Integrations¶
Cortex, LDAP/OIDC, and Elasticsearch are configured in settings.json — see
Configuration for the full reference.
TheHive, MISP, Watcher, SMTP, ChromaDB, and ai_narration are
connectors: their integrations.<name>
sections are DB-backed (editable via the connector admin/API, Vault-overlaid
for secret fields) rather than static settings.json blocks, though a
settings.json value still seeds them at first boot.
| Integration | Section | Purpose |
|---|---|---|
| Cortex | integrations.cortex |
Analyzer execution engine (required) |
| ChromaDB | integrations.chromadb |
Vector similarity search |
| TheHive | integrations.thehive |
Push cases to TheHive |
| MISP | integrations.misp |
Share indicators with MISP |
| Watcher | integrations.watcher |
Reconcile allow/deny domain lists against the Watcher service |
ai_narration |
integrations.ai_narration |
Plain-language case narration. Fires automatically via Ollama (default) or an operator-declared OpenAI-compatible endpoint (narration_provider = openai_compatible); OpenAI/Anthropic/Gemini are manual-only |
elastic_siem |
integrations.elastic_siem |
Forward cases at or above min_verdict to Elasticsearch as ECS documents for Elastic Security. Off by default; needs url and an api_key. See the connectors README |
xsoar |
integrations.xsoar |
Open a Cortex XSOAR incident for each finalised case at or above min_verdict. Off by default; needs url and an api_key (plus api_key_id on XSOAR 8). See the connectors README |
| LDAP / OIDC | authentication.ldap / authentication.oidc |
Single sign-on |
| Elasticsearch | (service) | Search and indexing |
| SMTP | email.smtp |
Outbound reporter notifications |
Each integration is optional except Cortex; leave a section's credentials blank,
enabled: false, or the connector disabled to turn it off.