Corelight for Microsoft Sentinel

Solution: Corelight

Corelight Logo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index


Attribute Value
Publisher Corelight
Support Tier Partner
Support Link https://support.corelight.com/
Categories IT Operations,Security - Network
Version 3.3.0
Author Corelight - info@corelight.com
First Published 2022-06-01
Last Updated 2026-08-28
Solution Folder Corelight
Marketplace Azure Marketplace · Rating: ★★★★★ 4.8/5 (20 ratings) · Popularity: 🔵 Medium (65%)

The Corelight solution provides the capability to ingest events from Zeek and Suricata via Corelight Sensors into Microsoft Sentinel.

Underlying Microsoft Technologies used:

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

a. Agent based logs collection from Windows and Linux machines

Contents

Data Connectors

This solution provides 1 data connector(s):

Tables Used

This solution uses 239 table(s):

Table Used By Connectors Used By Content
Corelight_v3_amqp_CL Corelight Connector Exporter -
Corelight_v3_analyzer_CL Corelight Connector Exporter -
Corelight_v3_anomaly_CL Corelight Connector Exporter -
Corelight_v3_asset_classification_CL Corelight Connector Exporter Workbooks
Corelight_v3_bacnet_CL Corelight Connector Exporter Workbooks
Corelight_v3_bacnet_device_control_CL Corelight Connector Exporter -
Corelight_v3_bacnet_discovery_CL Corelight Connector Exporter -
Corelight_v3_bacnet_property_CL Corelight Connector Exporter -
Corelight_v3_broker_CL Corelight Connector Exporter -
Corelight_v3_bsap_ip_header_CL Corelight Connector Exporter -
Corelight_v3_bsap_ip_rdb_CL Corelight Connector Exporter -
Corelight_v3_bsap_ip_unknown_CL Corelight Connector Exporter -
Corelight_v3_bsap_serial_header_CL Corelight Connector Exporter -
Corelight_v3_bsap_serial_rdb_CL Corelight Connector Exporter -
Corelight_v3_bsap_serial_rdb_ext_CL Corelight Connector Exporter -
Corelight_v3_bsap_serial_unknown_CL Corelight Connector Exporter -
Corelight_v3_capture_loss_CL Corelight Connector Exporter Workbooks
Corelight_v3_cip_CL Corelight Connector Exporter Workbooks
Corelight_v3_cip_identity_CL Corelight Connector Exporter -
Corelight_v3_cip_io_CL Corelight Connector Exporter -
Corelight_v3_cluster_CL Corelight Connector Exporter -
Corelight_v3_config_CL Corelight Connector Exporter -
Corelight_v3_conn_CL Corelight Connector Exporter Analytics, Hunting, Workbooks
Corelight_v3_conn_agg_CL Corelight Connector Exporter Analytics, Workbooks
Corelight_v3_conn_long_CL Corelight Connector Exporter Analytics, Hunting, Workbooks
Corelight_v3_conn_red_CL Corelight Connector Exporter Analytics, Hunting, Workbooks
Corelight_v3_corelight_ad_admin_shares_CL Corelight Connector Exporter -
Corelight_v3_corelight_ad_ew_servers_services_CL Corelight Connector Exporter -
Corelight_v3_corelight_ad_exe_files_CL Corelight Connector Exporter -
Corelight_v3_corelight_ad_ftp_connections_CL Corelight Connector Exporter -
Corelight_v3_corelight_ad_http_user_agents_CL Corelight Connector Exporter -
Corelight_v3_corelight_ad_ns_servers_services_CL Corelight Connector Exporter -
Corelight_v3_corelight_ad_ntlm_auth_CL Corelight Connector Exporter -
Corelight_v3_corelight_ad_rdp_CL Corelight Connector Exporter -
Corelight_v3_corelight_ad_ssh_clients_CL Corelight Connector Exporter -
Corelight_v3_corelight_ad_ssh_connections_CL Corelight Connector Exporter -
Corelight_v3_corelight_burst_CL Corelight Connector Exporter Workbooks
Corelight_v3_corelight_license_capacity_CL Corelight Connector Exporter -
Corelight_v3_corelight_metrics_disk_CL Corelight Connector Exporter Workbooks
Corelight_v3_corelight_metrics_iface_CL Corelight Connector Exporter Workbooks
Corelight_v3_corelight_metrics_memory_CL Corelight Connector Exporter Workbooks
Corelight_v3_corelight_metrics_system_CL Corelight Connector Exporter Workbooks
Corelight_v3_corelight_metrics_zeek_doctor_CL Corelight Connector Exporter Workbooks
Corelight_v3_corelight_overall_capture_loss_CL Corelight Connector Exporter Workbooks
Corelight_v3_corelight_pipeline_test_CL Corelight Connector Exporter -
Corelight_v3_corelight_profiling_CL Corelight Connector Exporter Workbooks
Corelight_v3_cotp_CL Corelight Connector Exporter -
Corelight_v3_datared_CL Corelight Connector Exporter Workbooks
Corelight_v3_dce_rpc_CL Corelight Connector Exporter Workbooks
Corelight_v3_dga_CL Corelight Connector Exporter Workbooks
Corelight_v3_dhcp_CL Corelight Connector Exporter Workbooks
Corelight_v3_dnp3_CL Corelight Connector Exporter Workbooks
Corelight_v3_dnp3_control_CL Corelight Connector Exporter -
Corelight_v3_dnp3_objects_CL Corelight Connector Exporter -
Corelight_v3_dns_CL Corelight Connector Exporter Analytics, Hunting, Workbooks
Corelight_v3_dns_agg_CL Corelight Connector Exporter Analytics, Workbooks
Corelight_v3_dns_red_CL Corelight Connector Exporter Analytics, Hunting, Workbooks
Corelight_v3_dpd_CL Corelight Connector Exporter Workbooks
Corelight_v3_ecat_aoe_info_CL Corelight Connector Exporter -
Corelight_v3_ecat_arp_info_CL Corelight Connector Exporter -
Corelight_v3_ecat_coe_info_CL Corelight Connector Exporter -
Corelight_v3_ecat_dev_info_CL Corelight Connector Exporter -
Corelight_v3_ecat_foe_info_CL Corelight Connector Exporter -
Corelight_v3_ecat_log_address_CL Corelight Connector Exporter -
Corelight_v3_ecat_registers_CL Corelight Connector Exporter -
Corelight_v3_ecat_soe_info_CL Corelight Connector Exporter -
Corelight_v3_encrypted_dns_CL Corelight Connector Exporter Workbooks
Corelight_v3_enip_CL Corelight Connector Exporter Workbooks
Corelight_v3_enip_debug_CL Corelight Connector Exporter Workbooks
Corelight_v3_enip_list_identity_CL Corelight Connector Exporter Workbooks
Corelight_v3_etc_viz_CL Corelight Connector Exporter Workbooks
Corelight_v3_files_CL Corelight Connector Exporter Hunting, Workbooks
Corelight_v3_files_agg_CL Corelight Connector Exporter Workbooks
Corelight_v3_files_red_CL Corelight Connector Exporter Hunting, Workbooks
Corelight_v3_first_seen_CL Corelight Connector Exporter -
Corelight_v3_ftp_CL Corelight Connector Exporter Workbooks
Corelight_v3_gena_CL Corelight Connector Exporter -
Corelight_v3_generic_dns_tunnels_CL Corelight Connector Exporter Workbooks
Corelight_v3_generic_icmp_tunnels_CL Corelight Connector Exporter Workbooks
Corelight_v3_genisys_CL Corelight Connector Exporter -
Corelight_v3_http2_CL Corelight Connector Exporter Analytics, Hunting, Workbooks
Corelight_v3_http_CL Corelight Connector Exporter Analytics, Hunting, Workbooks
Corelight_v3_http_agg_CL Corelight Connector Exporter Analytics, Workbooks
Corelight_v3_http_red_CL Corelight Connector Exporter Analytics, Hunting, Workbooks
Corelight_v3_icmp_specific_tunnels_CL Corelight Connector Exporter Workbooks
Corelight_v3_intel_CL Corelight Connector Exporter Workbooks
Corelight_v3_ipsec_CL Corelight Connector Exporter Workbooks
Corelight_v3_irc_CL Corelight Connector Exporter Workbooks
Corelight_v3_iso_cotp_CL Corelight Connector Exporter Workbooks
Corelight_v3_kerberos_CL Corelight Connector Exporter Workbooks
Corelight_v3_known_certs_CL Corelight Connector Exporter Workbooks
Corelight_v3_known_devices_CL Corelight Connector Exporter Workbooks
Corelight_v3_known_domains_CL Corelight Connector Exporter Workbooks
Corelight_v3_known_hosts_CL Corelight Connector Exporter Workbooks
Corelight_v3_known_names_CL Corelight Connector Exporter Workbooks
Corelight_v3_known_remotes_CL Corelight Connector Exporter Workbooks
Corelight_v3_known_services_CL Corelight Connector Exporter Workbooks
Corelight_v3_known_users_CL Corelight Connector Exporter Workbooks
Corelight_v3_ldap_CL Corelight Connector Exporter -
Corelight_v3_ldap_search_CL Corelight Connector Exporter -
Corelight_v3_loaded_scripts_CL Corelight Connector Exporter -
Corelight_v3_local_subnets_CL Corelight Connector Exporter Workbooks
Corelight_v3_local_subnets_dj_CL Corelight Connector Exporter Workbooks
Corelight_v3_local_subnets_graphs_CL Corelight Connector Exporter Workbooks
Corelight_v3_local_subnets_neighbor_CL Corelight Connector Exporter -
Corelight_v3_log4shell_CL Corelight Connector Exporter Workbooks
Corelight_v3_logschema_CL Corelight Connector Exporter -
Corelight_v3_modbus_CL Corelight Connector Exporter Workbooks
Corelight_v3_modbus_detailed_CL Corelight Connector Exporter -
Corelight_v3_modbus_mask_write_register_CL Corelight Connector Exporter -
Corelight_v3_modbus_read_device_identificatio_CL Corelight Connector Exporter -
