Cortex Configuration

Harsh Radadiya

Harsh Radadiya

Aug 19, 2024

3 Min

TABLE OF CONTENTS

  1. What is Cortex ?
  2. Why use Cortex ?
  3. Hardware Requirement
  4. Operating Systems
  5. Installation Guide
  6. Conclusion
  7. References

Screenshot 2024-08-20 055316.png

What is Cortex ?

  • Cortex is an open-source analysis and response tool specifically designed for security operations. It automates the analysis of observables and incidents, enabling security teams to respond to threats swiftly and efficiently.
  • With Cortex, users can leverage a wide array of analyzers to process various types of data, including IP addresses, domain names, URLs, and file hashes. This flexibility ensures comprehensive threat intelligence and streamlined incident response.
  • Integration with TheHive, another powerful security platform, allows Cortex to seamlessly share information and actions, enhancing the overall effectiveness of security operations. This integration helps maintain a cohesive and efficient security ecosystem.
  • Cortex's ability to automate and expedite analysis processes significantly reduces the workload on security teams, allowing them to focus on more critical tasks. Its open-source nature ensures continual improvement and community support, making it a robust solution for modern cybersecurity challenges.

Why use Cortex ?

  • Automated Analysis: Cortex automates the analysis of observables and incidents, reducing the manual effort and speeding up response times.
  • Integration: It seamlessly integrates with various security tools and platforms like TheHive, MISP, and SIEM solutions, enhancing overall security operations.
  • Scalability: Cortex supports a wide range of analyzers, allowing organizations to scale their threat intelligence and incident response capabilities effectively.
  • Efficiency: By centralizing and automating analysis tasks, Cortex improves the efficiency of security teams, enabling them to focus on more critical issues.
  • Customizability: Users can create custom analyzers and response scripts tailored to their specific security needs, providing flexibility and adaptability in threat management. 

Hardware Requirement

Hardware requirements depends on the usage of the system. We recommend starting with dedicated resources: 

  • 4 vCPU 
  • 16 GB RAM 

Operating Systems

Cortex has been tested and is supported on the following operating systems: 

  • Ubuntu 20.04 LTS 
  • Debian 11 
  • RHEL 8 
  • Fedora 35

Installation Guide

Step 1 :

  • If you are using one of the supported operating systems, use this all-in-one installation script:

    wget -q -O /tmp/install.sh https://archives.strangebee.com/scripts/install.sh ; sudo -v ; bash /tmp/install.sh
  • Select 3.
  • This script helps with the installation process on a fresh and supported OS ; the program also run successfully if the conditions in terms of hardware requirements are met.

01.png

 

Step 2 (Connect to Cortex) :

  • When Cortex is installed and configured, open your web browser and connect to :

    http://<CORTEX_IP>:9001.

 

Step 3 (Update Database) :

  • Cortex uses Elasticsearch to store users, organizations and analyzers configuration. The first time you connect to the Web UI (http://<CORTEX_IP>:9001), you have to create the database by clicking the Update Database button.

02.png

 

Step 4 (Create Cortex Administrator) :

  • Create a login username and password.

03.png

 

Step 5 (Login Cortex) :

04.png

  • You will note that the default cortex organization has been created and that it includes your user account, a Cortex global administrator.

05.png

 

Step 6 (Create an Organization) :

  • Click on Add organization.

07.png

 

Step 7 (Create an Organization User) :

  • Click on Organization name.
  • Click on Add User.

08.png

  • After create user set a password for user login.
  • Click on New Password and  set password.

Conclusion

  • The blog explains how to configure Cortex, an open-source tool for security operations, emphasizing its automated analysis capabilities, integration with other security platforms, scalability, efficiency, and customizability. It provides a step-by-step installation guide, including system requirements, database setup, and creating an administrator. 
  • Additionally, it details the process of creating an organization and adding users within Cortex. These steps ensure a streamlined and efficient setup, allowing security teams to leverage Cortex for enhanced threat intelligence and incident response.
Harsh Radadiya
Harsh RadadiyaSOC Analyst L2
linkedin

SOC Analyst professional with 2 years expertise in incident monitoring and reporting. He has previous experience as a SOC Analyst at Zeronsec India Pvt. Ltd. Holds a Bachelor’s degree in BCA from Veer Narmad South Gujarat University (VNSGU).

Share

Share to Microsoft Teams
Header Logo

Attack. Defend. Comply. Privacy.

InstagramTwitterLinkedinFacebook

Register with:

Linkedin
Copyright © 2019 - 2024 Certbar Security Pvt. Ltd. All rights reserved.