Corelight for Microsoft Sentinel

Solution: Corelight

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index

Attribute	Value
Publisher	Corelight
Support Tier	Partner
Support Link	https://support.corelight.com/
Categories	IT Operations,Security - Network
Version	3.3.0
Author	Corelight - info@corelight.com
First Published	2022-06-01
Last Updated	2026-08-28
Solution Folder	Corelight
Marketplace	Azure Marketplace · Rating: ★★★★★ 4.8/5 (20 ratings) · Popularity: 🔵 Medium (65%)

The Corelight solution provides the capability to ingest events from Zeek and Suricata via Corelight Sensors into Microsoft Sentinel.

Underlying Microsoft Technologies used:

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

a. Agent based logs collection from Windows and Linux machines

Data Connectors
Tables Used
Content Items

Data Connectors

This solution provides 1 data connector(s):

Corelight Connector Exporter

Tables Used

This solution uses 239 table(s):

Table	Used By Connectors	Used By Content
`Corelight_v3_amqp_CL`	Corelight Connector Exporter	-
`Corelight_v3_analyzer_CL`	Corelight Connector Exporter	-
`Corelight_v3_anomaly_CL`	Corelight Connector Exporter	-
`Corelight_v3_asset_classification_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_bacnet_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_bacnet_device_control_CL`	Corelight Connector Exporter	-
`Corelight_v3_bacnet_discovery_CL`	Corelight Connector Exporter	-
`Corelight_v3_bacnet_property_CL`	Corelight Connector Exporter	-
`Corelight_v3_broker_CL`	Corelight Connector Exporter	-
`Corelight_v3_bsap_ip_header_CL`	Corelight Connector Exporter	-
`Corelight_v3_bsap_ip_rdb_CL`	Corelight Connector Exporter	-
`Corelight_v3_bsap_ip_unknown_CL`	Corelight Connector Exporter	-
`Corelight_v3_bsap_serial_header_CL`	Corelight Connector Exporter	-
`Corelight_v3_bsap_serial_rdb_CL`	Corelight Connector Exporter	-
`Corelight_v3_bsap_serial_rdb_ext_CL`	Corelight Connector Exporter	-
`Corelight_v3_bsap_serial_unknown_CL`	Corelight Connector Exporter	-
`Corelight_v3_capture_loss_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_cip_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_cip_identity_CL`	Corelight Connector Exporter	-
`Corelight_v3_cip_io_CL`	Corelight Connector Exporter	-
`Corelight_v3_cluster_CL`	Corelight Connector Exporter	-
`Corelight_v3_config_CL`	Corelight Connector Exporter	-
`Corelight_v3_conn_CL`	Corelight Connector Exporter	Analytics, Hunting, Workbooks
`Corelight_v3_conn_agg_CL`	Corelight Connector Exporter	Analytics, Workbooks
`Corelight_v3_conn_long_CL`	Corelight Connector Exporter	Analytics, Hunting, Workbooks
`Corelight_v3_conn_red_CL`	Corelight Connector Exporter	Analytics, Hunting, Workbooks
`Corelight_v3_corelight_ad_admin_shares_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_ad_ew_servers_services_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_ad_exe_files_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_ad_ftp_connections_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_ad_http_user_agents_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_ad_ns_servers_services_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_ad_ntlm_auth_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_ad_rdp_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_ad_ssh_clients_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_ad_ssh_connections_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_burst_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_corelight_license_capacity_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_metrics_disk_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_corelight_metrics_iface_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_corelight_metrics_memory_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_corelight_metrics_system_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_corelight_metrics_zeek_doctor_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_corelight_overall_capture_loss_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_corelight_pipeline_test_CL`	Corelight Connector Exporter	-
`Corelight_v3_corelight_profiling_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_cotp_CL`	Corelight Connector Exporter	-
`Corelight_v3_datared_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_dce_rpc_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_dga_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_dhcp_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_dnp3_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_dnp3_control_CL`	Corelight Connector Exporter	-
`Corelight_v3_dnp3_objects_CL`	Corelight Connector Exporter	-
`Corelight_v3_dns_CL`	Corelight Connector Exporter	Analytics, Hunting, Workbooks
`Corelight_v3_dns_agg_CL`	Corelight Connector Exporter	Analytics, Workbooks
`Corelight_v3_dns_red_CL`	Corelight Connector Exporter	Analytics, Hunting, Workbooks
`Corelight_v3_dpd_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_ecat_aoe_info_CL`	Corelight Connector Exporter	-
`Corelight_v3_ecat_arp_info_CL`	Corelight Connector Exporter	-
`Corelight_v3_ecat_coe_info_CL`	Corelight Connector Exporter	-
`Corelight_v3_ecat_dev_info_CL`	Corelight Connector Exporter	-
`Corelight_v3_ecat_foe_info_CL`	Corelight Connector Exporter	-
`Corelight_v3_ecat_log_address_CL`	Corelight Connector Exporter	-
`Corelight_v3_ecat_registers_CL`	Corelight Connector Exporter	-
`Corelight_v3_ecat_soe_info_CL`	Corelight Connector Exporter	-
`Corelight_v3_encrypted_dns_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_enip_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_enip_debug_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_enip_list_identity_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_etc_viz_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_files_CL`	Corelight Connector Exporter	Hunting, Workbooks
`Corelight_v3_files_agg_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_files_red_CL`	Corelight Connector Exporter	Hunting, Workbooks
`Corelight_v3_first_seen_CL`	Corelight Connector Exporter	-
`Corelight_v3_ftp_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_gena_CL`	Corelight Connector Exporter	-
`Corelight_v3_generic_dns_tunnels_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_generic_icmp_tunnels_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_genisys_CL`	Corelight Connector Exporter	-
`Corelight_v3_http2_CL`	Corelight Connector Exporter	Analytics, Hunting, Workbooks
`Corelight_v3_http_CL`	Corelight Connector Exporter	Analytics, Hunting, Workbooks
`Corelight_v3_http_agg_CL`	Corelight Connector Exporter	Analytics, Workbooks
`Corelight_v3_http_red_CL`	Corelight Connector Exporter	Analytics, Hunting, Workbooks
`Corelight_v3_icmp_specific_tunnels_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_intel_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_ipsec_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_irc_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_iso_cotp_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_kerberos_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_known_certs_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_known_devices_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_known_domains_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_known_hosts_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_known_names_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_known_remotes_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_known_services_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_known_users_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_ldap_CL`	Corelight Connector Exporter	-
`Corelight_v3_ldap_search_CL`	Corelight Connector Exporter	-
`Corelight_v3_loaded_scripts_CL`	Corelight Connector Exporter	-
`Corelight_v3_local_subnets_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_local_subnets_dj_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_local_subnets_graphs_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_local_subnets_neighbor_CL`	Corelight Connector Exporter	-
`Corelight_v3_log4shell_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_logschema_CL`	Corelight Connector Exporter	-
`Corelight_v3_modbus_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_modbus_detailed_CL`	Corelight Connector Exporter	-
`Corelight_v3_modbus_mask_write_register_CL`	Corelight Connector Exporter	-
`Corelight_v3_modbus_read_device_identificatio_CL`	Corelight Connector Exporter	-
