Cortex Network Analysis Tool

BITMARCK Holding GmbH, based in Essen, develops and operates IT solutions for Germany's statutory health insurance system. The basis for this is the statutory health insurance software standard BITMARCK_21c|ng, which the connected insurers use. The group's customers include company and guild health insurance funds (BKK and IKK), DAK-Gesundheit and other substitute funds. According to the company, more than 80 percent of German statutory health insurers are BITMARCK customers.

For an IT service provider of this size, monitoring its networks for security issues is a permanent task. This is the setting for the network analysis tool, which uses data from Cortex systems through their API.

Security analysts need fast, reliable access to security-relevant information from the Cortex systems. This information was to be queried systematically and automatically through the Cortex API, so that it is available in a structured form for analysis.

Network data is complex. For analysts to interpret it efficiently and spot threats, the queried data has to be analyzed and presented clearly.

Some analysis steps are compute-intensive. The tool therefore had to be quick to develop while still performing well wherever larger amounts of data are processed.

The tool combines three languages with clearly separated responsibilities. Python handles the backend logic and communication with the Cortex API, C++ the performance-critical analysis algorithms, and HTML the graphical user interface.

For analysts, the tool brings the queried information together in one interface:

Splitting the work across languages reflects a simple trade-off between development effort and runtime. Python suits API communication and orchestration because queries and data preparation are quick to build and adjust. C++ is used where analysis algorithms need significant compute time.

The interface is built with HTML5, CSS3 and JavaScript and adapts to different screen sizes as a responsive application. The Cortex API serves as the data source through which the tool queries security-relevant information.

With the tool, security analysts query information from the Cortex systems automatically and see the results in visual form. The visualization makes anomalies in complex network data easier to spot and gives security decisions a traceable data basis.