Wait For Job Report
cortex.wait_job_report
ActionBusiness appsconnection required
Calls the Cortex API with the connection's credentials.
Hold the request open until a job finishes, then return its report.
Connection
- Required
- Yes — the node will not save without one
- Auth type
- Bearer token
- Providers
- Cortex
- Secret shape
- the Cortex organisation API key, or {"api_key": "…"}
- Config it needs
- base_url
- Resolved by
- config.connection_id, else node.connection_id
Configuration
2 fields, 1 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.
| Field | Type | Required | Default | Constraints | Example |
|---|---|---|---|---|---|
job_id Cortex's id for the job, as returned by cortex.run_analyzer or cortex.run_responder. | string | Yes | — | — | — |
at_most How long to wait before returning whatever the job has. Cortex answers as soon as the job ends, so a longer window costs nothing when the worker is quick. | string | No | 1minute | one of "1minute", "30second", "2minute", "5minute", "10minute", "30minute", "1hour" | — |
Example configuration
Every value below is the contract’s own example or default — nothing invented.
{
"at_most": "1minute"
}Output
One shape.
result
| Field | Type | Example |
|---|---|---|
id Cortex's id for the job — what the report nodes are given. | string | — |
analyzerId Id of the worker that runs the job. | string | — |
analyzerName Name of the worker that runs the job. | string | — |
analyzerDefinitionId Catalogue definition of that worker. | string | — |
status Where the job is: Waiting, InProgress, Success, Failure or Deleted. | string | — |
dataType The observable or record type the job was given. | string | — |
data The observable the job was given. | string | — |
tlp The Traffic Light Protocol level the job carries. | number | — |
pap The Permissible Actions Protocol level the job carries. | number | — |
message The context message sent with the job. | string | — |
errorMessage Why the worker failed, when it did. | string | — |
parameters The parameters the job was started with. | object | — |
organization The Cortex organisation the job belongs to. | string | — |
type Either 'analyzer' or 'responder'. | string | — |
label The label given to the job, if any. | string | — |
date When the job was created, as an ISO-8601 timestamp. | string | — |
startDate When the worker started, as an ISO-8601 timestamp. | string | — |
endDate When the worker finished, as an ISO-8601 timestamp. | string | — |
finished True when Cortex returned a real report object. It is false while the job is still running, and 'report' is then Cortex's status word instead. | boolean | — |
report The report object, or the status word for an unfinished job. | any | — |
report.success Whether the worker completed successfully. | boolean | — |
report.summary The worker's short summary, with its taxonomies. | object | — |
report.full The worker's full report, in its own shape. | object | — |
report.artifacts Observables the worker extracted from its input. | array | — |
report.operations Actions the worker asked TheHive to perform. | array | — |
report.errorMessage Why the worker failed, when it did. | string | — |
{
"analyzerDefinitionId": "",
"analyzerId": "",
"analyzerName": "",
"data": "",
"dataType": "",
"date": "",
"endDate": "",
"errorMessage": "",
"finished": false,
"id": "",
"label": "",
"message": "",
"organization": "",
"pap": 0,
"parameters": {},
"report": {
"artifacts": [],
"errorMessage": "",
"full": {},
"operations": [],
"success": false,
"summary": {}
},
"startDate": "",
"status": "",
"tlp": 0,
"type": ""
}See Wait For Job Report run in a workflow.
In a technical demo we add the Cortex connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.