`Corelight_v3_modbus_read_write_multiple_regis_CL`	Corelight Connector Exporter	-
`Corelight_v3_mqtt_connect_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_mqtt_publish_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_mqtt_subscribe_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_mysql_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_net_perf_CL`	Corelight Connector Exporter	-
`Corelight_v3_netcontrol_CL`	Corelight Connector Exporter	-
`Corelight_v3_netcontrol_drop_CL`	Corelight Connector Exporter	-
`Corelight_v3_netcontrol_shunt_CL`	Corelight Connector Exporter	-
`Corelight_v3_notice_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_notice_alarm_CL`	Corelight Connector Exporter	-
`Corelight_v3_ntlm_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_ntp_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_ocsp_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_opcua_bef_attr_operand_bpaths_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_bef_smpl_attr_bpaths_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_bef_where_clause_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_bef_where_clause_elements_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_activate_session_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_activate_session_cl_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_activate_session_lo_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_aggregate_filter_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_browse_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_browse_description_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_browse_request_cont_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_browse_response_ref_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_browse_result_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_close_session_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_cm_create_item_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_cm_items_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_create_session_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_create_session_disc_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_create_session_endp_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_create_session_user_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_create_subscription_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_data_change_filter_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_diag_info_detail_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_event_filter_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_event_filter_attrib_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_event_filter_elemen_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_event_filter_litera_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_event_filter_select_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_event_filter_simple_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_get_endpoints_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_get_endpoints_descr_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_get_endpoints_disco_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_get_endpoints_local_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_get_endpoints_profi_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_get_endpoints_user_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_opensecure_channel_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_read_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_read_nodes_to_read_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_read_results_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_status_code_detail_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_variant_array_dims_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_variant_data_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_variant_data_value_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_variant_extension_o_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_variant_metadata_CL`	Corelight Connector Exporter	-
`Corelight_v3_opcua_binary_write_CL`	Corelight Connector Exporter	-
`Corelight_v3_openflow_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_packet_filter_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_pe_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_postgresql_CL`	Corelight Connector Exporter	-
`Corelight_v3_print_CL`	Corelight Connector Exporter	-
`Corelight_v3_profinet_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_profinet_dce_rpc_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_profinet_debug_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_quic_CL`	Corelight Connector Exporter	-
`Corelight_v3_radius_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_rdp_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_redis_CL`	Corelight Connector Exporter	-
`Corelight_v3_reporter_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_rfb_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_s7comm_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_s7comm_known_devices_CL`	Corelight Connector Exporter	-
`Corelight_v3_s7comm_plus_CL`	Corelight Connector Exporter	-
`Corelight_v3_s7comm_read_szl_CL`	Corelight Connector Exporter	-
`Corelight_v3_s7comm_upload_download_CL`	Corelight Connector Exporter	-
`Corelight_v3_signatures_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_sip_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_smartpcap_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_smartpcap_stats_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_smb_files_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_smb_mapping_CL`	Corelight Connector Exporter	Hunting, Workbooks
`Corelight_v3_smtp_CL`	Corelight Connector Exporter	Analytics, Hunting, Workbooks
`Corelight_v3_smtp_links_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_snmp_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_socks_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_software_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_specific_dns_tunnels_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_ssdp_CL`	Corelight Connector Exporter	-
`Corelight_v3_ssh_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_ssl_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_ssl_agg_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_ssl_red_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_stats_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_stepping_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_stun_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_stun_nat_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_suricata_corelight_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_suricata_eve_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_suricata_stats_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_suricata_zeek_stats_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_syslog_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_tds_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_tds_rpc_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_tds_sql_batch_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_telemetry_CL`	Corelight Connector Exporter	-
`Corelight_v3_telnet_CL`	Corelight Connector Exporter	-
`Corelight_v3_traceroute_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_tunnel_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_unknown_smartpcap_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_util_stats_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_vpn_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_websocket_CL`	Corelight Connector Exporter	-
`Corelight_v3_weird_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_weird_agg_CL`	Corelight Connector Exporter	-
`Corelight_v3_weird_red_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_weird_stats_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_wireguard_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_x509_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_x509_red_CL`	Corelight Connector Exporter	Workbooks
`Corelight_v3_yara_corelight_CL`	Corelight Connector Exporter	-
`Corelight_v3_yara_error_corelight_CL`	Corelight Connector Exporter	-
`Corelight_v3_zeek_doctor_CL`	Corelight Connector Exporter	Workbooks
`Usage`	-	Workbooks

Content Items

This solution includes 261 content item(s):

Content Type	Count
Parsers	231
Analytic Rules	10
Hunting Queries	10
Workbooks	5
Watchlists	5