Corelight_v3_modbus_read_write_multiple_regis_CL Corelight Connector Exporter -
Corelight_v3_mqtt_connect_CL Corelight Connector Exporter Workbooks
Corelight_v3_mqtt_publish_CL Corelight Connector Exporter Workbooks
Corelight_v3_mqtt_subscribe_CL Corelight Connector Exporter Workbooks
Corelight_v3_mysql_CL Corelight Connector Exporter Workbooks
Corelight_v3_net_perf_CL Corelight Connector Exporter -
Corelight_v3_netcontrol_CL Corelight Connector Exporter -
Corelight_v3_netcontrol_drop_CL Corelight Connector Exporter -
Corelight_v3_netcontrol_shunt_CL Corelight Connector Exporter -
Corelight_v3_notice_CL Corelight Connector Exporter Workbooks
Corelight_v3_notice_alarm_CL Corelight Connector Exporter -
Corelight_v3_ntlm_CL Corelight Connector Exporter Workbooks
Corelight_v3_ntp_CL Corelight Connector Exporter Workbooks
Corelight_v3_ocsp_CL Corelight Connector Exporter Workbooks
Corelight_v3_opcua_bef_attr_operand_bpaths_CL Corelight Connector Exporter -
Corelight_v3_opcua_bef_smpl_attr_bpaths_CL Corelight Connector Exporter -
Corelight_v3_opcua_bef_where_clause_CL Corelight Connector Exporter -
Corelight_v3_opcua_bef_where_clause_elements_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_activate_session_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_activate_session_cl_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_activate_session_lo_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_aggregate_filter_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_browse_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_browse_description_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_browse_request_cont_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_browse_response_ref_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_browse_result_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_close_session_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_cm_create_item_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_cm_items_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_create_session_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_create_session_disc_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_create_session_endp_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_create_session_user_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_create_subscription_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_data_change_filter_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_diag_info_detail_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_event_filter_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_event_filter_attrib_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_event_filter_elemen_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_event_filter_litera_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_event_filter_select_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_event_filter_simple_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_get_endpoints_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_get_endpoints_descr_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_get_endpoints_disco_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_get_endpoints_local_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_get_endpoints_profi_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_get_endpoints_user_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_opensecure_channel_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_read_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_read_nodes_to_read_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_read_results_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_status_code_detail_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_variant_array_dims_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_variant_data_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_variant_data_value_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_variant_extension_o_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_variant_metadata_CL Corelight Connector Exporter -
Corelight_v3_opcua_binary_write_CL Corelight Connector Exporter -
Corelight_v3_openflow_CL Corelight Connector Exporter Workbooks
Corelight_v3_packet_filter_CL Corelight Connector Exporter Workbooks
Corelight_v3_pe_CL Corelight Connector Exporter Workbooks
Corelight_v3_postgresql_CL Corelight Connector Exporter -
Corelight_v3_print_CL Corelight Connector Exporter -
Corelight_v3_profinet_CL Corelight Connector Exporter Workbooks
Corelight_v3_profinet_dce_rpc_CL Corelight Connector Exporter Workbooks
Corelight_v3_profinet_debug_CL Corelight Connector Exporter Workbooks
Corelight_v3_quic_CL Corelight Connector Exporter -
Corelight_v3_radius_CL Corelight Connector Exporter Workbooks
Corelight_v3_rdp_CL Corelight Connector Exporter Workbooks
Corelight_v3_redis_CL Corelight Connector Exporter -
Corelight_v3_reporter_CL Corelight Connector Exporter Workbooks
Corelight_v3_rfb_CL Corelight Connector Exporter Workbooks
Corelight_v3_s7comm_CL Corelight Connector Exporter Workbooks
Corelight_v3_s7comm_known_devices_CL Corelight Connector Exporter -
Corelight_v3_s7comm_plus_CL Corelight Connector Exporter -
Corelight_v3_s7comm_read_szl_CL Corelight Connector Exporter -
Corelight_v3_s7comm_upload_download_CL Corelight Connector Exporter -
Corelight_v3_signatures_CL Corelight Connector Exporter Workbooks
Corelight_v3_sip_CL Corelight Connector Exporter Workbooks
Corelight_v3_smartpcap_CL Corelight Connector Exporter Workbooks
Corelight_v3_smartpcap_stats_CL Corelight Connector Exporter Workbooks
Corelight_v3_smb_files_CL Corelight Connector Exporter Workbooks
Corelight_v3_smb_mapping_CL Corelight Connector Exporter Hunting, Workbooks
Corelight_v3_smtp_CL Corelight Connector Exporter Analytics, Hunting, Workbooks
Corelight_v3_smtp_links_CL Corelight Connector Exporter Workbooks
Corelight_v3_snmp_CL Corelight Connector Exporter Workbooks
Corelight_v3_socks_CL Corelight Connector Exporter Workbooks
Corelight_v3_software_CL Corelight Connector Exporter Workbooks
Corelight_v3_specific_dns_tunnels_CL Corelight Connector Exporter Workbooks
Corelight_v3_ssdp_CL Corelight Connector Exporter -
Corelight_v3_ssh_CL Corelight Connector Exporter Workbooks
Corelight_v3_ssl_CL Corelight Connector Exporter Workbooks
Corelight_v3_ssl_agg_CL Corelight Connector Exporter Workbooks
Corelight_v3_ssl_red_CL Corelight Connector Exporter Workbooks
Corelight_v3_stats_CL Corelight Connector Exporter Workbooks
Corelight_v3_stepping_CL Corelight Connector Exporter Workbooks
Corelight_v3_stun_CL Corelight Connector Exporter Workbooks
Corelight_v3_stun_nat_CL Corelight Connector Exporter Workbooks
Corelight_v3_suricata_corelight_CL Corelight Connector Exporter Workbooks
Corelight_v3_suricata_eve_CL Corelight Connector Exporter Workbooks
Corelight_v3_suricata_stats_CL Corelight Connector Exporter Workbooks
Corelight_v3_suricata_zeek_stats_CL Corelight Connector Exporter Workbooks
Corelight_v3_syslog_CL Corelight Connector Exporter Workbooks
Corelight_v3_tds_CL Corelight Connector Exporter Workbooks
Corelight_v3_tds_rpc_CL Corelight Connector Exporter Workbooks
Corelight_v3_tds_sql_batch_CL Corelight Connector Exporter Workbooks
Corelight_v3_telemetry_CL Corelight Connector Exporter -
Corelight_v3_telnet_CL Corelight Connector Exporter -
Corelight_v3_traceroute_CL Corelight Connector Exporter Workbooks
Corelight_v3_tunnel_CL Corelight Connector Exporter Workbooks
Corelight_v3_unknown_smartpcap_CL Corelight Connector Exporter Workbooks
Corelight_v3_util_stats_CL Corelight Connector Exporter Workbooks
Corelight_v3_vpn_CL Corelight Connector Exporter Workbooks
Corelight_v3_websocket_CL Corelight Connector Exporter -
Corelight_v3_weird_CL Corelight Connector Exporter Workbooks
Corelight_v3_weird_agg_CL Corelight Connector Exporter -
Corelight_v3_weird_red_CL Corelight Connector Exporter Workbooks
Corelight_v3_weird_stats_CL Corelight Connector Exporter Workbooks
Corelight_v3_wireguard_CL Corelight Connector Exporter Workbooks
Corelight_v3_x509_CL Corelight Connector Exporter Workbooks
Corelight_v3_x509_red_CL Corelight Connector Exporter Workbooks
Corelight_v3_yara_corelight_CL Corelight Connector Exporter -
Corelight_v3_yara_error_corelight_CL Corelight Connector Exporter -
Corelight_v3_zeek_doctor_CL Corelight Connector Exporter Workbooks
Usage - Workbooks

