What it does
Cortex is an open-source engine for analyzing observables such as hashes, domains, URLs and files through a web interface or REST API.
Cortex collects analysis integrations behind one workflow. An analyst can submit an observable to selected analyzers rather than manually repeat the same lookup across several tools. Its README describes individual and bulk analysis and integration with TheHive and MISP. Choose analyzers according to the information they send to external services. A local file hash and a confidential sample have different disclosure implications. Define that policy before automating enrichment across a case.
Strengths
- Shared individual and bulk observable analysis
- TheHive and MISP integrations
Best for
- SOCs standardizing approved enrichment workflows
Sources
- Cortex and TheHive (Oct 26, 2026)
- Cortex LICENSE (Oct 26, 2026)