Creating Multiple Instances of the same responder type

[OlexTratisky]

Hello, i am running latest version of Cortex. I would like to create multiple instances of the same responder. Is this possible?
Idea is to have each instance bound to different artificats/playbooks

[OlexTratisky]

example is : velociraptor_workflow_01 , so multiple ones of that type with different artifacts each

[janderik]

Yes, you can create multiple instances of the same responder type in Cortex. Here's how:

Method 1: Multiple Docker containers

# docker-compose.yml
version: '3'
services:
  # First instance - for malware analysis
  responder-malware:
    image: thehiveproject/cortex-neurons:latest
    environment:
      - CORTEX_JOB_TYPE=responder
      - CORTEX_RESONDER_TYPE=MalwareAnalysis
      - CORTEX_RESONDER_NAME=MalwareAnalysis-Instance1
    volumes:
      - ./config-malware:/etc/cortex

  # Second instance - for forensics
  responder-forensics:
    image: thehiveproject/cortex-neurons:latest
    environment:
      - CORTEX_JOB_TYPE=responder
      - CORTEX_RESONDER_TYPE=MalwareAnalysis
      - CORTEX_RESONDER_NAME=MalwareAnalysis-Instance2
    volumes:
      - ./config-forensics:/etc/cortex

Method 2: Configuration-based

In your Cortex configuration file (application.conf):

responder {
  # Instance 1 - for high-priority tasks
  malware-analysis-1 {
    name: "MalwareAnalysis-HighPriority"
    analyzer: "MalwareAnalysis"
    config: {
      maxfilesize: 10485760  # 10MB limit
    }
  }
  
  # Instance 2 - for large files
  malware-analysis-2 {
    name: "MalwareAnalysis-LargeFiles"
    analyzer: "MalwareAnalysis"
    config: {
      maxfilesize: 104857600  # 100MB limit
    }
  }
}

Method 3: Different configurations for same analyzer

Create separate configuration profiles:

{
  "name": "VirusTotal-Light",
  "analyzer": "VirusTotal_Get_v3_1",
  "config": {
    "apikey": "API_KEY_1",
    "maxfilesize": 10485760
  }
},
{
  "name": "VirusTotal-Heavy",
  "analyzer": "VirusTotal_Get_v3_1",
  "config": {
    "apikey": "API_KEY_2",
    "maxfilesize": 104857600
  }
}

Best practices:

1. Naming convention: Use descriptive names like {Type}-{Purpose} (e.g., MalwareAnalysis-Sandbox, MalwareAnalysis-Quick)
2. Resource allocation: Different instances can have different resource limits
3. API keys: Use different API keys for different rate limits
4. Load balancing: Configure TheHive to distribute jobs across instances

TheHive integration:

In TheHive, you can specify which responder instance to use:

{
  "responder": {
    "name": "MalwareAnalysis-Sandbox",
    "maxrate": 10
  }
}

This allows you to route specific cases to specific responder instances.