Cortex tries to solve a common problem frequently encountered by SOCs, CSIRTs and security researchers in the course of threat intelligence, digital forensics and incident response: how to analyze observables they have collected, at scale, by querying a single tool instead of several?
Note: This is the Cortex documentation repository. If you are looking for its source code, please visit https://github.com/CERT-BDF/Cortex/.
Cortex uses a Java VM. We recommend using a virtual machine with 8vCPU, 8 GB of RAM and 10 GB of disk. You can also use a physical machine with similar specifications.
Cortex can be installed using:
- An RPM package
- A DEB package
- Docker
- Binary
- Ansible script contributed by @drewstinnett
Cortex can also be built from sources.
Once you have installed Cortex, you need to install the analyzers and configure them.
Cortex is an open source and free software released under the AGPL (Affero General Public License). We, TheHive Project, are committed to ensure that TheHive will remain a free and open source project on the long-run.
Information, news and updates are regularly posted on TheHive Project Twitter account and on the blog.
We welcome your contributions. Please feel free to fork the code, play with it, make some patches and send us pull requests using issues.
We do have a Code of conduct. Make sure to check it out before contributing.
Please open an issue on GitHub if you'd like to report a bug or request a feature. We are also available on Gitter to help you out.
If you need to contact the Project's team, send an email to support@thehive-project.org.
Important Note:
- If you have troubles with a Cortex analyzer or would like to request a new one or an improvement to an existing analyzer, please open an issue on the analyzers' dedicated GitHub repository.
- If you encounter an issue with TheHive or would like to request the addition of a feature in it, please open an issue on its dedicated GitHub repository.
- If you have problems with TheHive4py, please open an issue on its dedicated repository.
We have set up a Google forum at https://groups.google.com/a/thehive-project.org/d/forum/users. To request access, you need a Google account. You may create one using a Gmail address or without it.