Corelight Investigator
自動配備
コミュニティの提供による
Detection & Response Enablement
概要
Import Corelight Investigator alerts and detections into OpenCTI as STIX Incidents.
The OpenCTI Corelight Investigator connector imports alerts and detections from Corelight Investigator (SaaS NDR) into OpenCTI as STIX Incidents. It periodically queries the Investigator Detections and Alerts API (bearer API key), maps the normalized Investigator severity (1-10) to the OpenCTI severity, extracts the source/destination IP observables referenced by an alert, and attributes the imported objects to a Corelight Investigator author identity with a configurable TLP marking. Imports are incremental using the connector state.
基本情報
コネクター
7.260706.0
7.260706.0
0