External Integrations: Cortex Analyzer
Sekoia.io is providing a Cortex analyzer to enrich data in TheHive ecosystem.
Objective
Collect Sekoia.io CTI feed in an existing Cortex instance self-managed, for any operational purpose such as CTI aggregation, dissemination, hunting...
Prerequisites:
- An operational Cortex instance with administrator privileges
- An active Sekoia.io licence with access to the CTI
- An access to Sekoia.io User Center with the permissions to create an API key with CTI permissions
Note
Sekoia Intelligence feed will be available upon Cortex setup
1. Connect to Cortex
1- In a Web browser, type the following http://server_ip:cortex_port
2- Enter your login and password of your Cortex instance setup beforehand with orgadmin
role
2. Configuration
1- Setup the Analyzer configuration
1- Select your Organization on the top right corner
2- Go to Analyzers Config tab and Search SekoiaIntelligenceCenter
3- Edit and Add your Sekoia API key and Base url
2- Setup the Analyzer
1- Go to Analyzers tab and Search SekoiaIntelligenceCenter
2- Edit and Add your Sekoia API key and Base url
3- Check Sekoia intelligence
1- Go to job page
2- Select SekoiaIntelligenceCenter
in Analyzers
3- Click on view
to see details of the job
3. Troubleshoot
1- Go to Analyzers tab > Run an analyzer
2- Check the jobs in Jobs History tab
4. Other resources
- The Cortex official documentation
https://github.com/TheHive-Project/CortexDocs/blob/master/installation/install-guide.md#docker
http://docs.thehive-project.org/cortex/user-guides/first-start/
https://github.com/TheHive-Project/CortexDocs/blob/master/admin/quick-start.md