Input management¶
You can leverage the Zeek Input framework to provide contextual data for use with enabled Zeek packages. Depending on the Zeek packages, this data can be used to generate logs (alerts), prevent the generation of logs (alerts), and/or enrich logs with additional data from external sources.
Corelight-update can collect input files from local or remote sources and/or generate input files with enabled third-party integrations. Once collected, any input files with the same name will automatically get merged into a single input file with that name and published.
Input management settings¶
input_management: default_input: true
Corelight sensors contain a number of Zeek packages that can take advantage of input files. However, none of those files are included out of the box. If default_input
is enabled, Corelight-update will automatically generate templates for those files and place them in the local-input folder. See Locally managed sources for the path.