Some Cortex Nodes are not running jobs

Hi Team,

I got a workflow where i get email from Imap Node, then create cases and observables on TheHive.
After that i run analyzers for each observable.
The problem is that some cortex nodes are not running those analyzers.
The marked node are not running analyzers.
What can be the reason for this behavior?
Thanks in advance.

.

The Workflow

{
  "name": "soar_workfkow",
  "nodes": [
    {
      "parameters": {},
      "name": "Start",
      "type": "n8n-nodes-base.start",
      "typeVersion": 1,
      "position": [
        2150,
        110
      ]
    },
    {
      "parameters": {
        "format": "resolved",
        "options": {
          "allowUnauthorizedCerts": true
        }
      },
      "name": "IMAP Email",
      "type": "n8n-nodes-base.emailReadImap",
      "typeVersion": 1,
      "position": [
        921,
        1423
      ],
      "credentials": {
        "imap": "Imap Server"
      }
    },
    {
      "parameters": {
        "functionCode": "const { Readable } = require('stream');\n\n// retrieve the base64 encoded data (from the attachment)\nconst data = getBinaryData().attachment_0.data; \n// convert it into a buffer\nconst buff = new Buffer(data, 'base64');\n// create a stream\nconst stream = Readable.from(buff.toString());\n\nconst simpleParser= require('mailparser').simpleParser;\nconst parsed = await simpleParser(stream)\n\n//item.result = parsed;\nreturn parsed"
      },
      "name": "FunctionItem",
      "type": "n8n-nodes-base.functionItem",
      "typeVersion": 1,
      "position": [
        1761,
        1713
      ]
    },
    {
      "parameters": {
        "conditions": {
          "number": [
            {
              "value1": "={{Object.keys($binary).length}}",
              "operation": "larger"
            }
          ]
        }
      },
      "name": "IF1",
      "type": "n8n-nodes-base.if",
      "typeVersion": 1,
      "position": [
        981,
        1893
      ]
    },
    {
      "parameters": {
        "functionCode": "item.filename = getBinaryData().attachment_0.fileName;\nvar test = item.filename.slice(-3);\nreturn test;\n"
      },
      "name": "FunctionItem1",
      "type": "n8n-nodes-base.functionItem",
      "typeVersion": 1,
      "position": [
        1281,
        1873
      ]
    },
    {
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{$json[\"0\"]}}{{$json[\"1\"]}}{{$json[\"2\"]}}",
              "value2": "eml"
            }
          ]
        }
      },
      "name": "IF",
      "type": "n8n-nodes-base.if",
      "typeVersion": 1,
      "position": [
        1511,
        1873
      ],
      "alwaysOutputData": false
    },
    {
      "parameters": {
        "resource": "case",
        "operation": "create",
        "title": "={{$node[\"FunctionItem\"].json[\"subject\"]}}",
        "description": "=From:{{$node[\"FunctionItem\"].json[\"from\"][\"value\"][0][\"address\"]}}\nTo: {{$node[\"FunctionItem\"].json[\"to\"][\"value\"][0][\"address\"]}}\n\n{{$node[\"FunctionItem\"].json[\"text\"]}}",
        "severity": 1,
        "startDate": "2021-05-07T15:20:43.000Z",
        "owner": "Soc Notifications",
        "tags": "Phishing, soc",
        "options": {}
      },
      "name": "TheHive",
      "type": "n8n-nodes-base.theHive",
      "typeVersion": 1,
      "position": [
        1951,
        1783
      ],
      "credentials": {
        "theHiveApi": "TheHive API"
      }
    },
    {
      "parameters": {
        "resource": "observable",
        "operation": "create",
        "caseId": "={{$node[\"TheHive\"].json[\"_id\"]}}",
        "dataType": "mail",
        "data": "={{$node[\"FunctionItem\"].json[\"from\"][\"value\"][0][\"address\"]}}",
        "message": "={{$node[\"FunctionItem\"].json[\"text\"]}}",
        "startDate": "2021-05-07T15:42:51.000Z",
        "status": "Ok",
        "options": {}
      },
      "name": "TheHive1",
      "type": "n8n-nodes-base.theHive",
      "typeVersion": 1,
      "position": [
        2081,
        1643
      ],
      "credentials": {
        "theHiveApi": "TheHive API"
      }
    },
    {
      "parameters": {
        "dataPropertyName": "=html",
        "extractionValues": {
          "values": [
            {
              "key": "body",
              "cssSelector": "body"
            }
          ]
        },
        "options": {}
      },
      "name": "HTML Extract",
      "type": "n8n-nodes-base.htmlExtract",
