Corelight-update¶
The primary purpose of the Corelight-update utility is to automate and simplify the workflow of collecting data from disparate sources of dynamic content for Corelight Sensors by integrating into your existing CI/CD process.
This data includes threat intel, Suricata rulesets, vulnerability data, Zeek packages and other Input Framework data. The data can come from pre-formatted local sources, pre-formatted remote sources, or third-part integrations.
There’s no need for additional tools if you integrate Corelight-update with your CI/CD or change control process to manage Suricata rulesets, Intel files, Input files or Zeek package bundles.
In addition to collecting and formatting data sources, Corelight-update can optionally apply Corelight best practices to Suricata rulesets, extracting indicators from atomic Suricata rules and creating Zeek Intel files. The corresponding Suricata rules are then disabled, reducing the workload of the Suricata process.
Corelight-update natively supports the concept of hierarchical processing with a single global configuration and multiple policy configurations.
The output of each policy is a single Intel file, a single Suricata ruleset, a single package bundle, and multiple Input files ready to be consumed by a Corelight Sensor.
A secondary function of Corelight-update is to push content to Corelight Sensors. It supports ALL types of sensors, both Fleet-managed and stand-alone.