Analytic Rules

Name	Severity	Tactics	Tables Used
Corelight - C2 DGA Detected Via Repetitive Failures	Medium	CommandAndControl	`Corelight_v3_dns_CL` `Corelight_v3_dns_agg_CL` `Corelight_v3_dns_red_CL`
Corelight - External Proxy Detected	Low	DefenseEvasion, CommandAndControl	`Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_agg_CL` `Corelight_v3_http_red_CL`
Corelight - Forced External Outbound SMB	Medium	CredentialAccess	`Corelight_v3_conn_CL` `Corelight_v3_conn_agg_CL` `Corelight_v3_conn_long_CL` `Corelight_v3_conn_red_CL`
Corelight - Multiple Compressed Files Transferred over HTTP	Medium	Exfiltration	`Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_agg_CL` `Corelight_v3_http_red_CL`
Corelight - Multiple files sent over HTTP with abnormal requests	Medium	Exfiltration	`Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_agg_CL` `Corelight_v3_http_red_CL`
Corelight - Network Service Scanning Multiple IP Addresses	Medium	InitialAccess	`Corelight_v3_conn_CL` `Corelight_v3_conn_agg_CL` `Corelight_v3_conn_long_CL` `Corelight_v3_conn_red_CL`
Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request	Medium	InitialAccess	`Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_agg_CL` `Corelight_v3_http_red_CL`
Corelight - Possible Webshell	Medium	Persistence	`Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_agg_CL` `Corelight_v3_http_red_CL`
Corelight - Possible Webshell (Rare PUT or POST)	Medium	Persistence	`Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_agg_CL` `Corelight_v3_http_red_CL`
Corelight - SMTP Email containing NON Ascii Characters within the Subject	Low	InitialAccess	`Corelight_v3_smtp_CL`

Hunting Queries

Name	Tactics	Tables Used
Corelight - Abnormal Email Subject	InitialAccess	`Corelight_v3_smtp_CL`
Corelight - Compressed Files Transferred over HTTP	Exfiltration	`Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_red_CL`
Corelight - External Facing Services	InitialAccess	`Corelight_v3_conn_CL` `Corelight_v3_conn_long_CL` `Corelight_v3_conn_red_CL`
Corelight - File uploads by source	Exfiltration	`Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_red_CL`
Corelight - Files in logs	InitialAccess, Exfiltration	`Corelight_v3_files_CL` `Corelight_v3_files_red_CL`
Corelight - Multiple Remote SMB Connections from single client	Discovery	`Corelight_v3_smb_mapping_CL`
Corelight - Obfuscated binary filenames	InitialAccess	`Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_red_CL`
Corelight - Rare PUT or POST	Persistence	`Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_red_CL`
Corelight - Repetitive DNS Failures	CommandAndControl	`Corelight_v3_dns_CL` `Corelight_v3_dns_red_CL`
Corelight - Top sources of data transferred	Exfiltration	`Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_red_CL`