      "typeVersion": 1,
      "position": [
        1061,
        1143
      ]
    },
    {
      "parameters": {
        "resource": "case",
        "operation": "create",
        "title": "= {{$node[\"Merge\"].json[\"subject\"]}}",
        "description": "=From:{{$node[\"IMAP Email\"].json[\"from\"][\"value\"][0][\"address\"]}}\nTo:{{$node[\"IMAP Email\"].json[\"to\"][\"value\"][0][\"address\"]}}\n\n{{$node[\"HTML Extract\"].json[\"body\"]}}",
        "startDate": "2021-05-17T15:37:13.000Z",
        "owner": "soc-notifications",
        "tags": "soc",
        "options": {}
      },
      "name": "TheHive2",
      "type": "n8n-nodes-base.theHive",
      "typeVersion": 1,
      "position": [
        1271,
        1143
      ],
      "credentials": {
        "theHiveApi": "TheHive API"
      }
    },
    {
      "parameters": {
        "resource": "observable",
        "operation": "create",
        "caseId": "={{$node[\"TheHive2\"].json[\"_id\"]}}",
        "dataType": "mail",
        "data": "={{$node[\"IMAP Email\"].json[\"from\"][\"value\"][0][\"address\"]}}",
        "message": "=",
        "startDate": "2021-05-07T16:03:41.000Z",
        "status": "Ok",
        "options": {}
      },
      "name": "TheHive3",
      "type": "n8n-nodes-base.theHive",
      "typeVersion": 1,
      "position": [
        1531,
        1143
      ],
      "credentials": {
        "theHiveApi": "TheHive API"
      }
    },
    {
      "parameters": {
        "resource": "observable",
        "operation": "create",
        "caseId": "={{$node[\"TheHive\"].json[\"_id\"]}}",
        "dataType": "file",
        "message": "=",
        "status": "Ok",
        "options": {}
      },
      "name": "TheHive4",
      "type": "n8n-nodes-base.theHive",
      "typeVersion": 1,
      "position": [
        2261,
        1963
      ],
      "credentials": {
        "theHiveApi": "TheHive API"
      }
    },
    {
      "parameters": {
        "mode": "jsonToBinary",
        "options": {
          "fileName": "download.hml"
        }
      },
      "name": "Move Binary Data",
      "type": "n8n-nodes-base.moveBinaryData",
      "typeVersion": 1,
      "position": [
        2081,
        1963
      ]
    },
    {
      "parameters": {
        "mode": "jsonToBinary",
        "options": {
          "fileName": "data.json",
          "mimeType": "application/json"
        }
      },
      "name": "Move Binary Data1",
      "type": "n8n-nodes-base.moveBinaryData",
      "typeVersion": 1,
      "position": [
        1290,
        880
      ]
    },
    {
      "parameters": {
        "resource": "observable",
        "operation": "create",
        "caseId": "={{$node[\"TheHive2\"].json[\"_id\"]}}",
        "dataType": "file",
        "binaryProperty": "=data",
        "message": "=",
        "startDate": "2021-05-08T10:10:08.000Z",
        "status": "Ok",
        "options": {}
      },
      "name": "TheHive5",
      "type": "n8n-nodes-base.theHive",
      "typeVersion": 1,
      "position": [
        1500,
        750
      ],
      "credentials": {
        "theHiveApi": "TheHive API"
      }
    },
    {
      "parameters": {
        "analyzer": "14d553ba98f7aa940c3545d56f7c9668::Abuse_Finder_3_0",
        "observableType": "mail",
        "observableValue": "={{$node[\"IMAP Email\"].json[\"from\"][\"value\"][0][\"address\"]}}",
        "additionalFields": {
          "timeout": 200
        }
      },
      "name": "Cortex1",
      "type": "n8n-nodes-base.cortex",
      "typeVersion": 1,
      "position": [
        1740,
        1040
      ],
      "credentials": {
        "cortexApi": "Cortex API"
      }
    },
    {
      "parameters": {
        "functionCode": "const waitTimeSeconds = 3;\n\nreturn new Promise((resolve) => {\n  setTimeout(() => {\n    resolve(items);\n  }, waitTimeSeconds * 1000);\n});\n\n"
      },
      "name": "Wait1",
      "type": "n8n-nodes-base.function",
      "typeVersion": 1,
      "position": [
        1920,
        1140
      ]
    },
    {
      "parameters": {
        "resource": "job",
        "jobId": "={{$json[\"_id\"]}}"
      },
      "name": "Cortex2",
      "type": "n8n-nodes-base.cortex",
      "typeVersion": 1,
      "position": [
        2101,
        1033
      ],
      "credentials": {
        "cortexApi": "Cortex API"
      }
    },
    {
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{$node[\"Cortex2\"].json[\"status\"]}}",
              "value2": "Success"
            }
          ]
        }
      },
      "name": "IF2",
      "type": "n8n-nodes-base.if",
      "typeVersion": 1,
      "position": [
        2291,
        1183
      ]
    },
    {
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{$node[\"IF2\"].parameter[\"conditions\"][\"string\"][0][\"value2\"]}}",
              "value2": "Sucess"
            }
          ],
          "number": [
            {
              "value1": "={{$node[\"Cortex1\"].json[\"tlp\"]}}",
              "operation": "larger",
              "value2": 2
            }
          ]
        }
      },
      "name": "IF4",
      "type": "n8n-nodes-base.if",
      "typeVersion": 1,
      "position": [
        2521,
        1033
      ]
    },
    {
      "parameters": {
        "resource": "case",
        "operation": "update",
        "id": "={{$node[\"TheHive2\"].json[\"id\"]}}",
        "updateFields": {
          "severity": 3
        }
      },
      "name": "TheHive7",
      "type": "n8n-nodes-base.theHive",
      "typeVersion": 1,
      "position": [
        2741,
        1163
      ],
      "credentials": {
        "theHiveApi": "TheHive API"
      }
    },
    {
      "parameters": {
        "functionCode": "const waitTimeSeconds = 3;\n\nreturn new Promise((resolve) => {\n  setTimeout(() => {\n    resolve(items);\n  }, waitTimeSeconds * 1000);\n});\n\n"
      },
      "name": "Wait",
      "type": "n8n-nodes-base.function",
      "typeVersion": 1,
      "position": [
        2451,
        1623
      ]
    },
    {
      "parameters": {
        "resource": "job",
        "jobId": "={{$json[\"_id\"]}}"
      },
      "name": "Cortex",
      "type": "n8n-nodes-base.cortex",
      "typeVersion": 1,
      "position": [
        2611,
        1793
      ],
      "credentials": {
        "cortexApi": "Cortex API"
      }
    },
    {
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{$node[\"Cortex\"].json[\"status\"]}}",
              "value2": "Success"
            }
          ]
        }
      },
      "name": "IF5",
      "type": "n8n-nodes-base.if",
      "typeVersion": 1,
      "position": [
        2761,
        1613
      ]
    },
    {
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{$node[\"IF5\"].parameter[\"conditions\"][\"string\"][0][\"value2\"]}}",
              "value2": "Sucess"
            }
          ],
          "number": [
            {
              "value1": "={{$node[\"Cortex1\"].json[\"tlp\"]}}",
              "operation": "larger",
              "value2": 2
            }
          ]
        }
      },
      "name": "IF6",
      "type": "n8n-nodes-base.if",
      "typeVersion": 1,
      "position": [
        2941,
        1753
      ]
    },
    {
      "parameters": {
        "resource": "case",
        "operation": "update",
        "id": "={{$node[\"TheHive\"].json[\"id\"]}}",
        "updateFields": {
          "severity": 3
        }
      },
      "name": "TheHive8",
      "type": "n8n-nodes-base.theHive",
      "typeVersion": 1,
      "position": [
        3141,
        1733
      ],
      "credentials": {
        "theHiveApi": "TheHive API"
      }
    },
    {
      "parameters": {
        "analyzer": "14d553ba98f7aa940c3545d56f7c9668::Abuse_Finder_3_0",
        "observableType": "mail",
        "observableValue": "={{$node[\"FunctionItem\"].json[\"from\"][\"value\"][0][\"address\"]}}",
        "additionalFields": {
          "timeout": 200
        }
      },
      "name": "Cortex3",
      "type": "n8n-nodes-base.cortex",
      "typeVersion": 1,
      "position": [
        2301,
        1773
      ],
      "credentials": {
        "cortexApi": "Cortex API"
      }
    },
    {
      "parameters": {},
      "name": "Merge",
      "type": "n8n-nodes-base.merge",
      "typeVersion": 1,
      "position": [
        1171,
        1503
      ]
    },
    {
      "parameters": {
        "mode": "mergeByIndex",
        "join": "inner"
      },
      "name": "Merge1",
      "type": "n8n-nodes-base.merge",
      "typeVersion": 1,
      "position": [
        1411,
        1403
      ]
    },
    {
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{$json[\"0\"]}}{{$json[\"1\"]}}{{$json[\"2\"]}}",
              "operation": "notEqual",
              "value2": "eml"
            }
          ]
        }
      },
      "name": "IF3",
      "type": "n8n-nodes-base.if",
      "typeVersion": 1,
      "position": [
        1511,
        1643
      ],
      "alwaysOutputData": false
    },
    {
      "parameters": {
        "conditions": {
          "number": [
            {
              "value1": "={{Object.keys($binary).length}}",
              "operation": "larger"
            }
          ]
        }
      },
      "name": "IF7",
      "type": "n8n-nodes-base.if",
      "typeVersion": 1,
      "position": [
        1681,
        1403
      ]
    },
    {
      "parameters": {
        "analyzer": "ed2780846f8db956d03164a2fef6d057::FileInfo_7_0",
        "observableType": "file",
        "binaryPropertyName": "attachment_0",
        "additionalFields": {
          "force": true,
          "timeout": 200
        }
      },
      "name": "Cortex4",
      "type": "n8n-nodes-base.cortex",
      "typeVersion": 1,
      "position": [
        1891,
        1513
      ],
      "alwaysOutputData": false,
      "notesInFlow": false,
      "credentials": {
        "cortexApi": "Cortex API"
      }
    },
    {
      "parameters": {
        "resource": "observable",
        "operation": "create",
        "caseId": "={{$node[\"TheHive2\"].json[\"_id\"]}}",
        "dataType": "file",
        "binaryProperty": "attachment_0",
        "message": "={{$node[\"HTML Extract\"].json[\"body\"]}}",
        "status": "Ok",
        "options": {}
      },
      "name": "TheHive6",
      "type": "n8n-nodes-base.theHive",
      "typeVersion": 1,
      "position": [
        1861,
        1293
      ],
      "credentials": {
        "theHiveApi": "TheHive API"
      }
    },
    {
      "parameters": {
        "functionCode": "const waitTimeSeconds = 3;\n\nreturn new Promise((resolve) => {\n  setTimeout(() => {\n    resolve(items);\n  }, waitTimeSeconds * 1000);\n});\n\n"
      },
      "name": "Wait2",
      "type": "n8n-nodes-base.function",
      "typeVersion": 1,
      "position": [
        2131,
        1373
      ]
    },
    {
      "parameters": {
        "resource": "job",
        "jobId": "="
      },
      "name": "Cortex5",
      "type": "n8n-nodes-base.cortex",
      "typeVersion": 1,
      "position": [
        2340,
        1470
      ],
      "credentials": {
        "cortexApi": "Cortex API"
      }
    },
    {
      "parameters": {
        "analyzer": "ed2780846f8db956d03164a2fef6d057::FileInfo_7_0",
        "observableType": "file",
        "additionalFields": {
          "timeout": 200
        }
      },
      "name": "Cortex6",
      "type": "n8n-nodes-base.cortex",
      "typeVersion": 1,
      "position": [
        1510,
        950
      ],
      "credentials": {
        "cortexApi": "Cortex API"
      }
    }
  ],
  "connections": {
    "IMAP Email": {
      "main": [
        [
          {
            "node": "IF1",
            "type": "main",
            "index": 0
          },
          {
            "node": "Merge",
            "type": "main",
            "index": 1
          },
          {
            "node": "Merge1",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "FunctionItem": {
      "main": [
        [
          {
            "node": "TheHive",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF1": {
      "main": [
        [
          {
            "node": "FunctionItem1",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "FunctionItem1": {
      "main": [
        [
          {
            "node": "IF",
            "type": "main",
            "index": 0
          },
          {
            "node": "IF3",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF": {
      "main": [
        [
          {
            "node": "FunctionItem",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "TheHive": {
      "main": [
        [
          {
            "node": "Move Binary Data",
            "type": "main",
            "index": 0
          },
          {
            "node": "TheHive1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "HTML Extract": {
      "main": [
        [
          {
            "node": "TheHive2",
            "type": "main",
            "index": 0
          },
          {
            "node": "Move Binary Data1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "TheHive2": {
      "main": [
        [
          {
            "node": "Move Binary Data1",
            "type": "main",
            "index": 0
          },
          {
            "node": "TheHive3",
            "type": "main",
            "index": 0
          },
          {
            "node": "IF7",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Move Binary Data": {
      "main": [
        [
          {
            "node": "TheHive4",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Move Binary Data1": {
      "main": [
        [
          {
            "node": "TheHive5",
            "type": "main",
            "index": 0
          },
          {
            "node": "Cortex6",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Cortex1": {
      "main": [
        [
          {
            "node": "Wait1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait1": {
      "main": [
        [
          {
            "node": "Cortex2",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Cortex2": {
      "main": [
        [
          {
            "node": "IF2",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF2": {
      "main": [
        [
          {
            "node": "IF4",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF4": {
      "main": [
        [
          {
            "node": "TheHive7",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "TheHive3": {
      "main": [
        [
          {
            "node": "Cortex1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait": {
      "main": [
        [
          {
            "node": "Cortex",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Cortex": {
      "main": [
        [
          {
            "node": "IF5",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF5": {
      "main": [
        [
          {
            "node": "IF6",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF6": {
      "main": [
        [
          {
            "node": "TheHive8",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "TheHive1": {
      "main": [
        [
          {
            "node": "Cortex3",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Cortex3": {
      "main": [
        [
          {
            "node": "Wait",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Merge": {
      "main": [
        [
          {
            "node": "HTML Extract",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Merge1": {
      "main": [
        [
          {
            "node": "HTML Extract",
            "type": "main",
            "index": 0
          },
          {
            "node": "IF7",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF3": {
      "main": [
        [
          {
            "node": "Merge1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF7": {
      "main": [
        [
          {
            "node": "TheHive6",
            "type": "main",
            "index": 0
          },
          {
            "node": "Cortex4",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Cortex4": {
      "main": [
        [
          {
            "node": "Wait2",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait2": {
      "main": [
        [
          {
            "node": "Cortex5",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "active": true,
  "settings": {},
  "id": "2"
}

It looks like a lot of your nodes do get executed twice. Is that on purpose or by accident? Because that could be a problem, especially if expressions do get used (even though looking at your workflow it does not use any on those nodes).
Generally, would I assume that the calls get made to the API just fine. Is there a way to see what happens in Cortex and if it gets the calls? Does the output of the node look correct?

Hi @jan.

Actually it’s not supposed to the nodes run twice. This is a strange behavior. I don’t know how can I fix it.

When Cortex nodes are executed you can see the job running on cortex web application.
In this case you can only see job running for that particular node that ran successfully. The nodes that didn’t run doesn’t return output on n8n.

If you add two input connections to a node with only one input, then the node will execute twice, once for each input connection. If you look at your screenshot above, you will see where it happens.
“HTML Extract” and “The Hive2” are connected to “Move Binary Data1”. So will “Move Binary Data1” execute once with the data of the node “HTML Extract” and once with the data of the node “The Hive2”.

Thanks @jan. That makes sense.
Already made the change and it works fine

Regarding the Cortex Issue it seems the problem is related to specific analyzers.
I simplified the workflow to evaluate it.

Nothing was executed

No job executed on cortex side as well.

Abuse finder is the analyzer that works fine.