Skip to content

socfortress/iris-cortexanalyzer-module

Repository files navigation

Cortex Analyzer Module Awesome

Quickly integrate DFIR-IRIS with Cortex to run any Cortex Analyzer.

MIT License LinkedIn your-own-soc-free-for-life-tier youtube-channel


Logo

Cortex Analyzer

SOCFortress provided DFIR-IRIS module.
Contact SOCFortress »

Intro

Use the Cortex Analyzer module to run Cortex Analyzers via the DFIR-IRIS platform.

Get started with Cortex: Video Tutorial

The module is built for the below IoC types:

  • Ip Address
  • Domain
  • Hash (MD5, SHA224, SHA256, SHA512)

You can configure the module to run any Cortex Analyzer you like.

You must have the Analyzer enabled within Cortex prior to running the module.

Configuration




Results




Install

Currently, the Cortex Analyzer module can be ran as DFIR-IRIS Module.

Get started with DFIR-IRIS: Video Tutorial

The below steps assume you already have your own DFIR-IRIS application up and running.

  1. Fetch the Cortex Analyzer Module Repo
    git clone https://github.com/socfortress/iris-cortexanalyzer-module
    cd iris-cortexanalyzer-module
    
  2. Install the module
    ./buildnpush2iris.sh -a
    

Configuration

Once installed, configure the module to include:

  • Cortex API Endpoint (e.g. http://localhost:9001)
  • Cortex API Key
  • Cortex Analyzer Name (e.g. VirusTotal_GetReport_3_0)
  1. Navigate to Advanced -> Modules

Advanced -> Modules




  1. Add a new module

Add a new module




  1. Input the Module name: iris_cortexanalyzer_module

Input Module




  1. Configure the module

Configure Module




Running the Module

To run the module select Case -> IOC and select the dropdown menu.

Module currently supports IoC of type: ip, domain, hash

IoC




Run Module




Refresh the webpage within your browser.

Auto refresh is coming soon

Issues?

If you are experiencing issues, please contact us at [email protected]

About

IRIS module to run Cortex Analyzer

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published