Workbooks

Name	Tables Used
Corelight	`Corelight_v3_conn_CL` `Corelight_v3_conn_long_CL` `Corelight_v3_conn_red_CL` `Corelight_v3_dns_CL` `Corelight_v3_dns_red_CL` `Corelight_v3_etc_viz_CL` `Corelight_v3_files_CL` `Corelight_v3_files_red_CL` `Corelight_v3_ftp_CL` `Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_red_CL` `Corelight_v3_intel_CL` `Corelight_v3_notice_CL` `Corelight_v3_rdp_CL` `Corelight_v3_smb_files_CL` `Corelight_v3_smb_mapping_CL` `Corelight_v3_ssl_CL` `Corelight_v3_ssl_red_CL` `Corelight_v3_suricata_corelight_CL` `Corelight_v3_vpn_CL` `Corelight_v3_x509_CL` `Corelight_v3_x509_red_CL`
Corelight_Data_Explorer	`Corelight_v3_asset_classification_CL` `Corelight_v3_bacnet_CL` `Corelight_v3_capture_loss_CL` `Corelight_v3_cip_CL` `Corelight_v3_conn_CL` `Corelight_v3_conn_agg_CL` `Corelight_v3_conn_long_CL` `Corelight_v3_conn_red_CL` `Corelight_v3_corelight_burst_CL` `Corelight_v3_corelight_overall_capture_loss_CL` `Corelight_v3_corelight_profiling_CL` `Corelight_v3_datared_CL` `Corelight_v3_dce_rpc_CL` `Corelight_v3_dga_CL` `Corelight_v3_dhcp_CL` `Corelight_v3_dnp3_CL` `Corelight_v3_dns_CL` `Corelight_v3_dns_agg_CL` `Corelight_v3_dns_red_CL` `Corelight_v3_dpd_CL` `Corelight_v3_encrypted_dns_CL` `Corelight_v3_enip_CL` `Corelight_v3_enip_debug_CL` `Corelight_v3_enip_list_identity_CL` `Corelight_v3_etc_viz_CL` `Corelight_v3_files_CL` `Corelight_v3_files_agg_CL` `Corelight_v3_files_red_CL` `Corelight_v3_ftp_CL` `Corelight_v3_generic_dns_tunnels_CL` `Corelight_v3_generic_icmp_tunnels_CL` `Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_agg_CL` `Corelight_v3_http_red_CL` `Corelight_v3_icmp_specific_tunnels_CL` `Corelight_v3_intel_CL` `Corelight_v3_ipsec_CL` `Corelight_v3_irc_CL` `Corelight_v3_iso_cotp_CL` `Corelight_v3_kerberos_CL` `Corelight_v3_known_certs_CL` `Corelight_v3_known_devices_CL` `Corelight_v3_known_domains_CL` `Corelight_v3_known_hosts_CL` `Corelight_v3_known_names_CL` `Corelight_v3_known_remotes_CL` `Corelight_v3_known_services_CL` `Corelight_v3_known_users_CL` `Corelight_v3_local_subnets_CL` `Corelight_v3_local_subnets_dj_CL` `Corelight_v3_local_subnets_graphs_CL` `Corelight_v3_log4shell_CL` `Corelight_v3_modbus_CL` `Corelight_v3_mqtt_connect_CL` `Corelight_v3_mqtt_publish_CL` `Corelight_v3_mqtt_subscribe_CL` `Corelight_v3_mysql_CL` `Corelight_v3_notice_CL` `Corelight_v3_ntlm_CL` `Corelight_v3_ntp_CL` `Corelight_v3_ocsp_CL` `Corelight_v3_openflow_CL` `Corelight_v3_packet_filter_CL` `Corelight_v3_pe_CL` `Corelight_v3_profinet_CL` `Corelight_v3_profinet_dce_rpc_CL` `Corelight_v3_profinet_debug_CL` `Corelight_v3_radius_CL` `Corelight_v3_rdp_CL` `Corelight_v3_reporter_CL` `Corelight_v3_rfb_CL` `Corelight_v3_s7comm_CL` `Corelight_v3_signatures_CL` `Corelight_v3_sip_CL` `Corelight_v3_smartpcap_CL` `Corelight_v3_smartpcap_stats_CL` `Corelight_v3_smb_files_CL` `Corelight_v3_smb_mapping_CL` `Corelight_v3_smtp_CL` `Corelight_v3_smtp_links_CL` `Corelight_v3_snmp_CL` `Corelight_v3_socks_CL` `Corelight_v3_software_CL` `Corelight_v3_specific_dns_tunnels_CL` `Corelight_v3_ssh_CL` `Corelight_v3_ssl_CL` `Corelight_v3_ssl_agg_CL` `Corelight_v3_ssl_red_CL` `Corelight_v3_stats_CL` `Corelight_v3_stepping_CL` `Corelight_v3_stun_CL` `Corelight_v3_stun_nat_CL` `Corelight_v3_suricata_corelight_CL` `Corelight_v3_suricata_eve_CL` `Corelight_v3_suricata_stats_CL` `Corelight_v3_suricata_zeek_stats_CL` `Corelight_v3_syslog_CL` `Corelight_v3_tds_CL` `Corelight_v3_tds_rpc_CL` `Corelight_v3_tds_sql_batch_CL` `Corelight_v3_traceroute_CL` `Corelight_v3_tunnel_CL` `Corelight_v3_unknown_smartpcap_CL` `Corelight_v3_util_stats_CL` `Corelight_v3_vpn_CL` `Corelight_v3_weird_CL` `Corelight_v3_weird_red_CL` `Corelight_v3_weird_stats_CL` `Corelight_v3_wireguard_CL` `Corelight_v3_x509_CL` `Corelight_v3_x509_red_CL` `Corelight_v3_zeek_doctor_CL`
Corelight_Data_Insights	`Corelight_v3_conn_CL` `Corelight_v3_conn_long_CL` `Corelight_v3_conn_red_CL` `Corelight_v3_dns_CL` `Corelight_v3_dns_red_CL` `Corelight_v3_rdp_CL` `Corelight_v3_ssh_CL` `Corelight_v3_ssl_CL` `Corelight_v3_ssl_red_CL` `Corelight_v3_vpn_CL` `Corelight_v3_x509_CL` `Corelight_v3_x509_red_CL`
Corelight_Operations	`Corelight_v3_corelight_metrics_disk_CL` `Corelight_v3_corelight_metrics_iface_CL` `Corelight_v3_corelight_metrics_memory_CL` `Corelight_v3_corelight_metrics_system_CL` `Corelight_v3_corelight_metrics_zeek_doctor_CL` `Usage`
Corelight_Security_Workflow	`Corelight_v3_bacnet_CL` `Corelight_v3_capture_loss_CL` `Corelight_v3_cip_CL` `Corelight_v3_conn_CL` `Corelight_v3_conn_long_CL` `Corelight_v3_conn_red_CL` `Corelight_v3_corelight_burst_CL` `Corelight_v3_corelight_overall_capture_loss_CL` `Corelight_v3_corelight_profiling_CL` `Corelight_v3_datared_CL` `Corelight_v3_dce_rpc_CL` `Corelight_v3_dga_CL` `Corelight_v3_dhcp_CL` `Corelight_v3_dnp3_CL` `Corelight_v3_dns_CL` `Corelight_v3_dns_red_CL` `Corelight_v3_dpd_CL` `Corelight_v3_encrypted_dns_CL` `Corelight_v3_enip_CL` `Corelight_v3_enip_debug_CL` `Corelight_v3_enip_list_identity_CL` `Corelight_v3_etc_viz_CL` `Corelight_v3_files_CL` `Corelight_v3_files_red_CL` `Corelight_v3_ftp_CL` `Corelight_v3_generic_dns_tunnels_CL` `Corelight_v3_generic_icmp_tunnels_CL` `Corelight_v3_http2_CL` `Corelight_v3_http_CL` `Corelight_v3_http_red_CL` `Corelight_v3_icmp_specific_tunnels_CL` `Corelight_v3_intel_CL` `Corelight_v3_ipsec_CL` `Corelight_v3_irc_CL` `Corelight_v3_iso_cotp_CL` `Corelight_v3_kerberos_CL` `Corelight_v3_known_certs_CL` `Corelight_v3_known_devices_CL` `Corelight_v3_known_domains_CL` `Corelight_v3_known_hosts_CL` `Corelight_v3_known_names_CL` `Corelight_v3_known_remotes_CL` `Corelight_v3_known_services_CL` `Corelight_v3_known_users_CL` `Corelight_v3_local_subnets_CL` `Corelight_v3_local_subnets_dj_CL` `Corelight_v3_local_subnets_graphs_CL` `Corelight_v3_log4shell_CL` `Corelight_v3_modbus_CL` `Corelight_v3_mqtt_connect_CL` `Corelight_v3_mqtt_publish_CL` `Corelight_v3_mqtt_subscribe_CL` `Corelight_v3_mysql_CL` `Corelight_v3_notice_CL` `Corelight_v3_ntlm_CL` `Corelight_v3_ntp_CL` `Corelight_v3_ocsp_CL` `Corelight_v3_openflow_CL` `Corelight_v3_packet_filter_CL` `Corelight_v3_pe_CL` `Corelight_v3_profinet_CL` `Corelight_v3_profinet_dce_rpc_CL` `Corelight_v3_profinet_debug_CL` `Corelight_v3_radius_CL` `Corelight_v3_rdp_CL` `Corelight_v3_reporter_CL` `Corelight_v3_rfb_CL` `Corelight_v3_s7comm_CL` `Corelight_v3_signatures_CL` `Corelight_v3_sip_CL` `Corelight_v3_smartpcap_CL` `Corelight_v3_smartpcap_stats_CL` `Corelight_v3_smb_files_CL` `Corelight_v3_smb_mapping_CL` `Corelight_v3_smtp_CL` `Corelight_v3_smtp_links_CL` `Corelight_v3_snmp_CL` `Corelight_v3_socks_CL` `Corelight_v3_software_CL` `Corelight_v3_specific_dns_tunnels_CL` `Corelight_v3_ssh_CL` `Corelight_v3_ssl_CL` `Corelight_v3_ssl_red_CL` `Corelight_v3_stats_CL` `Corelight_v3_stepping_CL` `Corelight_v3_stun_CL` `Corelight_v3_stun_nat_CL` `Corelight_v3_suricata_corelight_CL` `Corelight_v3_suricata_eve_CL` `Corelight_v3_suricata_stats_CL` `Corelight_v3_suricata_zeek_stats_CL` `Corelight_v3_syslog_CL` `Corelight_v3_tds_CL` `Corelight_v3_tds_rpc_CL` `Corelight_v3_tds_sql_batch_CL` `Corelight_v3_traceroute_CL` `Corelight_v3_tunnel_CL` `Corelight_v3_unknown_smartpcap_CL` `Corelight_v3_util_stats_CL` `Corelight_v3_vpn_CL` `Corelight_v3_weird_CL` `Corelight_v3_weird_red_CL` `Corelight_v3_weird_stats_CL` `Corelight_v3_wireguard_CL` `Corelight_v3_x509_CL` `Corelight_v3_x509_red_CL` `Corelight_v3_zeek_doctor_CL`

