TheHive-Project/Cortex

Health v2 · maintenance only

Adoption not part of the score

1618 stars · 265 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Cortex is an open-source observable analysis and active response engine for SOCs, CSIRTs, and security researchers. It lets analysts analyze observables like IPs, URLs, domains, files, and hashes at scale via a web interface or REST API, using dozens of pluggable analyzers and responders, and integrates tightly with TheHive and MISP.

Use cases

• analyze IPs, URLs, domains, and file hashes in bulk during incident response
• enrich IOCs with threat intelligence from a single tool
• automate observable analysis via a REST API
• run responders to take active response actions on observables
• integrate automated analysis into TheHive or MISP workflows
• write custom analyzers for internal tools and services

When to choose

• you run a SOC or CSIRT and need to analyze many observables at scale
• you want one tool to orchestrate dozens of threat-intel enrichment services
• you use TheHive or MISP and want native analyzer integration
• you need a horizontally scalable, stateless REST API for automated enrichment

When to avoid

• you need a general-purpose SIEM or case management platform (use TheHive alongside it)
• you want a lightweight one-off IOC lookup script rather than an analysis engine
• you cannot host a JVM-based Linux service or maintain Docker deployments

Facets

service · maturity maintenance

security workflow-automation api-framework http-server security self-hosted dfir soc csirt observable-analysis analyzer-engine responder thehive misp ioc-enrichment rest-api scala agpl incident-response threat-intelligence digital-forensics automation linux web-server docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="TheHive-Project/Cortex")