanceof Error ? error.message : String(error)}`, }, ], isError: true, }; } }, - Input schema for 'cortex_disable_analyzer': requires analyzerId (string) describing the enabled analyzer's internal ID.
"Disable (remove) an enabled analyzer from the current organization", { analyzerId: z .string() .describe("The enabled analyzer's ID (the internal ID from cortex_list_analyzers, not the definition ID)"), }, - src/client.ts:145-150 (helper)Client method deleteAnalyzer that sends a DELETE request to /analyzer/{analyzerId}.
async deleteAnalyzer(analyzerId: string): Promise<void> { await this.request<void>( `/analyzer/${encodeURIComponent(analyzerId)}`, { method: "DELETE" }, ); } - src/index.ts:40-44 (registration)Top-level registration call registerAnalyzerDefinitionTools(server, client) which registers the tool.
registerAnalyzerDefinitionTools(server, client); registerResponderDefinitionTools(server, client); registerStatusTools(server, client); registerOrganizationTools(server, client); registerUserTools(server, client);