cortex_run_analyzer_by_name
Run a named analyzer on an observable by providing the analyzer name, data type, and value. Optionally set TLP and PAP levels.
Instructions
Run an analyzer by name instead of ID (convenience wrapper)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| analyzerName | Yes | The analyzer name to search for | |
| dataType | Yes | The observable data type | |
| data | Yes | The observable value | |
| tlp | No | Traffic Light Protocol level (default: 2/AMBER) | |
| pap | No | Permissible Actions Protocol level (default: 2) |