TheHive responders and Cortex analyzers
Custom Cortex analyzers and responders turn TheHive into the place where an analyst runs enrichment and response in one click, without switching between consoles.
The problem
TheHive ships with a library of analyzers and responders, and most SOCs need tools that are not in it: an internal CMDB, a regional threat feed, an EDR action. Without custom components, analysts copy observables out of the case and paste them elsewhere.
Stack
- Case management
- TheHiveCortex
- Language and delivery
- PythonGitGitHub ActionsGitLab CI
- Integrations
- MISPOpenCTIVirusTotalRecorded FutureServiceNowJiraEDR APIs
How it works
- 1
Identify
List the lookups and actions analysts repeat on observables such as IPs, domains, hashes, URLs, users and hosts.
- 2
Build analyzers
Write them in Python as Cortex analyzers. Each returns a short structured report and taxonomy tags, so results are readable at a glance and searchable.
- 3
Build responders
Write responders for actions on a case or an observable, such as blocking an indicator, isolating a host or opening a ticket in ServiceNow.
- 4
Automate
Analyzers run automatically when an observable is added. Responders chain from case templates and alerts.
- 5
Operate
Components are packaged, versioned and tested, their API secrets stay outside the code, and a pipeline deploys them.
Guardrails and failure handling
- Analyzers are read-only. Responders run under TheHive roles, so only the right people can trigger a block or an isolation.
- Rate limits and caching protect the external APIs and their quotas.
- Unit tests replay recorded API responses, so a component is checked without calling the live service.
What changes for the SOC
- Analysts stay in the case from alert to closure.
- Actions are consistent and appear in the case timeline.
- A new integration is a small Python module, not a project.