Parsers

Name	Description	Tables Used
Corelight	-	-
corelight_amqp	-	`Corelight_v3_amqp_CL` (read)
corelight_analyzer	-	`Corelight_v3_analyzer_CL` (read)
corelight_anomaly	-	`Corelight_v3_anomaly_CL` (read)
corelight_asset_classification	-	`Corelight_v3_asset_classification_CL` (read)
corelight_bacnet	-	`Corelight_v3_bacnet_CL` (read)
corelight_bacnet_device_control	-	`Corelight_v3_bacnet_device_control_CL` (read)
corelight_bacnet_discovery	-	`Corelight_v3_bacnet_discovery_CL` (read)
corelight_bacnet_property	-	`Corelight_v3_bacnet_property_CL` (read)
corelight_broker	-	`Corelight_v3_broker_CL` (read)
corelight_bsap_ip_header	-	`Corelight_v3_bsap_ip_header_CL` (read)
corelight_bsap_ip_rdb	-	`Corelight_v3_bsap_ip_rdb_CL` (read)
corelight_bsap_ip_unknown	-	`Corelight_v3_bsap_ip_unknown_CL` (read)
corelight_bsap_serial_header	-	`Corelight_v3_bsap_serial_header_CL` (read)
corelight_bsap_serial_rdb	-	`Corelight_v3_bsap_serial_rdb_CL` (read)
corelight_bsap_serial_rdb_ext	-	`Corelight_v3_bsap_serial_rdb_ext_CL` (read)
corelight_bsap_serial_unknown	-	`Corelight_v3_bsap_serial_unknown_CL` (read)
corelight_capture_loss	-	`Corelight_v3_capture_loss_CL` (read)
corelight_cip	-	`Corelight_v3_cip_CL` (read)
corelight_cip_identity	-	`Corelight_v3_cip_identity_CL` (read)
corelight_cip_io	-	`Corelight_v3_cip_io_CL` (read)
corelight_cluster	-	`Corelight_v3_cluster_CL` (read)
corelight_config	-	`Corelight_v3_config_CL` (read)
corelight_conn	-	`Corelight_v3_conn_CL` (read) `Corelight_v3_conn_long_CL` (read) `Corelight_v3_conn_red_CL` (read)
corelight_conn_agg	-	`Corelight_v3_conn_agg_CL` (read)
corelight_conn_long	-	`Corelight_v3_conn_long_CL` (read)
corelight_conn_red	-	`Corelight_v3_conn_red_CL` (read)
corelight_corelight_ad_admin_shares	-	`Corelight_v3_corelight_ad_admin_shares_CL` (read)
corelight_corelight_ad_ew_servers_services	-	`Corelight_v3_corelight_ad_ew_servers_services_CL` (read)
corelight_corelight_ad_exe_files	-	`Corelight_v3_corelight_ad_exe_files_CL` (read)
corelight_corelight_ad_ftp_connections	-	`Corelight_v3_corelight_ad_ftp_connections_CL` (read)
corelight_corelight_ad_http_user_agents	-	`Corelight_v3_corelight_ad_http_user_agents_CL` (read)
corelight_corelight_ad_ns_servers_services	-	`Corelight_v3_corelight_ad_ns_servers_services_CL` (read)
corelight_corelight_ad_ntlm_auth	-	`Corelight_v3_corelight_ad_ntlm_auth_CL` (read)
corelight_corelight_ad_rdp	-	`Corelight_v3_corelight_ad_rdp_CL` (read)
corelight_corelight_ad_ssh_clients	-	`Corelight_v3_corelight_ad_ssh_clients_CL` (read)
corelight_corelight_ad_ssh_connections	-	`Corelight_v3_corelight_ad_ssh_connections_CL` (read)
corelight_corelight_burst	-	`Corelight_v3_corelight_burst_CL` (read)
corelight_corelight_license_capacity	-	`Corelight_v3_corelight_license_capacity_CL` (read)
corelight_corelight_metrics_disk	-	`Corelight_v3_corelight_metrics_disk_CL` (read)
corelight_corelight_metrics_iface	-	`Corelight_v3_corelight_metrics_iface_CL` (read)
corelight_corelight_metrics_memory	-	`Corelight_v3_corelight_metrics_memory_CL` (read)
corelight_corelight_metrics_system	-	`Corelight_v3_corelight_metrics_system_CL` (read)
corelight_corelight_metrics_zeek_doctor	-	`Corelight_v3_corelight_metrics_zeek_doctor_CL` (read)
corelight_corelight_overall_capture_loss	-	`Corelight_v3_corelight_overall_capture_loss_CL` (read)
corelight_corelight_pipeline_test	-	`Corelight_v3_corelight_pipeline_test_CL` (read)
corelight_corelight_profiling	-	`Corelight_v3_corelight_profiling_CL` (read)
corelight_datared	-	`Corelight_v3_datared_CL` (read)
corelight_dce_rpc	-	`Corelight_v3_dce_rpc_CL` (read)
corelight_dga	-	`Corelight_v3_dga_CL` (read)
corelight_dhcp	-	`Corelight_v3_dhcp_CL` (read)
corelight_dnp3	-	`Corelight_v3_dnp3_CL` (read)
corelight_dnp3_control	-	`Corelight_v3_dnp3_control_CL` (read)
corelight_dnp3_objects	-	`Corelight_v3_dnp3_objects_CL` (read)
corelight_dns	-	`Corelight_v3_dns_CL` (read) `Corelight_v3_dns_red_CL` (read)
corelight_dns_agg	-	`Corelight_v3_dns_agg_CL` (read)
corelight_dns_red	-	`Corelight_v3_dns_red_CL` (read)
corelight_dpd	-	`Corelight_v3_dpd_CL` (read)
corelight_ecat_aoe_info	-	`Corelight_v3_ecat_aoe_info_CL` (read)
corelight_ecat_arp_info	-	`Corelight_v3_ecat_arp_info_CL` (read)
corelight_ecat_coe_info	-	`Corelight_v3_ecat_coe_info_CL` (read)
corelight_ecat_dev_info	-	`Corelight_v3_ecat_dev_info_CL` (read)
corelight_ecat_foe_info	-	`Corelight_v3_ecat_foe_info_CL` (read)
corelight_ecat_log_address	-	`Corelight_v3_ecat_log_address_CL` (read)
corelight_ecat_registers	-	`Corelight_v3_ecat_registers_CL` (read)
corelight_ecat_soe_info	-	`Corelight_v3_ecat_soe_info_CL` (read)
corelight_encrypted_dns	-	`Corelight_v3_encrypted_dns_CL` (read)
corelight_enip	-	`Corelight_v3_enip_CL` (read)
corelight_enip_debug	-	`Corelight_v3_enip_debug_CL` (read)
corelight_enip_list_identity	-	`Corelight_v3_enip_list_identity_CL` (read)
corelight_etc_viz	-	`Corelight_v3_etc_viz_CL` (read)
corelight_files	-	`Corelight_v3_files_CL` (read) `Corelight_v3_files_red_CL` (read)
corelight_files_agg	-	`Corelight_v3_files_agg_CL` (read)
corelight_files_red	-	`Corelight_v3_files_red_CL` (read)
corelight_first_seen	-	`Corelight_v3_first_seen_CL` (read)
corelight_ftp	-	`Corelight_v3_ftp_CL` (read)
corelight_gena	-	`Corelight_v3_gena_CL` (read)
corelight_generic_dns_tunnels	-	`Corelight_v3_generic_dns_tunnels_CL` (read)
corelight_generic_icmp_tunnels	-	`Corelight_v3_generic_icmp_tunnels_CL` (read)
corelight_genisys	-	`Corelight_v3_genisys_CL` (read)