Content Items

This solution includes 261 content item(s):

Content Type Count
Parsers 231
Analytic Rules 10
Hunting Queries 10
Workbooks 5
Watchlists 5

Analytic Rules

Name Severity Tactics Tables Used
Corelight - C2 DGA Detected Via Repetitive Failures Medium CommandAndControl Corelight_v3_dns_CL
Corelight_v3_dns_agg_CL
Corelight_v3_dns_red_CL
Corelight - External Proxy Detected Low DefenseEvasion, CommandAndControl Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_agg_CL
Corelight_v3_http_red_CL
Corelight - Forced External Outbound SMB Medium CredentialAccess Corelight_v3_conn_CL
Corelight_v3_conn_agg_CL
Corelight_v3_conn_long_CL
Corelight_v3_conn_red_CL
Corelight - Multiple Compressed Files Transferred over HTTP Medium Exfiltration Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_agg_CL
Corelight_v3_http_red_CL
Corelight - Multiple files sent over HTTP with abnormal requests Medium Exfiltration Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_agg_CL
Corelight_v3_http_red_CL
Corelight - Network Service Scanning Multiple IP Addresses Medium InitialAccess Corelight_v3_conn_CL
Corelight_v3_conn_agg_CL
Corelight_v3_conn_long_CL
Corelight_v3_conn_red_CL
Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request Medium InitialAccess Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_agg_CL
Corelight_v3_http_red_CL
Corelight - Possible Webshell Medium Persistence Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_agg_CL
Corelight_v3_http_red_CL
Corelight - Possible Webshell (Rare PUT or POST) Medium Persistence Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_agg_CL
Corelight_v3_http_red_CL
Corelight - SMTP Email containing NON Ascii Characters within the Subject Low InitialAccess Corelight_v3_smtp_CL

