Get a result from the EmlParser analyzer (Cortex/TheHive)

Hello to all! This is my first post, I am currently working on N8N for TheHive and Cortex.

I’m having small problems using analyzers on Cortex that use files.

I explain in steps:

  • I get the attachment from an email.
  • I want to use the EmlParser analyzer with the attachment
  • Cortex launches the analyzer
  • The JSON result is empty

I tried to use virustotal with the site : https://google.fr → I get the result but with the files the result is empty.

I also tried via a technique on another post to add a script after the analyzer:

const waitTimeSeconds = 3;

return new Promise((resolve) => {

  setTimeout(() => {

    resolve(items);

  }, waitTimeSeconds * 1000);

});

But the problem comes from the analyzer

Thank you in advance for your help !

Hey @Twinki, welcome to the community :tada:

I am very sorry to hear you’re having trouble here. Unfortunately, I am not familiar with Cortex and don’t have an instance set up on my end. However, from looking at this website it sounds like the EmlParser_2_0 could be expecting an .eml file in the binary property you’re specifying in the respective node:

Submit a .eml formatted file and extract some useful information.

Is the attachment you’re passing on an .eml file?