# TheHive-Project/Cortex

Cortex: a Powerful Observable Analysis and Active Response Engine

Repository: https://github.com/TheHive-Project/Cortex
Canonical: https://ross.abutalabs.com/products/thehive-project-cortex
Homepage: https://strangebee.com/cortex/
Language: Scala
License: AGPL-3.0
License Family: copyleft
Topics: response, dfir, analysis, analyzer, thehive, engine, scala, python, rest, api, security-incidents, digital-forensics, iocs, observable, free, free-software, open-source, incident-response, cyber-threat-intelligence, cortex
Last push: 2026-06-30T09:01:11+00:00

## Health v2 (maintenance only)
Score: 84/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 90, release rhythm 66, longevity 100
- inputs: {"age_days": 3522, "days_push": 64, "days_rel": 64, "gap_med": 134, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1618, forks 265 (observed 2026-08-28T04:05:12.144174+00:00)

## What it is
Cortex is an open-source observable analysis and active response engine for SOCs, CSIRTs, and security researchers. It lets analysts analyze observables like IPs, URLs, domains, files, and hashes at scale via a web interface or REST API, using dozens of pluggable analyzers and responders, and integrates tightly with TheHive and MISP.

## Use cases
- analyze IPs, URLs, domains, and file hashes in bulk during incident response
- enrich IOCs with threat intelligence from a single tool
- automate observable analysis via a REST API
- run responders to take active response actions on observables
- integrate automated analysis into TheHive or MISP workflows
- write custom analyzers for internal tools and services

## When to choose
- you run a SOC or CSIRT and need to analyze many observables at scale
- you want one tool to orchestrate dozens of threat-intel enrichment services
- you use TheHive or MISP and want native analyzer integration
- you need a horizontally scalable, stateless REST API for automated enrichment

## When to avoid
- you need a general-purpose SIEM or case management platform (use TheHive alongside it)
- you want a lightweight one-off IOC lookup script rather than an analysis engine
- you cannot host a JVM-based Linux service or maintain Docker deployments

## Facets
- artifact type: service
- maturity: maintenance
- function: security, workflow-automation, api-framework, http-server
- domain: security
- platform: self-hosted
- tags: dfir, soc, csirt, observable-analysis, analyzer-engine, responder, thehive, misp, ioc-enrichment, rest-api, scala, agpl, incident-response, threat-intelligence, digital-forensics, automation, linux, web-server, docker

## Member repositories
- TheHive-Project/Cortex (main) score 84

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:12.144174+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:49:37.601601+00:00, confidence not recorded.
  - readme: https://github.com/TheHive-Project/Cortex (fetched 2026-08-28T04:05:12.144174+00:00, sha d3d3f9971635)
  - homepage: https://strangebee.com/cortex/ (fetched 2026-08-29T11:22:13.363235+00:00, sha fb410c256a84)
  - site_page: https://strangebee.com/about-strangebee (fetched 2026-08-29T11:22:13.374506+00:00, sha 314e4b0d6874)
  - site_page: https://strangebee.com/thehive-features (fetched 2026-08-29T11:22:13.378207+00:00, sha 32b3ec8a83c7)
  - site_page: https://docs.strangebee.com (fetched 2026-08-29T11:22:13.379925+00:00, sha 1ed6c17ecb4d)
  - site_page: https://docs.strangebee.com/ (fetched 2026-08-29T11:22:13.383371+00:00, sha 1ed6c17ecb4d)
  - site_page: https://strangebee.com/thehive-pricing (fetched 2026-08-29T11:22:13.372706+00:00, sha ee63c03d6507)
  - site_page: https://strangebee.com/thehive-integrations (fetched 2026-08-29T11:22:13.376440+00:00, sha 3cb0ddb76a17)
  - site_page: https://strangebee.com/integrations (fetched 2026-08-29T11:22:13.381645+00:00, sha 3cb0ddb76a17)
- Data as of 2026-08-30T08:39:29.467469+00:00.