Hunting Queries

Name Tactics Tables Used
Corelight - Abnormal Email Subject InitialAccess Corelight_v3_smtp_CL
Corelight - Compressed Files Transferred over HTTP Exfiltration Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_red_CL
Corelight - External Facing Services InitialAccess Corelight_v3_conn_CL
Corelight_v3_conn_long_CL
Corelight_v3_conn_red_CL
Corelight - File uploads by source Exfiltration Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_red_CL
Corelight - Files in logs InitialAccess, Exfiltration Corelight_v3_files_CL
Corelight_v3_files_red_CL
Corelight - Multiple Remote SMB Connections from single client Discovery Corelight_v3_smb_mapping_CL
Corelight - Obfuscated binary filenames InitialAccess Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_red_CL
Corelight - Rare PUT or POST Persistence Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_red_CL
Corelight - Repetitive DNS Failures CommandAndControl Corelight_v3_dns_CL
Corelight_v3_dns_red_CL
Corelight - Top sources of data transferred Exfiltration Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_red_CL

Workbooks

Name Tables Used
Corelight Corelight_v3_conn_CL
Corelight_v3_conn_long_CL
Corelight_v3_conn_red_CL
Corelight_v3_dns_CL
Corelight_v3_dns_red_CL
Corelight_v3_etc_viz_CL
Corelight_v3_files_CL
Corelight_v3_files_red_CL
Corelight_v3_ftp_CL
Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_red_CL
Corelight_v3_intel_CL
Corelight_v3_notice_CL
Corelight_v3_rdp_CL
Corelight_v3_smb_files_CL
Corelight_v3_smb_mapping_CL
Corelight_v3_ssl_CL
Corelight_v3_ssl_red_CL
Corelight_v3_suricata_corelight_CL
Corelight_v3_vpn_CL
Corelight_v3_x509_CL
Corelight_v3_x509_red_CL
Corelight_Data_Explorer Corelight_v3_asset_classification_CL
Corelight_v3_bacnet_CL
Corelight_v3_capture_loss_CL
Corelight_v3_cip_CL
Corelight_v3_conn_CL
Corelight_v3_conn_agg_CL
Corelight_v3_conn_long_CL
Corelight_v3_conn_red_CL
Corelight_v3_corelight_burst_CL
Corelight_v3_corelight_overall_capture_loss_CL
Corelight_v3_corelight_profiling_CL
Corelight_v3_datared_CL
Corelight_v3_dce_rpc_CL
Corelight_v3_dga_CL
Corelight_v3_dhcp_CL
Corelight_v3_dnp3_CL
Corelight_v3_dns_CL
Corelight_v3_dns_agg_CL
Corelight_v3_dns_red_CL
Corelight_v3_dpd_CL
Corelight_v3_encrypted_dns_CL
Corelight_v3_enip_CL
Corelight_v3_enip_debug_CL
Corelight_v3_enip_list_identity_CL
Corelight_v3_etc_viz_CL
Corelight_v3_files_CL
Corelight_v3_files_agg_CL
Corelight_v3_files_red_CL
Corelight_v3_ftp_CL
Corelight_v3_generic_dns_tunnels_CL
Corelight_v3_generic_icmp_tunnels_CL
Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_agg_CL
Corelight_v3_http_red_CL
Corelight_v3_icmp_specific_tunnels_CL
Corelight_v3_intel_CL
Corelight_v3_ipsec_CL
Corelight_v3_irc_CL
Corelight_v3_iso_cotp_CL
Corelight_v3_kerberos_CL
Corelight_v3_known_certs_CL
Corelight_v3_known_devices_CL
Corelight_v3_known_domains_CL
Corelight_v3_known_hosts_CL
Corelight_v3_known_names_CL
Corelight_v3_known_remotes_CL
Corelight_v3_known_services_CL
Corelight_v3_known_users_CL
Corelight_v3_local_subnets_CL
Corelight_v3_local_subnets_dj_CL
Corelight_v3_local_subnets_graphs_CL
Corelight_v3_log4shell_CL
Corelight_v3_modbus_CL
Corelight_v3_mqtt_connect_CL
Corelight_v3_mqtt_publish_CL
Corelight_v3_mqtt_subscribe_CL
Corelight_v3_mysql_CL
Corelight_v3_notice_CL
Corelight_v3_ntlm_CL
Corelight_v3_ntp_CL
Corelight_v3_ocsp_CL
Corelight_v3_openflow_CL
Corelight_v3_packet_filter_CL
Corelight_v3_pe_CL
Corelight_v3_profinet_CL
Corelight_v3_profinet_dce_rpc_CL
Corelight_v3_profinet_debug_CL
Corelight_v3_radius_CL
Corelight_v3_rdp_CL
Corelight_v3_reporter_CL
Corelight_v3_rfb_CL
Corelight_v3_s7comm_CL
Corelight_v3_signatures_CL
Corelight_v3_sip_CL
Corelight_v3_smartpcap_CL
Corelight_v3_smartpcap_stats_CL
Corelight_v3_smb_files_CL
Corelight_v3_smb_mapping_CL
Corelight_v3_smtp_CL
Corelight_v3_smtp_links_CL
Corelight_v3_snmp_CL
Corelight_v3_socks_CL
Corelight_v3_software_CL
Corelight_v3_specific_dns_tunnels_CL
Corelight_v3_ssh_CL
Corelight_v3_ssl_CL
Corelight_v3_ssl_agg_CL
Corelight_v3_ssl_red_CL
Corelight_v3_stats_CL
Corelight_v3_stepping_CL
Corelight_v3_stun_CL
Corelight_v3_stun_nat_CL
Corelight_v3_suricata_corelight_CL
Corelight_v3_suricata_eve_CL
Corelight_v3_suricata_stats_CL
Corelight_v3_suricata_zeek_stats_CL
Corelight_v3_syslog_CL
Corelight_v3_tds_CL
Corelight_v3_tds_rpc_CL
Corelight_v3_tds_sql_batch_CL
Corelight_v3_traceroute_CL
Corelight_v3_tunnel_CL
Corelight_v3_unknown_smartpcap_CL
Corelight_v3_util_stats_CL
Corelight_v3_vpn_CL
Corelight_v3_weird_CL
Corelight_v3_weird_red_CL
Corelight_v3_weird_stats_CL
Corelight_v3_wireguard_CL
Corelight_v3_x509_CL
Corelight_v3_x509_red_CL
Corelight_v3_zeek_doctor_CL
Corelight_Data_Insights Corelight_v3_conn_CL
Corelight_v3_conn_long_CL
Corelight_v3_conn_red_CL
Corelight_v3_dns_CL
Corelight_v3_dns_red_CL
Corelight_v3_rdp_CL
Corelight_v3_ssh_CL
Corelight_v3_ssl_CL
Corelight_v3_ssl_red_CL
Corelight_v3_vpn_CL
Corelight_v3_x509_CL
Corelight_v3_x509_red_CL
Corelight_Operations Corelight_v3_corelight_metrics_disk_CL
Corelight_v3_corelight_metrics_iface_CL
Corelight_v3_corelight_metrics_memory_CL
Corelight_v3_corelight_metrics_system_CL
Corelight_v3_corelight_metrics_zeek_doctor_CL
Usage
Corelight_Security_Workflow Corelight_v3_bacnet_CL
Corelight_v3_capture_loss_CL
Corelight_v3_cip_CL
Corelight_v3_conn_CL
Corelight_v3_conn_long_CL
Corelight_v3_conn_red_CL
Corelight_v3_corelight_burst_CL
Corelight_v3_corelight_overall_capture_loss_CL
Corelight_v3_corelight_profiling_CL
Corelight_v3_datared_CL
Corelight_v3_dce_rpc_CL
Corelight_v3_dga_CL
Corelight_v3_dhcp_CL
Corelight_v3_dnp3_CL
Corelight_v3_dns_CL
Corelight_v3_dns_red_CL
Corelight_v3_dpd_CL
Corelight_v3_encrypted_dns_CL
Corelight_v3_enip_CL
Corelight_v3_enip_debug_CL
Corelight_v3_enip_list_identity_CL
Corelight_v3_etc_viz_CL
Corelight_v3_files_CL
Corelight_v3_files_red_CL
Corelight_v3_ftp_CL
Corelight_v3_generic_dns_tunnels_CL
Corelight_v3_generic_icmp_tunnels_CL
Corelight_v3_http2_CL
Corelight_v3_http_CL
Corelight_v3_http_red_CL
Corelight_v3_icmp_specific_tunnels_CL
Corelight_v3_intel_CL
Corelight_v3_ipsec_CL
Corelight_v3_irc_CL
Corelight_v3_iso_cotp_CL
Corelight_v3_kerberos_CL
Corelight_v3_known_certs_CL
Corelight_v3_known_devices_CL
Corelight_v3_known_domains_CL
Corelight_v3_known_hosts_CL
Corelight_v3_known_names_CL
Corelight_v3_known_remotes_CL
Corelight_v3_known_services_CL
Corelight_v3_known_users_CL
Corelight_v3_local_subnets_CL
Corelight_v3_local_subnets_dj_CL
Corelight_v3_local_subnets_graphs_CL
Corelight_v3_log4shell_CL
Corelight_v3_modbus_CL
Corelight_v3_mqtt_connect_CL
Corelight_v3_mqtt_publish_CL
Corelight_v3_mqtt_subscribe_CL
Corelight_v3_mysql_CL
Corelight_v3_notice_CL
Corelight_v3_ntlm_CL
Corelight_v3_ntp_CL
Corelight_v3_ocsp_CL
Corelight_v3_openflow_CL
Corelight_v3_packet_filter_CL
Corelight_v3_pe_CL
Corelight_v3_profinet_CL
Corelight_v3_profinet_dce_rpc_CL
Corelight_v3_profinet_debug_CL
Corelight_v3_radius_CL
Corelight_v3_rdp_CL
Corelight_v3_reporter_CL
Corelight_v3_rfb_CL
Corelight_v3_s7comm_CL
Corelight_v3_signatures_CL
Corelight_v3_sip_CL
Corelight_v3_smartpcap_CL
Corelight_v3_smartpcap_stats_CL
Corelight_v3_smb_files_CL
Corelight_v3_smb_mapping_CL
Corelight_v3_smtp_CL
Corelight_v3_smtp_links_CL
Corelight_v3_snmp_CL
Corelight_v3_socks_CL
Corelight_v3_software_CL
Corelight_v3_specific_dns_tunnels_CL
Corelight_v3_ssh_CL
Corelight_v3_ssl_CL
Corelight_v3_ssl_red_CL
Corelight_v3_stats_CL
Corelight_v3_stepping_CL
Corelight_v3_stun_CL
Corelight_v3_stun_nat_CL
Corelight_v3_suricata_corelight_CL
Corelight_v3_suricata_eve_CL
Corelight_v3_suricata_stats_CL
Corelight_v3_suricata_zeek_stats_CL
Corelight_v3_syslog_CL
Corelight_v3_tds_CL
Corelight_v3_tds_rpc_CL
Corelight_v3_tds_sql_batch_CL
Corelight_v3_traceroute_CL
Corelight_v3_tunnel_CL
Corelight_v3_unknown_smartpcap_CL
Corelight_v3_util_stats_CL
Corelight_v3_vpn_CL
Corelight_v3_weird_CL
Corelight_v3_weird_red_CL
Corelight_v3_weird_stats_CL
Corelight_v3_wireguard_CL
Corelight_v3_x509_CL
Corelight_v3_x509_red_CL
Corelight_v3_zeek_doctor_CL

