Integration

Cortex integration

Cortex analysis and response engine API, the observable enrichment companion of TheHive: list the analyzers enabled for an organisation, run one against an observable, poll the resulting job, read its taxonomies and full report, and trigger responders that act on a verdict. Cortex is self hosted, so the instance host is part of the credential alongside the API key.

Connect Cortex How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Cortex.Built from the 15 Cortex tools below, on the connection you add once.

Common Cortex use cases

removing jobs created while testing an analyzer
discovering which automated response actions are available
finding every failed analysis to diagnose a broken analyzer
checking whether an observable was already analyzed recently
fanning an observable out to every analyzer that can process it
polling an analysis until it finishes before reading the verdict
confirming which organisation an automation credential belongs to
checking that a Cortex instance is reachable before submitting work
reading the verdict of an enrichment to drive an automated decision
blocking a confirmed malicious address through an automated responder

What you can do with Cortex

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Job, 7 operations

delete_jobDelete jobDELETEMarks a Cortex job as deleted so it stops appearing in searches.
get_jobGet jobGETReturns the current state of a Cortex job without downloading its report.
get_job_reportGet job reportGETReturns a Cortex job with the analyzer's taxonomies, full report and extracted artifacts.
list_jobsList jobsGETReturns recent Cortex jobs filtered by observable value, observable type or analyzer.
run_analyzerRun analyzerPOSTRuns a Cortex analyzer against an observable and returns the job to poll.
search_jobsSearch jobsPOSTSearches Cortex jobs with a structured query, sorting and paging.
wait_for_job_reportWait for job reportGETBlocks until a Cortex job finishes, then returns its report.

Analyzer, 3 operations

get_analyzerGet analyzerGETReturns the configuration of a single Cortex analyzer.
list_analyzersList analyzersGETReturns the analyzers this Cortex organisation has enabled, with the data types each accepts.
list_analyzers_by_typeList analyzers by typeGETReturns every enabled analyzer that can process a given observable type.

Responder, 3 operations

list_respondersList respondersGETReturns the responders this Cortex organisation has enabled.
list_responders_by_typeList responders by typeGETReturns every enabled responder that can act on a given input type.
run_responderRun responderPOSTTriggers a Cortex responder to act on a case, alert or observable.

Organization, 1 operation

list_organizationsList organizationsGETReturns the Cortex organisations the credential can see.

Status, 1 operation

get_statusGet statusGETReturns the Cortex version and authentication capabilities of the instance.

Use Cortex from Claude Code, Cursor or Codex

Connect Cortex in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Cortex operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Cortex

Create your workspace
Sign up free. Nothing to install.
Connect Cortex once
Add your Cortex connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Cortex integration FAQ

What can you do with the Cortex integration?

LiveContext exposes 15 operations on Cortex, covering job, analyzer, responder and organization. Common uses include removing jobs created while testing an analyzer, discovering which automated response actions are available and finding every failed analysis to diagnose a broken analyzer.