Skip to content

Getting started

Installation

corcli is published as a Python package and can be installed with pip, ideally by using a virtual environment. corcli uses python-magic and require the installation of libmagic.

  1. Install libmagic:
sudo apt-get install libmagic1

sudo yum install libmagic

brew install libmagic

port install file

pip install python-magic-bin
  1. Open up a terminal and install corcli with:
pip install corcli

pip install corcli=="1.*"

It will automatically install all dependencies: inquirer, cortex4py, colorama and toml.

using Docker

A docker image is available from the repository and comes with all dependencies pre-installed. Open up a terminal and pull the image with:

docker pull ghcr.io/0xfustang/corcli:1.1.0

docker pull ghcr.io/0xfustang/corcli:1.x

Configuration

corcli can use a configuration file containing information about the Cortex instances and aliases. Feel free to use the example below or the one from the code repository. Just copy the .example file into myconfigfile.toml to get started.

You can name a group of analyzers to call. In the configuration file below, I set the group malware to call three analysers that I regularly use.

title = "cortex-cli configuration file"

[cortex-instance]

[cortex-instance.default]
url = "https://cortex.local"
verify_cert = true

hashlookup = 'CIRCLHashlookup_1_1'
urlhaus = 'URLhaus_2_0'
malbazaar = 'MalwareBazaar_1_0'
eml = 'EmlParser_2_1'
vt = 'VirusTotal_GetReport_3_1'
doh = 'GoogleDNS_resolve_1_0_0'
misp = 'MISP_2_1'
octi = 'OpenCTI_SearchObservables_2_0'

malware = ['CIRCLHashlookup_1_1', 'MalwareBazaar_1_0', 'VirusTotal_GetReport_3_1']

[cortex-instance.dev]
url = "https://cortex-dev.local"
verify_cert = false

octi = 'OpenCTI_SearchObservables_2_0'

[cortex-instance.ext]
url = "https://cortex-ext.local/"
verify_cert = true
Note

corcli uses TOML configuration file.

Warning

Do not change cortex-instance.default, corcli won't be able to read the default instance config

Now that you have a configuration file, use the option -cf or --config-file.

API key

corcli can use the environment variables for the API key to provide or just use the -k or --api-key argument. If none of these options are used, you will be prompted to add the API key.

export CORTEX_CLI_API="API_KEY"
corcli -cf ~/corcli_config/corcli.toml -d google.com

corcli -cf ~/corcli_config/corcli.toml -k API_KEY -d google.com

Submit your first job

To submit a job to Cortex use the following:

corcli -cf ~/corcli_config/corcli.toml -d google.com

corcli -u https://cortex.afterlife.local -d google.com

docker run -ti -e CORTEX_CLI_API=$CORTEX_CLI_API --rm -v $CONFIG_PATH:/app/config/ -v $(pwd):/app/ ghcr.io/0xfustang/corcli:1.1.0 corcli -cf config/corcli.toml -d google.com

docker run -ti -e CORTEX_CLI_API=$CORTEX_CLI_API --rm -v $(pwd):/app/ ghcr.io/0xfustang/corcli:1.1.0 corcli -c https://cortex.local -d google.com

You will find more use cases in the Usage page.

Tips

corcli aliases

Take advantage of the aliases for your favorites analyzers by configuring your configuration file, otherwise corcli will prompt you to select one of the enabled Cortex's analyzers.

Note

If the analysers present in your configuration file gets updated you will need to manually apply the changes.

corcli -cf ~/corcli_config/corcli.toml -d google.com -a eml

corcli -u https://cortex.afterlife.local -d google.com -a eml -a hashlookup -a doh

sh alias

You can set a bash or zsh alias to call corcli with your regular configuration file. 

alias corcli='source /path/to/your_virtual_env/bin/activate && python -m corcli -cf ~/corcli_configs/corcli.toml'

alias corcli='docker run -ti -e CORTEX_CLI_API=$CORTEX_CLI_API --rm -v $CONFIG_PATH:/app/config/ -v $(pwd):/app/ ghcr.io/0xfustang/corcli:1.1.0 corcli -cf config/corcli.toml'