No more chaos in your browser tabs every time you investigate observables: thanks to TheHive’s native integration with the Cortex engine, you can launch analyses in a single click—and the results will flow straight into your TheHive cases.
With over 300 out-of-the-box integrations to third-party tools, you’re always ready to analyze and quickly respond to any threat.
Incident response teams often have a diverse set of tools in their toolbox to analyze observables. Some are highly efficient, while others are used to provide indications without being fully trusted. Analysts still prefer to confirm their judgments by obtaining reputations from multiple sources.
Once your Cortex is connected to TheHive and your Cortex analyzers are enabled, triggering an analysis and getting a report directly into the case is a breeze: just click on the little “fire” button (see the screenshot below). The great thing is that the report will be archived and available at any time, in case someone reviews the case and wonders why a particular decision was made.
Once the analysis is complete, small labels are applied so anyone viewing the list of observables can instantly see which items are marked as malicious, suspicious or safe. Blue labels indicate useful information.
All analyzers in the StrangeBee catalog come with an HTML report template, transforming each analysis result from a raw API JSON response into a clean, human-readable document that highlights the most relevant information for analysts.
By embedding analysis tools directly into cases, TheHive helps analysts eliminate redundant actions and stay focused on what matters most: analyzing data and making informed decisions.
Responders are another powerful way to eliminate the repetitive tasks your analysts perform every day. By automating these actions and making them directly accessible, you ensure that incident responses are handled faster and more effectively.
Imagine an alert about a suspicious file detected on a host. You run analyzers to learn more about the file or its hash—and discover it’s linked to a botnet known to spread across the network.
No time to lose! Instead of switching to your EDR, searching manually for the infected host and requesting its isolation, you can simply launch a responder straight from the observable in TheHive to isolate the host immediately.
By making this action available directly within TheHive, analysts save precious time when it matters most, protecting the organization before the threat spreads.
Cortex responders aren’t only designed for the most critical or urgent actions. They can also be used to transfer information from a case to third-party tools—for example, via their APIs.
With responders, your imagination is the only limit. They empower analysts with fast, effective and easily accessible automations that reduce response time and lighten their workload.
