Cortex organization boundaries decide what an analyzer API key can reach

Cortex organization boundaries determine the scope of what an analyzer API key can access, according to the Cortex documentation. An API key represents an organization's credential and controls the range of operations allowed. A superadmin key can list organizations, while an organization administrator can enable analyzers and an analyst can submit a job. The role defines allowed operations, but the organization defines the data and configuration the operation can access.

To maintain security, organization administrators should limit analyzer configuration to a small support role and rotate provider keys when necessary. Review outbound network access from Cortex to external analysis services, as a compromised analyzer configuration can turn the platform into a request proxy or leak observables to unintended providers. Rate limits and quotas serve as security controls, requiring meaningful limits and monitoring of rejected jobs and repeated provider failures.

When creating a test user in an organization, grant only the read or analyze role needed for the workflow, generate its API key, and use it to list analyzers, submit a benign observable, and attempt organization-management actions. Repeat this process from a dedicated TheHive integration account. Ensure the API key does not appear in visible configuration fields, screenshots, or workflow exports.

Regularly review organization-boundary settings, remove dormant integrations, and test the analyzer's outbound path, including resolving provider hostnames and inspecting proxy settings. This inventory helps ensure the analyzer's authority, including its key, organization, role, and analyzer credentials, is clear and accountable.