Corelight Investigator
Automatic deploy
Supported by community
Detection & Response Enablement
Overview
Import Corelight Investigator alerts and detections into OpenCTI as STIX Incidents.
The OpenCTI Corelight Investigator connector imports alerts and detections from Corelight Investigator (SaaS NDR) into OpenCTI as STIX Incidents. It periodically queries the Investigator Detections and Alerts API (bearer API key), maps the normalized Investigator severity (1-10) to the OpenCTI severity, extracts the source/destination IP observables referenced by an alert, and attributes the imported objects to a Corelight Investigator author identity with a configurable TLP marking. Imports are incremental using the connector state.