DomainTools Iris Integration for TheHive and Cortex
User Guides

DomainTools Iris Integration for TheHive and Cortex

Installing the DomainTools Iris App


Deploy App

Follow the steps to install the Integration components in your local environment:

  1. SSH into Cortex instance
  2. The deployment script (listed in Prerequisites) automates the cloning and deployment of the components. To run the script, execute the command:
    ./ in the home directory

  3. If the automated script ran successfully, skip this step. Otherwise you can manually install it by following the below steps:
    1. Change directory to Cortex Analyzer home:
      cd /opt/Cortex-Analyzers/analyzers
    2. Create a folder for DomainTools :
      mkdir DomainToolsIris
    3. Import Analyzer: Copy downloaded analyzers into your Analyzer home directory
    4. Import Report Templates:
      Copy the report templates into the Cortex template home directory:

      cp -af ~/cortex/thehive-templates/DomainToolsIris*
    5. Import Responders (optional):
      Copy the responders into responder home directory

      cp -af ~/cortex/responders/DomainToolsIris* /opt/Cortex-Analyzers/responders

Configure App

  • Login into Cortex instance
  • Select the appropriate Organization (optional) -> Click ‘Analyzers Config’
  • Search for ‘DomainToolsIris’ → Click Edit
    • Update Analyzer Config with the following:
      • username: DomainTools Iris API credentials
      • key: DomainTools Iris API credentials
      • pivot_count_threshold: Pivot count threshold. (Default: 500)

  • Click ‘Responders Config’ to update the Responder config.
    • Update the following values:
      • Risk Score Threshold
      • Tags

  • Enable the two Analyzers as below:
  • Overriding Cache setting:
    This is an optional step if you want to use the default Cache setting. The ‘Use Global’ setting uses whatever is configured in Cortex for the organization. You can override the setting to a Custom value. Setting a low value will allow you to bypass the cache and retrieve updated intelligence data from DomainTools.

Test Setup

There are two ways you can verify the setup of the App. You can use either of them based on your preference:

  1. Click Analyzers from Top Menu -> Filter on DomainToolsIris -> Identify ‘DomainToolsIris_Investigate_1_0’ -> Click Run.
  2. Alternatively, you can use the New Analysis from the top left corner of the Menu
    You will see the below screen. Complete the fields marked mandatory, and Click ‘Start’

  3. You can verify results by clicking ’Job History’ and filtering for the Observable you supplied in the above step: