Invoke MISP modules within Cortex. Besides its regular analyzers, Cortex 1.1.1 can analyze observables using MISP expansion modules. Obviously, there are some overlap between Cortex native analyzers and MISP expansion modules. For example, you could query the CIRCL’s Passive DNS service using a native Cortex analyzer or a MISP expansion module. When there’s overlap, we highly recommend you rely on the Cortex analyzer.