Automated Email Incident Triage with TheHive and Cortex

• Automated Email Monitoring: Automatically processes incoming emails from an IMAP server, focusing on attachments.
• Dynamic TheHive Case Creation: Creates a new case in TheHive for each suspicious email, using attachment details and message IDs.
• Cortex-Powered IOC Extraction: Integrates with Cortex to analyze email attachments and extract critical IOCs like domains, email addresses, and IP addresses.
• Intelligent Observable Enrichment: Automatically enriches extracted IOCs with further threat intelligence, performing email reputation checks and gathering IP intelligence via OTX.
• Conditional Processing: Uses conditional logic to ensure only relevant IOCs are processed and added to TheHive cases.

To set up and utilize this powerful workflow, follow these steps:

1. Configure IMAP Email Node: Set up your IMAP credentials. Ensure the 'Format' is set to 'Resolved' to properly handle attachments.
2. Set Up TheHive Credentials: Create a new 'TheHiveApi' credential in n8n, providing your TheHive server URL and API key. This will be used by all TheHive nodes.
3. Set Up Cortex Credentials: Create a new 'CortexApi' credential in n8n, providing your Cortex server URL and API key.
4. TheHive (initial artifact & case creation): The 'TheHive' node creates an artifact (your email attachment). The 'Create Case' node promotes this artifact to a full case. These nodes are pre-configured to use data from the 'IMAP Email' node, but you may customize the title and description expressions if needed.
5. Analyzer Email & Cortex Nodes: The 'Analyzer Email' node triggers a Cortex analysis job on the email attachment. The 'Cortex' node then retrieves the report. Ensure your Cortex instance has the specified analyzers (24a64a086a410e1c7d7ace74003c4480::CORTEX) available.
6. Conditional IOC Handling (IF Node): This node checks if Cortex found any domains, emails, or IPs. No configuration is typically needed here.
7. Update Case Domain/Email/IP: These nodes automatically create new observables in TheHive for the detected IOCs. Ensure the correct 'dataType' is selected for each (e.g., 'domain', 'mail', 'ip').
8. Email Reputation & OTX IP: These final TheHive nodes trigger additional Cortex analyzers (e.g., 9902b4e5c58015184b177de13f2151c7::CORTEX for email reputation, b084bf78d1aea92966b6ef6a4f6193a5::CORTEX for OTX IP) on the newly created observables to enrich their data. Ensure these analyzers are configured in your Cortex instance.