TheHive Cortex Analyzer
Detection & Response Enablement
概要
This integration enables TheHive to query OpenCTI for observable matches through Cortex analyzers, allowing investigators to enrich observables with threat intelligence directly from case artifacts.
The TheHive Cortex OpenCTI integration provides TheHive users with the ability to search and enrich observables using OpenCTI's threat intelligence database through Cortex analyzers. This integration streamlines threat investigation workflows by enabling direct lookups of observables from within TheHive cases.
Key capabilities include:
- Exact Observable Matching: Use the OpenCTI_SearchExactObservable analyzer to retrieve precise matches for observables in the OpenCTI platform
- Broad Observable Search: Leverage the OpenCTI_SearchObservables analyzer to find all observables containing the input data, enabling broader threat context discovery
基本情報
Filigran
Nino Rowlands
サードパーティとの統合
Incident Response & Case Management
2026年8月19日
5.6.1
2