Automation (Cortex)

The Automation component (Cortex) is configured separately from Energy SOAR Base. Its main configuration file is /etc/cortex/application.conf.

Enabling the Automation connector

The Automation module is activated in /etc/energysoar/application.conf.d/cortex.conf:

play.modules.enabled += org.emca.energysoar.connector.cortex.CortexModule

This is enabled by default after installation.

Energy Logserver connection

Automation uses Energy Logserver as its data store. The connection is configured in /etc/cortex/application.conf:

search {
  index = cortex
  uri = "http://127.0.0.1:9200"

  ## Authentication (if required)
  #user = ""
  #password = ""

  ## SSL configuration
  #keyStore {
  #  path = "/path/to/keystore"
  #  type = "JKS"
  #  password = "keystore-password"
  #}
  #trustStore {
  #  path = "/path/to/trustStore"
  #  type = "JKS"
  #  password = "trustStore-password"
  #}
}

For a cluster, list all nodes separated by commas:

uri = "http://node1:9200,node2:9200,node3:9200"

Analyzers

Automation looks for analyzers in the directories listed under analyzer.urls:

analyzer {
  urls = [
    "/opt/cortex/Cortex-Analyzers/analyzers/",
    "/opt/cortex/Energy-Analyzers/analyzers/"
  ]

  fork-join-executor {
    parallelism-min = 2
    parallelism-factor = 2.0
    parallelism-max = 4
  }
}

parallelism-max limits how many analyzer jobs run simultaneously. Increase this on systems with more CPU cores.

Responders

Responders follow the same configuration pattern as analyzers:

responder {
  urls = [
    "/opt/cortex/Cortex-Analyzers/responders/",
    "/opt/cortex/Energy-Analyzers/responders/"
  ]

  fork-join-executor {
    parallelism-min = 2
    parallelism-factor = 2.0
    parallelism-max = 4
  }
}

Job cache

Automation caches analyzer results to avoid re-running the same job against the same observable within a short window:

cache {
  job = 10 minutes
}

The cache.job value can be overridden for individual analyzers in the Automation web interface. Set it to 0 to disable caching for a specific analyzer.

After modifying /etc/cortex/application.conf, restart the Automation service:

systemctl restart cortex

Workflow engine (n8n)

Energy SOAR Base connects to the n8n workflow engine using settings in /etc/energysoar/application.conf.d/n8n.conf. The defaults match the local n8n instance installed by the installer. Change these only when n8n runs on a different host or with non-default credentials:

n8n {
  baseUrl = "http://localhost:5678/"
  username = "admin"
  password = "admin"
}

Key	Description
n8n.baseUrl	Base URL of the n8n instance.
n8n.username	n8n user account used by Energy SOAR Base.
n8n.password	Password for the above account.

After modifying n8n.conf, restart Energy SOAR Base:

systemctl restart energysoar