List Responders

cortex.list_responders
ActionBusiness appsconnection required

Calls the Cortex API with the connection's credentials.

List the responders enabled for the connection's organisation.

Connection

Required
Yes — the node will not save without one
Auth type
Bearer token
Providers
Cortex
Secret shape
the Cortex organisation API key, or {"api_key": "…"}
Config it needs
base_url
Resolved by
config.connection_id, else node.connection_id

Configuration

1 field, none required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.

FieldTypeRequiredDefaultConstraintsExample
range
How much of the result set to return, as a Cortex range window: '0-49' for the first fifty, or 'all' for every match. Leave it blank for Cortex's own default page.
stringNo——0-49

Example configuration

Every value below is the contract’s own example or default — nothing invented.

{
  "range": "0-49"
}

Output

One shape.

result

FieldTypeExample
items
The enabled responders, exactly as Cortex returned them.
array—
items[].id
Cortex's id for the worker, used in the run path.
string—
items[].name
The worker's name, e.g. VirusTotal_GetReport.
string—
items[].version
The worker's version.
string—
items[].analyzerDefinitionId
The catalogue definition this worker was enabled from.
string—
items[].description
What the worker does, as its author wrote it.
string—
items[].author
Who wrote the worker.
string—
items[].url
The worker's home page.
string—
items[].license
The worker's licence.
string—
items[].dataTypeList
The observable data types this worker accepts, such as ip or domain.
array—
items[].type
Either 'analyzer' or 'responder'.
string—
count
How many workers this response carried.
number—
{
  "count": 0,
  "items": [
    {
      "analyzerDefinitionId": "",
      "author": "",
      "dataTypeList": [],
      "description": "",
      "id": "",
      "license": "",
      "name": "",
      "type": "",
      "url": "",
      "version": ""
    }
  ]
}

See List Responders run in a workflow.

In a technical demo we add the Cortex connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.