corelight_http	-	`Corelight_v3_http2_CL` (read) `Corelight_v3_http_CL` (read) `Corelight_v3_http_red_CL` (read)
corelight_http2	-	`Corelight_v3_http2_CL` (read)
corelight_http_agg	-	`Corelight_v3_http_agg_CL` (read)
corelight_http_red	-	`Corelight_v3_http_red_CL` (read)
corelight_icmp_specific_tunnels	-	`Corelight_v3_icmp_specific_tunnels_CL` (read)
corelight_intel	-	`Corelight_v3_intel_CL` (read)
corelight_ipsec	-	`Corelight_v3_ipsec_CL` (read)
corelight_irc	-	`Corelight_v3_irc_CL` (read)
corelight_iso_cotp	-	`Corelight_v3_iso_cotp_CL` (read)
corelight_kerberos	-	`Corelight_v3_kerberos_CL` (read)
corelight_known_certs	-	`Corelight_v3_known_certs_CL` (read)
corelight_known_devices	-	`Corelight_v3_known_devices_CL` (read)
corelight_known_domains	-	`Corelight_v3_known_domains_CL` (read)
corelight_known_hosts	-	`Corelight_v3_known_hosts_CL` (read)
corelight_known_names	-	`Corelight_v3_known_names_CL` (read)
corelight_known_remotes	-	`Corelight_v3_known_remotes_CL` (read)
corelight_known_services	-	`Corelight_v3_known_services_CL` (read)
corelight_known_users	-	`Corelight_v3_known_users_CL` (read)
corelight_ldap	-	`Corelight_v3_ldap_CL` (read)
corelight_ldap_search	-	`Corelight_v3_ldap_search_CL` (read)
corelight_loaded_scripts	-	`Corelight_v3_loaded_scripts_CL` (read)
corelight_local_subnets	-	`Corelight_v3_local_subnets_CL` (read)
corelight_local_subnets_dj	-	`Corelight_v3_local_subnets_dj_CL` (read)
corelight_local_subnets_graphs	-	`Corelight_v3_local_subnets_graphs_CL` (read)
corelight_local_subnets_neighbor	-	`Corelight_v3_local_subnets_neighbor_CL` (read)
corelight_log4shell	-	`Corelight_v3_log4shell_CL` (read)
corelight_logschema	-	`Corelight_v3_logschema_CL` (read)
corelight_modbus	-	`Corelight_v3_modbus_CL` (read)
corelight_modbus_detailed	-	`Corelight_v3_modbus_detailed_CL` (read)
corelight_modbus_mask_write_register	-	`Corelight_v3_modbus_mask_write_register_CL` (read)
corelight_modbus_read_device_identification	-	`Corelight_v3_modbus_read_device_identificatio_CL` (read)
corelight_modbus_read_write_multiple_registers	-	`Corelight_v3_modbus_read_write_multiple_regis_CL` (read)
corelight_mqtt_connect	-	`Corelight_v3_mqtt_connect_CL` (read)
corelight_mqtt_publish	-	`Corelight_v3_mqtt_publish_CL` (read)
corelight_mqtt_subscribe	-	`Corelight_v3_mqtt_subscribe_CL` (read)
corelight_mysql	-	`Corelight_v3_mysql_CL` (read)
corelight_netcontrol	-	`Corelight_v3_netcontrol_CL` (read)
corelight_netcontrol_drop	-	`Corelight_v3_netcontrol_drop_CL` (read)
corelight_netcontrol_shunt	-	`Corelight_v3_netcontrol_shunt_CL` (read)
corelight_notice	-	`Corelight_v3_notice_CL` (read)
corelight_notice_alarm	-	`Corelight_v3_notice_alarm_CL` (read)
corelight_ntlm	-	`Corelight_v3_ntlm_CL` (read)
corelight_ntp	-	`Corelight_v3_ntp_CL` (read)
corelight_ocsp	-	`Corelight_v3_ocsp_CL` (read)
corelight_opcua_binary	-	`Corelight_v3_opcua_binary_CL` (read)
corelight_opcua_binary_activate_session	-	`Corelight_v3_opcua_binary_activate_session_CL` (read)
corelight_opcua_binary_activate_session_client_software_cert	-	`Corelight_v3_opcua_binary_activate_session_cl_CL` (read)
corelight_opcua_binary_activate_session_locale_id	-	`Corelight_v3_opcua_binary_activate_session_lo_CL` (read)
corelight_opcua_binary_aggregate_filter	-	`Corelight_v3_opcua_binary_aggregate_filter_CL` (read)
corelight_opcua_binary_browse	-	`Corelight_v3_opcua_binary_browse_CL` (read)
corelight_opcua_binary_browse_description	-	`Corelight_v3_opcua_binary_browse_description_CL` (read)
corelight_opcua_binary_browse_request_continuation_point	-	`Corelight_v3_opcua_binary_browse_request_cont_CL` (read)
corelight_opcua_binary_browse_response_references	-	`Corelight_v3_opcua_binary_browse_response_ref_CL` (read)
corelight_opcua_binary_browse_result	-	`Corelight_v3_opcua_binary_browse_result_CL` (read)
corelight_opcua_binary_close_session	-	`Corelight_v3_opcua_binary_close_session_CL` (read)
corelight_opcua_binary_create_monitored_items	-	`Corelight_v3_opcua_binary_cm_items_CL` (read)
corelight_opcua_binary_create_monitored_items_create_item	-	`Corelight_v3_opcua_binary_cm_create_item_CL` (read)
corelight_opcua_binary_create_session	-	`Corelight_v3_opcua_binary_create_session_CL` (read)
corelight_opcua_binary_create_session_discovery	-	`Corelight_v3_opcua_binary_create_session_disc_CL` (read)
corelight_opcua_binary_create_session_endpoints	-	`Corelight_v3_opcua_binary_create_session_endp_CL` (read)
corelight_opcua_binary_create_session_user_token	-	`Corelight_v3_opcua_binary_create_session_user_CL` (read)
corelight_opcua_binary_create_subscription	-	`Corelight_v3_opcua_binary_create_subscription_CL` (read)
corelight_opcua_binary_data_change_filter	-	`Corelight_v3_opcua_binary_data_change_filter_CL` (read)
corelight_opcua_binary_diag_info_detail	-	`Corelight_v3_opcua_binary_diag_info_detail_CL` (read)
corelight_opcua_binary_event_filter	-	`Corelight_v3_opcua_binary_event_filter_CL` (read)
corelight_opcua_binary_event_filter_attribute_operand	-	`Corelight_v3_opcua_binary_event_filter_attrib_CL` (read)
corelight_opcua_binary_event_filter_attribute_operand_browse_paths	-	`Corelight_v3_opcua_bef_attr_operand_bpaths_CL` (read)
corelight_opcua_binary_event_filter_element_operand	-	`Corelight_v3_opcua_binary_event_filter_elemen_CL` (read)
corelight_opcua_binary_event_filter_literal_operand	-	`Corelight_v3_opcua_binary_event_filter_litera_CL` (read)
corelight_opcua_binary_event_filter_select_clause	-	`Corelight_v3_opcua_binary_event_filter_select_CL` (read)