Parsers

Name Description Tables Used
Corelight - -
corelight_amqp - Corelight_v3_amqp_CL (read)
corelight_analyzer - Corelight_v3_analyzer_CL (read)
corelight_anomaly - Corelight_v3_anomaly_CL (read)
corelight_asset_classification - Corelight_v3_asset_classification_CL (read)
corelight_bacnet - Corelight_v3_bacnet_CL (read)
corelight_bacnet_device_control - Corelight_v3_bacnet_device_control_CL (read)
corelight_bacnet_discovery - Corelight_v3_bacnet_discovery_CL (read)
corelight_bacnet_property - Corelight_v3_bacnet_property_CL (read)
corelight_broker - Corelight_v3_broker_CL (read)
corelight_bsap_ip_header - Corelight_v3_bsap_ip_header_CL (read)
corelight_bsap_ip_rdb - Corelight_v3_bsap_ip_rdb_CL (read)
corelight_bsap_ip_unknown - Corelight_v3_bsap_ip_unknown_CL (read)
corelight_bsap_serial_header - Corelight_v3_bsap_serial_header_CL (read)
corelight_bsap_serial_rdb - Corelight_v3_bsap_serial_rdb_CL (read)
corelight_bsap_serial_rdb_ext - Corelight_v3_bsap_serial_rdb_ext_CL (read)
corelight_bsap_serial_unknown - Corelight_v3_bsap_serial_unknown_CL (read)
corelight_capture_loss - Corelight_v3_capture_loss_CL (read)
corelight_cip - Corelight_v3_cip_CL (read)
corelight_cip_identity - Corelight_v3_cip_identity_CL (read)
corelight_cip_io - Corelight_v3_cip_io_CL (read)
corelight_cluster - Corelight_v3_cluster_CL (read)
corelight_config - Corelight_v3_config_CL (read)
corelight_conn - Corelight_v3_conn_CL (read)
Corelight_v3_conn_long_CL (read)
Corelight_v3_conn_red_CL (read)
corelight_conn_agg - Corelight_v3_conn_agg_CL (read)
corelight_conn_long - Corelight_v3_conn_long_CL (read)
corelight_conn_red - Corelight_v3_conn_red_CL (read)
corelight_corelight_ad_admin_shares - Corelight_v3_corelight_ad_admin_shares_CL (read)
corelight_corelight_ad_ew_servers_services - Corelight_v3_corelight_ad_ew_servers_services_CL (read)
corelight_corelight_ad_exe_files - Corelight_v3_corelight_ad_exe_files_CL (read)
corelight_corelight_ad_ftp_connections - Corelight_v3_corelight_ad_ftp_connections_CL (read)
corelight_corelight_ad_http_user_agents - Corelight_v3_corelight_ad_http_user_agents_CL (read)
corelight_corelight_ad_ns_servers_services - Corelight_v3_corelight_ad_ns_servers_services_CL (read)
corelight_corelight_ad_ntlm_auth - Corelight_v3_corelight_ad_ntlm_auth_CL (read)
corelight_corelight_ad_rdp - Corelight_v3_corelight_ad_rdp_CL (read)
corelight_corelight_ad_ssh_clients - Corelight_v3_corelight_ad_ssh_clients_CL (read)
corelight_corelight_ad_ssh_connections - Corelight_v3_corelight_ad_ssh_connections_CL (read)
corelight_corelight_burst - Corelight_v3_corelight_burst_CL (read)
corelight_corelight_license_capacity - Corelight_v3_corelight_license_capacity_CL (read)
corelight_corelight_metrics_disk - Corelight_v3_corelight_metrics_disk_CL (read)
corelight_corelight_metrics_iface - Corelight_v3_corelight_metrics_iface_CL (read)
corelight_corelight_metrics_memory - Corelight_v3_corelight_metrics_memory_CL (read)
corelight_corelight_metrics_system - Corelight_v3_corelight_metrics_system_CL (read)
corelight_corelight_metrics_zeek_doctor - Corelight_v3_corelight_metrics_zeek_doctor_CL (read)
corelight_corelight_overall_capture_loss - Corelight_v3_corelight_overall_capture_loss_CL (read)
corelight_corelight_pipeline_test - Corelight_v3_corelight_pipeline_test_CL (read)
corelight_corelight_profiling - Corelight_v3_corelight_profiling_CL (read)
corelight_datared - Corelight_v3_datared_CL (read)
corelight_dce_rpc - Corelight_v3_dce_rpc_CL (read)
corelight_dga - Corelight_v3_dga_CL (read)
corelight_dhcp - Corelight_v3_dhcp_CL (read)
corelight_dnp3 - Corelight_v3_dnp3_CL (read)
corelight_dnp3_control - Corelight_v3_dnp3_control_CL (read)
corelight_dnp3_objects - Corelight_v3_dnp3_objects_CL (read)
corelight_dns - Corelight_v3_dns_CL (read)
Corelight_v3_dns_red_CL (read)
corelight_dns_agg - Corelight_v3_dns_agg_CL (read)
corelight_dns_red - Corelight_v3_dns_red_CL (read)
corelight_dpd - Corelight_v3_dpd_CL (read)
corelight_ecat_aoe_info - Corelight_v3_ecat_aoe_info_CL (read)
corelight_ecat_arp_info - Corelight_v3_ecat_arp_info_CL (read)
corelight_ecat_coe_info - Corelight_v3_ecat_coe_info_CL (read)
corelight_ecat_dev_info - Corelight_v3_ecat_dev_info_CL (read)
corelight_ecat_foe_info - Corelight_v3_ecat_foe_info_CL (read)
corelight_ecat_log_address - Corelight_v3_ecat_log_address_CL (read)
corelight_ecat_registers - Corelight_v3_ecat_registers_CL (read)
corelight_ecat_soe_info - Corelight_v3_ecat_soe_info_CL (read)
corelight_encrypted_dns - Corelight_v3_encrypted_dns_CL (read)
corelight_enip - Corelight_v3_enip_CL (read)
corelight_enip_debug - Corelight_v3_enip_debug_CL (read)
corelight_enip_list_identity - Corelight_v3_enip_list_identity_CL (read)
corelight_etc_viz - Corelight_v3_etc_viz_CL (read)
corelight_files - Corelight_v3_files_CL (read)
Corelight_v3_files_red_CL (read)
corelight_files_agg - Corelight_v3_files_agg_CL (read)
corelight_files_red - Corelight_v3_files_red_CL (read)
corelight_first_seen - Corelight_v3_first_seen_CL (read)
corelight_ftp - Corelight_v3_ftp_CL (read)
corelight_gena - Corelight_v3_gena_CL (read)
corelight_generic_dns_tunnels - Corelight_v3_generic_dns_tunnels_CL (read)
corelight_generic_icmp_tunnels - Corelight_v3_generic_icmp_tunnels_CL (read)
corelight_genisys - Corelight_v3_genisys_CL (read)
corelight_http - Corelight_v3_http2_CL (read)
