Corelight-update

The primary purpose of the Corelight-update utility is to automate and simplify the workflow of collecting data from disparate sources of dynamic content for Corelight Sensors by integrating into your existing CI/CD process.

These data sources include Suricata rulesets, YARA rules, threat intelligence, vulnerability data, endpoint host data, and other Input Framework data for Zeek packages. The data can come from pre-formatted local sources, pre-formatted remote sources, or specific third-part integrations.

There’s no need for additional tools if you integrate Corelight-update with your CI/CD or change control process to manage Suricata rulesets, Intel files, Input files or Zeek package bundles.

Corelight-update natively supports the concept of hierarchical processing, with a single global configuration and multiple policy configurations.

The output of each policy is merged into a single Intel file, a single Suricata ruleset, a single package bundle, a single YARA rules file, and multiple Input files ready to be consumed by a Corelight Sensor.

A secondary function of Corelight-update is to push content to Corelight Sensors. It supports all types of sensors, both Fleet-managed and stand-alone.