TheHive + Cortex

In obserae: use the TheHive 5 output. You no longer need a webhook and a mapping of your own — this page used to describe building one, and that is now the fallback rather than the route.

Alerts in — the native output

Create a TheHive 5 output with your instance URL and an organisation API key. What arrives is what matters:

• Each address in the alert is a typed observable (dataType: "ip"), not a line of text in the description. An analyst can pivot on it immediately — search other cases, run a Cortex analyzer, drag it into a case. Addresses buried in prose have to be retyped, and in practice are not.
• Each observable carries obserae’s own context: the cartography host name as its message, and obserae:asset=…, obserae:group=…, obserae:role=…, obserae:intel=… as tags. An address a feed lists is flagged as an IOC, which is what drives TheHive’s highlighting.
• sourceRef is obserae’s incident key, so TheHive deduplicates on the same identity obserae does — and keeps doing so after you rename the rule.

Lifecycle events are off by default for TheHive. Once an analyst has taken an alert, its state belongs to the SIRP; obserae reaching back in to close it would be fighting your own workflow.

If your TheHive predates version 5, or you need a mapping obserae does not produce, a Webhook output pointed at TheHive’s own POST https://thehive.example.com/api/v1/alert still works — map dedup_key → sourceRef, rule.name → title, rule.severity → severity, and each entities[].ip to an observable of type ip. That last one is the part worth the effort; the rest is decoration.

Context out — a Cortex analyzer

The direction the output does not cover. A short Python analyzer calling GET /api/enrichment/lookup?ip=<observable> returns obserae’s asset resolution and feed verdicts into the observable’s report.

Return the taxonomy as obserae:asset="ci-runner-prod" and obserae:intel="tor" — a taxonomy an analyst reads at a glance beats a JSON blob they have to open.

Responder — deliberately not

obserae has no action to trigger, so a Cortex responder against obserae would have nothing to call. The responders in this workflow act on your firewall, and they belong to your firewall’s integration.