corelight_opcua_binary_event_filter_simple_attribute_operand	-	`Corelight_v3_opcua_binary_event_filter_simple_CL` (read)
corelight_opcua_binary_event_filter_simple_attribute_operand_browse_paths	-	`Corelight_v3_opcua_bef_smpl_attr_bpaths_CL` (read)
corelight_opcua_binary_event_filter_where_clause	-	`Corelight_v3_opcua_bef_where_clause_CL` (read)
corelight_opcua_binary_event_filter_where_clause_elements	-	`Corelight_v3_opcua_bef_where_clause_elements_CL` (read)
corelight_opcua_binary_get_endpoints	-	`Corelight_v3_opcua_binary_get_endpoints_CL` (read)
corelight_opcua_binary_get_endpoints_description	-	`Corelight_v3_opcua_binary_get_endpoints_descr_CL` (read)
corelight_opcua_binary_get_endpoints_discovery	-	`Corelight_v3_opcua_binary_get_endpoints_disco_CL` (read)
corelight_opcua_binary_get_endpoints_locale_id	-	`Corelight_v3_opcua_binary_get_endpoints_local_CL` (read)
corelight_opcua_binary_get_endpoints_profile_uri	-	`Corelight_v3_opcua_binary_get_endpoints_profi_CL` (read)
corelight_opcua_binary_get_endpoints_user_token	-	`Corelight_v3_opcua_binary_get_endpoints_user_CL` (read)
corelight_opcua_binary_opensecure_channel	-	`Corelight_v3_opcua_binary_opensecure_channel_CL` (read)
corelight_opcua_binary_read	-	`Corelight_v3_opcua_binary_read_CL` (read)
corelight_opcua_binary_read_nodes_to_read	-	`Corelight_v3_opcua_binary_read_nodes_to_read_CL` (read)
corelight_opcua_binary_read_results	-	`Corelight_v3_opcua_binary_read_results_CL` (read)
corelight_opcua_binary_status_code_detail	-	`Corelight_v3_opcua_binary_status_code_detail_CL` (read)
corelight_opcua_binary_variant_array_dims	-	`Corelight_v3_opcua_binary_variant_array_dims_CL` (read)
corelight_opcua_binary_variant_data	-	`Corelight_v3_opcua_binary_variant_data_CL` (read)
corelight_opcua_binary_variant_data_value	-	`Corelight_v3_opcua_binary_variant_data_value_CL` (read)
corelight_opcua_binary_variant_extension_object	-	`Corelight_v3_opcua_binary_variant_extension_o_CL` (read)
corelight_opcua_binary_variant_metadata	-	`Corelight_v3_opcua_binary_variant_metadata_CL` (read)
corelight_openflow	-	`Corelight_v3_openflow_CL` (read)
corelight_packet_filter	-	`Corelight_v3_packet_filter_CL` (read)
corelight_pe	-	`Corelight_v3_pe_CL` (read)
corelight_print	-	`Corelight_v3_print_CL` (read)
corelight_profinet	-	`Corelight_v3_profinet_CL` (read)
corelight_profinet_dce_rpc	-	`Corelight_v3_profinet_dce_rpc_CL` (read)
corelight_profinet_debug	-	`Corelight_v3_profinet_debug_CL` (read)
corelight_quic	-	`Corelight_v3_quic_CL` (read)
corelight_radius	-	`Corelight_v3_radius_CL` (read)
corelight_rdp	-	`Corelight_v3_rdp_CL` (read)
corelight_reporter	-	`Corelight_v3_reporter_CL` (read)
corelight_rfb	-	`Corelight_v3_rfb_CL` (read)
corelight_s7comm	-	`Corelight_v3_s7comm_CL` (read)
corelight_s7comm_plus	-	`Corelight_v3_s7comm_plus_CL` (read)
corelight_s7comm_read_szl	-	`Corelight_v3_s7comm_read_szl_CL` (read)
corelight_s7comm_upload_download	-	`Corelight_v3_s7comm_upload_download_CL` (read)
corelight_signatures	-	`Corelight_v3_signatures_CL` (read)
corelight_sip	-	`Corelight_v3_sip_CL` (read)
corelight_smartpcap	-	`Corelight_v3_smartpcap_CL` (read)
corelight_smartpcap_stats	-	`Corelight_v3_smartpcap_stats_CL` (read)
corelight_smb_files	-	`Corelight_v3_smb_files_CL` (read)
corelight_smb_mapping	-	`Corelight_v3_smb_mapping_CL` (read)
corelight_smtp	-	`Corelight_v3_smtp_CL` (read)
corelight_smtp_links	-	`Corelight_v3_smtp_links_CL` (read)
corelight_snmp	-	`Corelight_v3_snmp_CL` (read)
corelight_socks	-	`Corelight_v3_socks_CL` (read)
corelight_software	-	`Corelight_v3_software_CL` (read)
corelight_specific_dns_tunnels	-	`Corelight_v3_specific_dns_tunnels_CL` (read)
corelight_ssdp	-	`Corelight_v3_ssdp_CL` (read)
corelight_ssh	string	`Corelight_v3_ssh_CL` (read)
corelight_ssl	-	`Corelight_v3_ssl_CL` (read) `Corelight_v3_ssl_red_CL` (read)
corelight_ssl_agg	-	`Corelight_v3_ssl_agg_CL` (read)
corelight_ssl_red	-	`Corelight_v3_ssl_red_CL` (read)
corelight_stats	-	`Corelight_v3_stats_CL` (read)
corelight_stepping	-	`Corelight_v3_stepping_CL` (read)
corelight_stun	-	`Corelight_v3_stun_CL` (read)
corelight_stun_nat	-	`Corelight_v3_stun_nat_CL` (read)
corelight_suri_aggregations	-	-
corelight_suricata_corelight	-	`Corelight_v3_suricata_corelight_CL` (read)
corelight_suricata_eve	-	`Corelight_v3_suricata_eve_CL` (read)
corelight_suricata_stats	-	`Corelight_v3_suricata_stats_CL` (read)
corelight_suricata_zeek_stats	-	`Corelight_v3_suricata_zeek_stats_CL` (read)
corelight_syslog	-	`Corelight_v3_syslog_CL` (read)
corelight_tds	-	`Corelight_v3_tds_CL` (read)
corelight_tds_rpc	-	`Corelight_v3_tds_rpc_CL` (read)
corelight_tds_sql_batch	-	`Corelight_v3_tds_sql_batch_CL` (read)
corelight_telnet	-	`Corelight_v3_telnet_CL` (read)
corelight_traceroute	-	`Corelight_v3_traceroute_CL` (read)
corelight_tunnel	-	`Corelight_v3_tunnel_CL` (read)
corelight_unknown_smartpcap	-	`Corelight_v3_unknown_smartpcap_CL` (read)
corelight_util_stats	-	`Corelight_v3_util_stats_CL` (read)
corelight_vpn	string	`Corelight_v3_vpn_CL` (read)
corelight_websocket	-	`Corelight_v3_websocket_CL` (read)
corelight_weird	-	`Corelight_v3_weird_CL` (read)
corelight_weird_agg	-	`Corelight_v3_weird_agg_CL` (read)
corelight_weird_red	-	`Corelight_v3_weird_red_CL` (read)
corelight_weird_stats	-	`Corelight_v3_weird_stats_CL` (read)
corelight_wireguard	-	`Corelight_v3_wireguard_CL` (read)
corelight_x509	-	`Corelight_v3_x509_CL` (read) `Corelight_v3_x509_red_CL` (read)
corelight_x509_red	-	`Corelight_v3_x509_red_CL` (read)
corelight_zeek_doctor	-	`Corelight_v3_zeek_doctor_CL` (read)

