Overview¶
The primary purpose of the Corelight-update utility is to automate and simplify the workflow of collecting data from disparate sources of dynamic content for Corelight Sensors.
This data includes threat intel, Suricata rulesets, vulnerability data, Zeek packages and other Input Framework data. The source of data can be local or remote.
In addition to collecting and formatting data sources, Corelight-update can optionally apply Corelight best practices to Suricata rulesets, extracting indicators from atomic Suricata rules and creating Zeek Intel files. The corresponding Suricata rules are then disabled, reducing the workload of the Suricata process.
Corelight-update natively supports the concept of hierarchical policies with a single global policy and multiple group level policies.
The output of Corelight-update is a single Intel file and a single Suricata ruleset (per policy) that’s ready to be consumed by a Corelight Sensor.
A secondary function of Corelight-update is to push content to Corelight Sensors. It supports ALL types of sensors, both Fleet-managed and stand-alone.
In addition to Threat Feeds, Suricata Rulesets and vulnerability data, Corelight-update can also manage Zeek Package Bundles for Corelight Sensors. It can build and push a bundle from a manifest file or it can push a bundle built outside Corelight-update.