Cortex

Cortex, maintained by StrangeBee, is an open-source analysis engine and active response platform designed to automate the enrichment, investigation, and observable orchestration of security incidents. Engineered to complement incident response platforms such as TheHive and modern SIEM/SOAR ecosystems, Cortex enables security operations analysts to analyze digital observables—including IP addresses, domain names, file hashes, email addresses, and URLs—at scale through a unified REST API. Cortex utilizes an extensible framework of modular analyzers and responders: analyzers automatically query dozens of external threat intelligence services and reverse engineering tools to collect rich forensic context, while responders execute active remediation actions like isolating endpoints or blocking domains on perimeter firewalls. By consolidating disparate threat intelligence APIs behind a centralized engine, Cortex eliminates the need for analysts to manually copy and paste indicators across browser tabs, drastically accelerating alert triage. The platform features robust multi-tenancy, granular role-based access controls, and rate-limiting safeguards to manage API quota consumption across third-party threat feeds. Cortex empowers security teams to automate repetitive forensic workflows, standardize threat analysis, and significantly reduce mean time to triage in high-volume security operations centers.