--api-status--
{"versions":{"Cortex":"3.1.8-1","Elastic4Play":"1.13.6","Play":"2.8.19","Elastic4s":"7.17.2","ElasticSearch client":"7.17.1"},"config":{"protectDownloadsWith":"malware","authType":["key","local"],"capabilities":["authByKey","changePassword","setPassword"],"ssoAutoLogin":false}}
--application-conf--
# Cortex 3.x application.conf overlay — SEC-006 / ADR-034.
#
# Mounted into the container at /etc/cortex/application.conf:ro. The
# stock Cortex entrypoint generates a stub config that ends with
# `include file("/etc/cortex/application.conf")`, so this file is the
# canonical place to declare ES + per-instance settings.

# Elasticsearch backend (lives on the security network as `thehive-es`).
# Cortex 3.1.8 expects `search.uri`; the older host-list setting is ignored
# and leaves real API calls pointed at the upstream default of 127.0.0.1:9200.
search {
  index = "cortex"
  uri = "http://thehive-es:9200"
}

# TheHive authenticates to Cortex with the service-account API key
# provisioned by scripts/cortex-apikey.sh. Keep local auth enabled for the
# lab UI and bootstrap path, and add the key provider for in-network API
# clients such as TheHive.
auth.provider = ["local", "key"]

# NOTE: Cortex HTTPS termination is intentionally NOT enabled here.
#
# Cortex 3.1.8 bundles Play 2.8.19. Its `play.core.server.ssl.DefaultSSLEngineProvider`
# fails reflection at runtime with
#   `java.lang.ClassCastException: No constructor with
#    (appProvider:play.core.ApplicationProvider) or no-args constructor defined!`
# regardless of HTTP/2 enabled/disabled, `https.keyStore.*` vs
# `play.server.https.keyStore.*`, or whether the keystore is PKCS12 or JKS.
# The failure mode is intrinsic to the Cortex-bundled Play artifact, not
# the lab CA / keystore generation pipeline — the keystore round-trips
# cleanly via the unit tests in tests/test_soc_ca.py.
#
# Cortex remains HTTP-only on the aptl-security network, but TheHive now
# consumes it in-network through the fixture API key provisioned by
# scripts/cortex-apikey.sh and mounted into TheHive via
# config/cortex/thehive-cortex.env. The lab CA bundle is still mounted for
# outbound trust; server-side HTTPS can be revisited after a Cortex 4.x
# upgrade or a Play SSL-provider fix.

--generated-runtime-conf--
play.http.secret.key="GaPu97gEdL2k4mgtTzHM2JIGlKYiNUIQMtYwEUQp2lnUNNTqlUGtfqS7L9aTpYpc"
job.directory="/opt/cortex/jobs"
analyzer.urls=["https://download.thehive-project.org/analyzers.json"]
responder.urls=["https://download.thehive-project.org/responders.json"]
include file("/etc/cortex/application.conf")

--jobs-dir-top-level--
total 8
drwxr-xr-x 2 cortex root 4096 Jun 11 16:00 .
drwxr-xr-x 1 root   root 4096 Jun 11 16:00 ..

--es-indices--
health status index            uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .geoip_databases TGnTluEpStKZhulcAmXv7w   1   0         32            0       30mb           30mb
yellow open   cortex_6         Ufyl_oZHTkiD-eWF1qRgwg   1   1          2            0     27.2kb         27.2kb

--cortex-index-mapping--
{"cortex_6":{"mappings":{"properties":{"createdAt":{"type":"long"},"createdBy":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"description":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"key":{"type":"keyword"},"name":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"organization":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"password":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"preferences":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"relations":{"type":"keyword"},"roles":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"status":{"type":"keyword"},"updatedAt":{"type":"long"},"updatedBy":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}}}}
--cortex-index-count--
{"count":2,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0}}
