CORTEX n8n INTEGRATION: AUTOMATE CORTEX WITH N8N

The "Responder - Execute" action is your gateway to automated incident response within Cortex. Responders are Cortex's action-oriented counterparts to analyzers—while analyzers investigate, responders take action. This action allows you to programmatically trigger any responder configured in your Cortex instance, enabling automated blocking, containment, notification, and remediation workflows.

Configuration parameters: Credential to connect with is a required dropdown that lets you select your Cortex account credentials. Resource is pre-set to "Responder," indicating this action operates specifically on responder objects within Cortex. Operation is set to "Execute," defining that this action will trigger the responder to perform its configured task. Responder Type Name or ID is a text input field where you specify which responder to execute (either the name or the internal ID). Entity Type Name or ID is a text input for specifying the related entity type (e.g., "thehive:case," "thehive:alert"). JSON Parameters is a toggle switch that, when enabled, allows you to pass parameters in raw JSON format instead of using individual fields.

Typical use cases: Automatically block malicious IPs across firewalls when threat intelligence confirms a threat; send automated notifications to stakeholders when critical incidents are detected; trigger containment actions (isolate endpoints, disable accounts) based on SIEM alerts; execute custom remediation scripts when specific attack patterns are identified.

When to use it: Deploy this action when you need to automate response procedures that previously required manual intervention. It's particularly valuable in 24/7 SOC environments where immediate response is critical but human availability isn't guaranteed.

The "Get a job report" action retrieves the full, detailed report generated by a completed Cortex job. While "Get a job" provides status and metadata, this action delivers the actual analysis output—the findings, indicators, scores, and detailed results that analysts need to make decisions.

Configuration parameters: Credential to connect with is a required dropdown for selecting the Cortex account credentials that authorize the API call. Resource is set to "Job," indicating the action operates on job resources within Cortex. Operation is set to "Report," specifying that this action will retrieve the complete report output rather than just job metadata. Job ID is a required text input field where you provide the unique identifier of the job whose report you want to retrieve (supports expressions for dynamic job ID injection).

Typical use cases: Extract malware analysis results and automatically create TheHive case artifacts; parse threat intelligence reports and update blocking lists across security tools; send formatted analysis summaries to communication platforms (Slack, Teams, email); archive detailed reports to documentation systems or SIEM platforms for compliance.

When to use it: Use this action when you need the actual substance of an analysis—not just whether it completed, but what it found. It's the action that bridges Cortex analysis capabilities to downstream decision-making and automation documentation workflows.

The "Get a job" action retrieves detailed information about a specific analysis or responder job within Cortex. Every time Cortex runs an analyzer or responder, it creates a job with a unique identifier. This action lets you programmatically fetch the status, results, and metadata of any job, making it essential for building workflows that depend on analysis outcomes.

Configuration parameters: Credential to connect with is a required dropdown menu for selecting your Cortex account credentials. Resource is set to "Job," indicating this action operates on job objects—the records of analyzer and responder executions. Operation is set to "Get," meaning the action will retrieve information about a single job rather than listing multiple jobs. Job ID is a required text input field where you specify the unique identifier of the job you want to retrieve (supports expressions for dynamic injection).

Typical use cases: Check the completion status of long-running analyzer jobs before proceeding with downstream actions; retrieve analysis results and route them to different workflow branches based on findings; monitor responder execution and trigger alerts if jobs fail or timeout; build dashboards that display real-time job status across multiple Cortex analyzers.

When to use it: This action is fundamental for any workflow that needs to wait for or react to Cortex analysis results. Use it after triggering an analyzer to check when results are ready, or to fetch historical job data for reporting purposes. You can also explore similar patterns with our Zendesk n8n integration for ticket-based workflows.