Skip to content



Email visualisation#

Starting with version 2.0, this analyzer allows analysts to have an overview of the HTML rendered email. The program creates a screenshot of html parts of the message, inline and attachment parts. By default, this option is not enabled. To proceed, the Analyzer requires the program wkhtmltoimage beeing installed on the system.


wkhtmltopdf program is required. DEB and RPM packages exist. Once installed, in Cortex, configure the Analyzer accordingly :

  • set the parameter email_visualisation to true.
  • If needed, replace the default value of the wkhtmltoimage program path in the parameter wkhtmltoimage_path.


Author: StrangeBee
License: AGPL-V3
Version: 2.0
Supported observables types:
- file
Registration required: False
Subscription required: False
Free subscription: N/A
Third party service:


Parse and visualise EML email message. Submit a .eml formatted file and extract some useful information.


email_visualisation Enable email visualisation in report. This option requires the program wkhtmltoimage and installation of wkhtmltopdf package on the system. Docker image has this program installed. Refer to the documentation for more information.
Default value if not configured False
Type of the configuration item boolean
The configuration item can contain multiple values False
Is required True
wkhtmltoimage_path Path of wkhtmltoimage program on the system. This program is required to generate visualisation of the message as it seen in mail client program. If using Docker image, use default configuration.
Default value if not configured /usr/bin/wkhtmltoimage
Type of the configuration item string
The configuration item can contain multiple values False
Is required True

Templates samples for TheHive#

EmlParser: short report

EmlParser: long report

Last update: November 15, 2021 06:39:12