Lion Cipher Lab
Triage a security alert in TheHive with Cortex enrichment
- Threat Intel Analyst
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Enriching one indicator in a browser is a fine skill, but it does not scale and it does not survive a shift change. On a real SOC or CSIRT the moment an alert matters, it becomes a case — a shared, durable record that a whole team collaborates on, with observables, a timeline, assigned tasks, and a chain of custody an auditor or a court could follow. TheHive is the open-source platform that most small and mid-size teams reach for to do exactly that, and Cortex is the engine bolted alongside it that runs the enrichment lookups (VirusTotal, AbuseIPDB, MISP, and dozens more) for you,…
What you'll learn
- deploying TheHive + Cortex + Cassandra + Elasticsearch locally with Docker Compose
- connecting Cortex to TheHive so analyzers can be run from inside a case
- enabling a Cortex analyzer and supplying its API key (VirusTotal free tier)
- the alert-to-case triage workflow: receive an alert, promote it to a case
- adding observables (an IP, a domain, a file hash) and marking the malicious ones as IOCs
- running a Cortex analyzer to enrich an observable and reading the result on the case
- assigning tasks and closing a case with a resolution summary
- the judgment of why case management (TheHive), enrichment (Cortex) and intel (MISP) are separate systems, and when a full SOAR is overkill
Steps in this lab
- The three systems, and when you reach for them
- Know what you are signing up for (the honest resource cost)
- Deploy the stack with Docker Compose
- First login and wiring Cortex into TheHive
- Enable a Cortex analyzer and give it its API key
- Receive an alert and promote it to a case
- Enrich an observable by running a Cortex analyzer
- Mark IOCs, assign tasks, and close the case
- Do it better — and when NOT to bother