Corelight_v3_http_CL (read)
Corelight_v3_http_red_CL (read)
corelight_http2 - Corelight_v3_http2_CL (read)
corelight_http_agg - Corelight_v3_http_agg_CL (read)
corelight_http_red - Corelight_v3_http_red_CL (read)
corelight_icmp_specific_tunnels - Corelight_v3_icmp_specific_tunnels_CL (read)
corelight_intel - Corelight_v3_intel_CL (read)
corelight_ipsec - Corelight_v3_ipsec_CL (read)
corelight_irc - Corelight_v3_irc_CL (read)
corelight_iso_cotp - Corelight_v3_iso_cotp_CL (read)
corelight_kerberos - Corelight_v3_kerberos_CL (read)
corelight_known_certs - Corelight_v3_known_certs_CL (read)
corelight_known_devices - Corelight_v3_known_devices_CL (read)
corelight_known_domains - Corelight_v3_known_domains_CL (read)
corelight_known_hosts - Corelight_v3_known_hosts_CL (read)
corelight_known_names - Corelight_v3_known_names_CL (read)
corelight_known_remotes - Corelight_v3_known_remotes_CL (read)
corelight_known_services - Corelight_v3_known_services_CL (read)
corelight_known_users - Corelight_v3_known_users_CL (read)
corelight_ldap - Corelight_v3_ldap_CL (read)
corelight_ldap_search - Corelight_v3_ldap_search_CL (read)
corelight_loaded_scripts - Corelight_v3_loaded_scripts_CL (read)
corelight_local_subnets - Corelight_v3_local_subnets_CL (read)
corelight_local_subnets_dj - Corelight_v3_local_subnets_dj_CL (read)
corelight_local_subnets_graphs - Corelight_v3_local_subnets_graphs_CL (read)
corelight_local_subnets_neighbor - Corelight_v3_local_subnets_neighbor_CL (read)
corelight_log4shell - Corelight_v3_log4shell_CL (read)
corelight_logschema - Corelight_v3_logschema_CL (read)
corelight_modbus - Corelight_v3_modbus_CL (read)
corelight_modbus_detailed - Corelight_v3_modbus_detailed_CL (read)
corelight_modbus_mask_write_register - Corelight_v3_modbus_mask_write_register_CL (read)
corelight_modbus_read_device_identification - Corelight_v3_modbus_read_device_identificatio_CL (read)
corelight_modbus_read_write_multiple_registers - Corelight_v3_modbus_read_write_multiple_regis_CL (read)
corelight_mqtt_connect - Corelight_v3_mqtt_connect_CL (read)
corelight_mqtt_publish - Corelight_v3_mqtt_publish_CL (read)
corelight_mqtt_subscribe - Corelight_v3_mqtt_subscribe_CL (read)
corelight_mysql - Corelight_v3_mysql_CL (read)
corelight_netcontrol - Corelight_v3_netcontrol_CL (read)
corelight_netcontrol_drop - Corelight_v3_netcontrol_drop_CL (read)
corelight_netcontrol_shunt - Corelight_v3_netcontrol_shunt_CL (read)
corelight_notice - Corelight_v3_notice_CL (read)
corelight_notice_alarm - Corelight_v3_notice_alarm_CL (read)
corelight_ntlm - Corelight_v3_ntlm_CL (read)
corelight_ntp - Corelight_v3_ntp_CL (read)
corelight_ocsp - Corelight_v3_ocsp_CL (read)
corelight_opcua_binary - Corelight_v3_opcua_binary_CL (read)
corelight_opcua_binary_activate_session - Corelight_v3_opcua_binary_activate_session_CL (read)
corelight_opcua_binary_activate_session_client_software_cert - Corelight_v3_opcua_binary_activate_session_cl_CL (read)
corelight_opcua_binary_activate_session_locale_id - Corelight_v3_opcua_binary_activate_session_lo_CL (read)
corelight_opcua_binary_aggregate_filter - Corelight_v3_opcua_binary_aggregate_filter_CL (read)
corelight_opcua_binary_browse - Corelight_v3_opcua_binary_browse_CL (read)
corelight_opcua_binary_browse_description - Corelight_v3_opcua_binary_browse_description_CL (read)
corelight_opcua_binary_browse_request_continuation_point - Corelight_v3_opcua_binary_browse_request_cont_CL (read)
corelight_opcua_binary_browse_response_references - Corelight_v3_opcua_binary_browse_response_ref_CL (read)
corelight_opcua_binary_browse_result - Corelight_v3_opcua_binary_browse_result_CL (read)
corelight_opcua_binary_close_session - Corelight_v3_opcua_binary_close_session_CL (read)
corelight_opcua_binary_create_monitored_items - Corelight_v3_opcua_binary_cm_items_CL (read)
corelight_opcua_binary_create_monitored_items_create_item - Corelight_v3_opcua_binary_cm_create_item_CL (read)
corelight_opcua_binary_create_session - Corelight_v3_opcua_binary_create_session_CL (read)
corelight_opcua_binary_create_session_discovery - Corelight_v3_opcua_binary_create_session_disc_CL (read)
corelight_opcua_binary_create_session_endpoints - Corelight_v3_opcua_binary_create_session_endp_CL (read)
corelight_opcua_binary_create_session_user_token - Corelight_v3_opcua_binary_create_session_user_CL (read)
corelight_opcua_binary_create_subscription - Corelight_v3_opcua_binary_create_subscription_CL (read)
corelight_opcua_binary_data_change_filter - Corelight_v3_opcua_binary_data_change_filter_CL (read)
corelight_opcua_binary_diag_info_detail - Corelight_v3_opcua_binary_diag_info_detail_CL (read)
corelight_opcua_binary_event_filter - Corelight_v3_opcua_binary_event_filter_CL (read)
corelight_opcua_binary_event_filter_attribute_operand - Corelight_v3_opcua_binary_event_filter_attrib_CL (read)
corelight_opcua_binary_event_filter_attribute_operand_browse_paths - Corelight_v3_opcua_bef_attr_operand_bpaths_CL (read)
corelight_opcua_binary_event_filter_element_operand - Corelight_v3_opcua_binary_event_filter_elemen_CL (read)
corelight_opcua_binary_event_filter_literal_operand - Corelight_v3_opcua_binary_event_filter_litera_CL (read)
corelight_opcua_binary_event_filter_select_clause - Corelight_v3_opcua_binary_event_filter_select_CL (read)