Watchlists

Name	Description	Tables Used
CorelightAggregationsEnrichment1	-	-
CorelightAggregationsEnrichment2	-	-
CorelightDNSPortDesc	-	-
CorelightGeoCountries	-	-
CorelightInferencesDesc	-	-

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.3.0	18-08-2026	Updated Data Connector page for DCE/DCR based ingestion, added new Parsers, and updated Workbooks and Analytic Rules queries for the new table schema and field names
3.2.5	04-06-2026	Restructuring dashboards and adding asset classification tab in data explorer
3.2.4	19-03-2026	Added 'Show Aggregation' filters in Corelight Data Explorer Workbook.
3.2.3	27-01-2026	Added Corelight AWS VPC Flow dashboard.
3.2.2	01-12-2025	Added Corelight Aggregation Parsers.
3.2.1	30-10-2025	Added corelight_first_seen and corelight_anomaly Parsers.
3.2.0	05-03-2025	Added new Parsers, Workbooks and Watchlists.
3.1.0	27-09-2024	Updated Parsers and added new tabs in Workbook.
3.0.2	31-01-2024	Updated Parser Corelight Updated tactics of Hunting Query Corelight - Repetitive DNS Failures
3.0.1	16-11-2023	Updated package mainTemplate variables
3.0.0	20-09-2023	Changed backend format to use separate tables with parsed values
2.0.0	10-06-2022	Updated Workbooks
1.1.0	22-10-2021	Packaging updates
1.0.2	22-04-2021	Updated instructions, rules, LA config
1.0.1	09-04-2021	Updated Analytic Rule
1.0.0	01-04-2021	Initial Solution Release