CortexJobID

[emalderson]

CortexJobID

[emalderson]

Hello, I have never encountered this error. However, it may be due either to the version of Cortex that you are using (the tool has been tested with the versions listed in the guide related to docker) or to the fact that one of the analyzers that you have enabled is not working properly, so the JSON representation of the job does not contain the keys needed for ThePhish to work. Try enabling only the analyzers that have been tested, as explained in the guide.
P.S. Also check if the configuration with the API KEY of Cortex is working.

[jcandiat]

Dear, problem solved! indeed, the problem was in that part of the configuration. I knew where to get that info and it worked! Again, grateful for such excellent work.

[jcandiat]

Thank you very much for the information!
I think my mistake may be in the settings. Previously, I had already installed and running thehive with the cortex integrated into the MISP.
My version of Cortex is: 3.1.1-1

And looking at the documentation, I think the ID of the cortex is wrong and I don't know where to get it from.

[mgrant0]

I'm also hitting this error. I have tried using the login id of the cortex user. Is that the 'id'? I don't see anything else that looks like it could be an id associated with the account that I created the api key for. Another ticket, a user said they got this from the About page but I see nothing like an ID on that page, even logged in as that user. If this ID is not the string which is the Cortex user's login, what ID do I put in the conf file with this API key?

[emalderson]

As I said before, it is in the part related to Cortex in the "application.conf" file used by TheHive. Alternatively, it can be found in the "About" window of TheHive. Here an image taken from the internet is attached showing that ID:

The ID to use for Cortex here is literally the string "CORTEX-SERVER". Similarly, for MISP you have to use the ID that is literally "MISP-SERVER".