corelight_opcua_binary_event_filter_simple_attribute_operand - Corelight_v3_opcua_binary_event_filter_simple_CL (read)
corelight_opcua_binary_event_filter_simple_attribute_operand_browse_paths - Corelight_v3_opcua_bef_smpl_attr_bpaths_CL (read)
corelight_opcua_binary_event_filter_where_clause - Corelight_v3_opcua_bef_where_clause_CL (read)
corelight_opcua_binary_event_filter_where_clause_elements - Corelight_v3_opcua_bef_where_clause_elements_CL (read)
corelight_opcua_binary_get_endpoints - Corelight_v3_opcua_binary_get_endpoints_CL (read)
corelight_opcua_binary_get_endpoints_description - Corelight_v3_opcua_binary_get_endpoints_descr_CL (read)
corelight_opcua_binary_get_endpoints_discovery - Corelight_v3_opcua_binary_get_endpoints_disco_CL (read)
corelight_opcua_binary_get_endpoints_locale_id - Corelight_v3_opcua_binary_get_endpoints_local_CL (read)
corelight_opcua_binary_get_endpoints_profile_uri - Corelight_v3_opcua_binary_get_endpoints_profi_CL (read)
corelight_opcua_binary_get_endpoints_user_token - Corelight_v3_opcua_binary_get_endpoints_user_CL (read)
corelight_opcua_binary_opensecure_channel - Corelight_v3_opcua_binary_opensecure_channel_CL (read)
corelight_opcua_binary_read - Corelight_v3_opcua_binary_read_CL (read)
corelight_opcua_binary_read_nodes_to_read - Corelight_v3_opcua_binary_read_nodes_to_read_CL (read)
corelight_opcua_binary_read_results - Corelight_v3_opcua_binary_read_results_CL (read)
corelight_opcua_binary_status_code_detail - Corelight_v3_opcua_binary_status_code_detail_CL (read)
corelight_opcua_binary_variant_array_dims - Corelight_v3_opcua_binary_variant_array_dims_CL (read)
corelight_opcua_binary_variant_data - Corelight_v3_opcua_binary_variant_data_CL (read)
corelight_opcua_binary_variant_data_value - Corelight_v3_opcua_binary_variant_data_value_CL (read)
corelight_opcua_binary_variant_extension_object - Corelight_v3_opcua_binary_variant_extension_o_CL (read)
corelight_opcua_binary_variant_metadata - Corelight_v3_opcua_binary_variant_metadata_CL (read)
corelight_openflow - Corelight_v3_openflow_CL (read)
corelight_packet_filter - Corelight_v3_packet_filter_CL (read)
corelight_pe - Corelight_v3_pe_CL (read)
corelight_print - Corelight_v3_print_CL (read)
corelight_profinet - Corelight_v3_profinet_CL (read)
corelight_profinet_dce_rpc - Corelight_v3_profinet_dce_rpc_CL (read)
corelight_profinet_debug - Corelight_v3_profinet_debug_CL (read)
corelight_quic - Corelight_v3_quic_CL (read)
corelight_radius - Corelight_v3_radius_CL (read)
corelight_rdp - Corelight_v3_rdp_CL (read)
corelight_reporter - Corelight_v3_reporter_CL (read)
corelight_rfb - Corelight_v3_rfb_CL (read)
corelight_s7comm - Corelight_v3_s7comm_CL (read)
corelight_s7comm_plus - Corelight_v3_s7comm_plus_CL (read)
corelight_s7comm_read_szl - Corelight_v3_s7comm_read_szl_CL (read)
corelight_s7comm_upload_download - Corelight_v3_s7comm_upload_download_CL (read)
corelight_signatures - Corelight_v3_signatures_CL (read)
corelight_sip - Corelight_v3_sip_CL (read)
corelight_smartpcap - Corelight_v3_smartpcap_CL (read)
corelight_smartpcap_stats - Corelight_v3_smartpcap_stats_CL (read)
corelight_smb_files - Corelight_v3_smb_files_CL (read)
corelight_smb_mapping - Corelight_v3_smb_mapping_CL (read)
corelight_smtp - Corelight_v3_smtp_CL (read)
corelight_smtp_links - Corelight_v3_smtp_links_CL (read)
corelight_snmp - Corelight_v3_snmp_CL (read)
corelight_socks - Corelight_v3_socks_CL (read)
corelight_software - Corelight_v3_software_CL (read)
corelight_specific_dns_tunnels - Corelight_v3_specific_dns_tunnels_CL (read)
corelight_ssdp - Corelight_v3_ssdp_CL (read)
corelight_ssh string Corelight_v3_ssh_CL (read)
corelight_ssl - Corelight_v3_ssl_CL (read)
Corelight_v3_ssl_red_CL (read)
corelight_ssl_agg - Corelight_v3_ssl_agg_CL (read)
corelight_ssl_red - Corelight_v3_ssl_red_CL (read)
corelight_stats - Corelight_v3_stats_CL (read)
corelight_stepping - Corelight_v3_stepping_CL (read)
corelight_stun - Corelight_v3_stun_CL (read)
corelight_stun_nat - Corelight_v3_stun_nat_CL (read)
corelight_suri_aggregations - -
corelight_suricata_corelight - Corelight_v3_suricata_corelight_CL (read)
corelight_suricata_eve - Corelight_v3_suricata_eve_CL (read)
corelight_suricata_stats - Corelight_v3_suricata_stats_CL (read)
corelight_suricata_zeek_stats - Corelight_v3_suricata_zeek_stats_CL (read)
corelight_syslog - Corelight_v3_syslog_CL (read)
corelight_tds - Corelight_v3_tds_CL (read)
corelight_tds_rpc - Corelight_v3_tds_rpc_CL (read)
corelight_tds_sql_batch - Corelight_v3_tds_sql_batch_CL (read)
corelight_telnet - Corelight_v3_telnet_CL (read)
corelight_traceroute - Corelight_v3_traceroute_CL (read)
corelight_tunnel - Corelight_v3_tunnel_CL (read)
corelight_unknown_smartpcap - Corelight_v3_unknown_smartpcap_CL (read)
corelight_util_stats - Corelight_v3_util_stats_CL (read)
corelight_vpn string Corelight_v3_vpn_CL (read)
corelight_websocket - Corelight_v3_websocket_CL (read)
corelight_weird - Corelight_v3_weird_CL (read)
corelight_weird_agg - Corelight_v3_weird_agg_CL (read)
corelight_weird_red - Corelight_v3_weird_red_CL (read)
corelight_weird_stats - Corelight_v3_weird_stats_CL (read)
corelight_wireguard - Corelight_v3_wireguard_CL (read)
corelight_x509 - Corelight_v3_x509_CL (read)
Corelight_v3_x509_red_CL (read)
corelight_x509_red - Corelight_v3_x509_red_CL (read)
corelight_zeek_doctor - Corelight_v3_zeek_doctor_CL (read)

