Cortex n8n integrationAutomate Cortex with n8n.
Cortex sits between your detection tools and the analysis you still run by hand. The Cortex n8n integration exposes 4 operations across 3 resources: Analyzer, Responder and Job. No Cortex trigger node exists, so a workflow starts on a schedule or a webhook, then runs the analysis and reads the report.
Verified Trustpilot reviews · AI, automation & growth agency
What does the Cortex n8n integration actually do?
The Cortex node applies an analyzer or a responder to a given entity on a Cortex server you host yourself. An analyzer takes an observable, the value you want checked, and returns a verdict. A responder takes an entity and acts on it. Both run as jobs on the server, and the node can pull a job and its report back into the workflow afterwards.
Start with the case that costs the most attention: every observable checked before a human looks at it. A Schedule Trigger reads pending rows from Postgres, the node runs analyzer.execute on each one, and the verdict lands in a Slack channel with the observable value attached. The analyst opens the channel, not the console.
Containment that does not wait for the morning shift is the second pattern. Once a verdict comes back, an IF node routes the bad ones to responder.execute, which passes the entity to the responder you picked. The entity travels as JSON, so whatever produced it earlier in the workflow can be reused directly.
An archive you can actually search closes the loop. Analysis jobs finish on the server, and job.report returns the report for a job ID. Append it to Google Sheets and three months later you can answer what was checked and what came back, without opening Cortex at all. One public template, 1602, pairs the Cortex node with the TheHive node to analyze emails; another, 809, does nothing but fetch job details.
Where the node stops is easy to state. It covers analyzers, responders and job details, and nothing else of the Cortex API. Anything outside those 4 operations goes through the HTTP Request node, which calls any endpoint of the API and reuses the same credential through predefined authentication. There is also no Cortex trigger, so the workflow always starts somewhere else.
If you are weighing the platform rather than the node, the n8n review covers self-hosting and cost, and the n8n training walks through expressions and error handling on real workflows.
How do you connect Cortex to n8n?
- 01
Install Cortex on your server
Cortex is software you run yourself, so the first step happens outside n8n. Install it on a server that your n8n instance can reach over the network, and note the address it answers on. The credential form later expects that address in the form
http://<your_server_address>:9001/, which is the default shown in the field. - 02
Generate an API key in Cortex
Authentication uses a single API key, and Cortex issues it from its own interface. Generate the key for the account whose analyzers and responders the workflow should use, because a job runs with the permissions attached to that key. Copy the value straight away, then keep it out of the workflow itself: it belongs in the credential, not in a node field.
- 03
Create the Cortex credential in n8n
In n8n, open the Credentials menu and create a Cortex credential, which is the stored pair n8n uses to authenticate. Paste the key into API Key and the server address into Cortex Instance. A credential is created once and offered in the dropdown of every Cortex node afterwards, so a second workflow needs no new setup.
What can the Cortex node do?
The Cortex node exposes 4 operations across 3 resources. For each one: the node as you configure it in n8n, the required fields, and our field notes.
Analyzer
1 operationExecute an analyzer
analyzer.executeWhat you see in n8n
Notes & use cases
Runs one analyzer against one observable and returns the job that Cortex created for it.
Key parameters
- Analyzer Type Name or ID: picked from the list the node loads from your server, or set with an expression like
{{ $json.analyzer }}. - Observable Type Name or ID: the type of value being submitted, from a similar list.
- Observable Value: the value itself.
- Put Output File in Field: the name of the output binary field the file goes into.
- TLP: the sharing level of the analyzed observable, from
0White to3Red. - Force: bypasses the cache when a value was already analyzed and you want a fresh run.
Job
2 operationsGet a job
job.getWhat you see in n8n
Notes & use cases
Returns the details Cortex holds for one job, identified by its ID.
Key parameters
- Job ID: the ID of the job, typically
{{ $json.id }}carried over from the node that started it.
Get a job report
job.reportWhat you see in n8n
Notes & use cases
Pulls back what the analyzer or responder produced once the job is done.
Key parameters
- Job ID: the same identifier, reused after the job has finished rather than while it runs.
Responder
1 operationExecute a responder
responder.executeWhat you see in n8n
Notes & use cases
Hands an entity to a responder so Cortex acts on it instead of only describing it.
Key parameters
- Responder Type Name or ID: which responder to run, from the list or from an expression.
- Entity Type Name or ID: the data type of the object you are passing.
- Entity Object (JSON): the object itself, as JSON.
- JSON Parameters: switches between one JSON object and separate attributes entered through Parameters.
Need help automating Cortex with n8n?
A person reads every message.
