Cortex Analyzer Module

Quickly integrate DFIR-IRIS with Cortex to run any Cortex Analyzer.

Cortex Analyzer

SOCFortress provided DFIR-IRIS module.
Contact SOCFortress »

Intro

Use the Cortex Analyzer module to run Cortex Analyzers via the DFIR-IRIS platform.

Get started with Cortex: Video Tutorial

The module is built for the below IoC types:

• Ip Address
• Domain
• Hash (MD5, SHA224, SHA256, SHA512)

You can configure the module to run any Cortex Analyzer you like.

⚠ You must have the Analyzer enabled within Cortex prior to running the module.

Configuration

Results

Install

Currently, the Cortex Analyzer module can be ran as DFIR-IRIS Module.

Get started with DFIR-IRIS: Video Tutorial

The below steps assume you already have your own DFIR-IRIS application up and running.

1. Fetch the Cortex Analyzer Module Repo

   git clone https://github.com/socfortress/iris-cortexanalyzer-module
   cd iris-cortexanalyzer-module
   

2. Install the module

   ./buildnpush2iris.sh -a
   

Configuration

Once installed, configure the module to include:

• Cortex API Endpoint (e.g. http://localhost:9001)
• Cortex API Key
• Cortex Analyzer Name (e.g. VirusTotal_GetReport_3_0)

1. Navigate to Advanced -> Modules

Advanced -> Modules

2. Add a new module

Add a new module

3. Input the Module name: iris_cortexanalyzer_module

Input Module

4. Configure the module

Configure Module

Running the Module

To run the module select Case -> IOC and select the dropdown menu.

Module currently supports IoC of type: ip, domain, hash

IoC

Run Module

Refresh the webpage within your browser.

Auto refresh is coming soon

Issues?

If you are experiencing issues, please contact us at [email protected]