Watchlists

Name Description Tables Used
CorelightAggregationsEnrichment1 - -
CorelightAggregationsEnrichment2 - -
CorelightDNSPortDesc - -
CorelightGeoCountries - -
CorelightInferencesDesc - -

Release Notes

Version Date Modified (DD-MM-YYYY) Change History
3.3.0 18-08-2026 Updated Data Connector page for DCE/DCR based ingestion, added new Parsers, and updated Workbooks and Analytic Rules queries for the new table schema and field names
3.2.5 04-06-2026 Restructuring dashboards and adding asset classification tab in data explorer
3.2.4 19-03-2026 Added 'Show Aggregation' filters in Corelight Data Explorer Workbook.
3.2.3 27-01-2026 Added Corelight AWS VPC Flow dashboard.
3.2.2 01-12-2025 Added Corelight Aggregation Parsers.
3.2.1 30-10-2025 Added corelight_first_seen and corelight_anomaly Parsers.
3.2.0 05-03-2025 Added new Parsers, Workbooks and Watchlists.
3.1.0 27-09-2024 Updated Parsers and added new tabs in Workbook.
3.0.2 31-01-2024 Updated Parser Corelight
Updated tactics of Hunting Query Corelight - Repetitive DNS Failures
3.0.1 16-11-2023 Updated package mainTemplate variables
3.0.0 20-09-2023 Changed backend format to use separate tables with parsed values
2.0.0 10-06-2022 Updated Workbooks
1.1.0 22-10-2021 Packaging updates
1.0.2 22-04-2021 Updated instructions, rules, LA config
1.0.1 09-04-2021 Updated Analytic Rule
1.0.0 01-04-2021 Initial Solution Release

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index