{
  "Name": "Corelight",
  "Author": "Corelight - info@corelight.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Corelight/Data%20Connectors/Logo/corelight.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The [Corelight](https://corelight.com/) solution provides the capability to ingest events from [Zeek](https://zeek.org/) and [Suricata](https://suricata.io/) via Corelight Sensors into Microsoft Sentinel.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Agent based logs collection from Windows and Linux machines](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-custom-logs)",
  "WorkbookDescription": "Sample Corelight workbook",
  "Workbooks": [
    "Workbooks/Corelight_Data_Explorer.json",
    "Workbooks/Corelight_Data_Insights.json",
    "Workbooks/Corelight_Operations.json",
    "Workbooks/Corelight_Security_Workflow.json",
    "Workbooks/Corelight.json"
  ],
  "Watchlists": [
    "Watchlists/Corelight-AggregationsEnrichment/CorelightAggregationsEnrichment1.json",
    "Watchlists/Corelight-AggregationsEnrichment/CorelightAggregationsEnrichment2.json",
    "Watchlists/Corelight-DNSPortDesc/CorelightDNSPortDesc.json",
    "Watchlists/Corelight-InferencesDesc/CorelightInferencesDesc.json",
    "Watchlists/Corelight-GeoCountries/CorelightGeoCountries.json"
  ],
  "Analytic Rules": [
    "Analytic Rules/CorelightC2RepetitiveFailures.yaml",
    "Analytic Rules/CorelightExternalProxyDetected.yaml",
    "Analytic Rules/CorelightForcedExternalOutboundSMB.yaml",
    "Analytic Rules/CorelightMultipleCompressedFilesTransferredOverHTTP.yaml",
    "Analytic Rules/CorelightMultipleFilesSentOverHTTPAbnormalRequests.yaml",
    "Analytic Rules/CorelightNetworkServiceScanning.yaml",
    "Analytic Rules/CorelightPossibleWebshell.yaml",
    "Analytic Rules/CorelightPossibleWebshellRarePOST.yaml",
    "Analytic Rules/CorelightSMTPEmailSubjectNonAsciiCharacters.yaml",
    "Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml"
  ],
  "Data Connectors": [
    "Data Connectors/CorelightExporter/CorelightConnectorExporter.json"
  ],
  "Parsers": [
    "Parsers/Corelight.yaml",
    "Parsers/corelight_asset_classification.yaml",
    "Parsers/corelight_bacnet.yaml",
    "Parsers/corelight_capture_loss.yaml",
    "Parsers/corelight_cip.yaml",
    "Parsers/corelight_conn.yaml",
    "Parsers/corelight_conn_long.yaml",
    "Parsers/corelight_conn_red.yaml",
    "Parsers/corelight_corelight_burst.yaml",
    "Parsers/corelight_corelight_overall_capture_loss.yaml",
    "Parsers/corelight_corelight_profiling.yaml",
    "Parsers/corelight_datared.yaml",
    "Parsers/corelight_dce_rpc.yaml",
    "Parsers/corelight_dga.yaml",
    "Parsers/corelight_dhcp.yaml",
    "Parsers/corelight_dnp3.yaml",
    "Parsers/corelight_dns.yaml",
    "Parsers/corelight_dns_red.yaml",
    "Parsers/corelight_dpd.yaml",
    "Parsers/corelight_encrypted_dns.yaml",
    "Parsers/corelight_enip.yaml",
    "Parsers/corelight_enip_debug.yaml",
    "Parsers/corelight_enip_list_identity.yaml",
    "Parsers/corelight_etc_viz.yaml",
    "Parsers/corelight_files.yaml",
    "Parsers/corelight_files_red.yaml",
    "Parsers/corelight_ftp.yaml",
    "Parsers/corelight_generic_dns_tunnels.yaml",
    "Parsers/corelight_generic_icmp_tunnels.yaml",
    "Parsers/corelight_http.yaml",
    "Parsers/corelight_http2.yaml",
    "Parsers/corelight_http_red.yaml",
    "Parsers/corelight_icmp_specific_tunnels.yaml",
    "Parsers/corelight_intel.yaml",
    "Parsers/corelight_ipsec.yaml",
    "Parsers/corelight_irc.yaml",
    "Parsers/corelight_iso_cotp.yaml",
    "Parsers/corelight_kerberos.yaml",
    "Parsers/corelight_known_certs.yaml",
    "Parsers/corelight_known_devices.yaml",
    "Parsers/corelight_known_domains.yaml",
    "Parsers/corelight_known_hosts.yaml",
    "Parsers/corelight_known_names.yaml",
    "Parsers/corelight_known_remotes.yaml",
    "Parsers/corelight_known_services.yaml",
    "Parsers/corelight_known_users.yaml",
    "Parsers/corelight_local_subnets.yaml",
    "Parsers/corelight_local_subnets_dj.yaml",
    "Parsers/corelight_local_subnets_graphs.yaml",
    "Parsers/corelight_log4shell.yaml",
    "Parsers/corelight_modbus.yaml",
    "Parsers/corelight_mqtt_connect.yaml",
    "Parsers/corelight_mqtt_publish.yaml",
    "Parsers/corelight_mqtt_subscribe.yaml",
    "Parsers/corelight_mysql.yaml",
    "Parsers/corelight_notice.yaml",
    "Parsers/corelight_ntlm.yaml",
    "Parsers/corelight_ntp.yaml",
    "Parsers/corelight_ocsp.yaml",
    "Parsers/corelight_openflow.yaml",
    "Parsers/corelight_packet_filter.yaml",
    "Parsers/corelight_pe.yaml",
    "Parsers/corelight_profinet.yaml",
    "Parsers/corelight_profinet_dce_rpc.yaml",
    "Parsers/corelight_profinet_debug.yaml",
    "Parsers/corelight_radius.yaml",
    "Parsers/corelight_rdp.yaml",
    "Parsers/corelight_reporter.yaml",
    "Parsers/corelight_rfb.yaml",
    "Parsers/corelight_s7comm.yaml",
    "Parsers/corelight_signatures.yaml",
    "Parsers/corelight_sip.yaml",
    "Parsers/corelight_smartpcap.yaml",
    "Parsers/corelight_smartpcap_stats.yaml",
    "Parsers/corelight_smb_files.yaml",
    "Parsers/corelight_smb_mapping.yaml",
    "Parsers/corelight_smtp.yaml",
    "Parsers/corelight_smtp_links.yaml",
    "Parsers/corelight_snmp.yaml",
    "Parsers/corelight_socks.yaml",
    "Parsers/corelight_software.yaml",
    "Parsers/corelight_specific_dns_tunnels.yaml",
    "Parsers/corelight_ssh.yaml",
    "Parsers/corelight_ssl.yaml",
    "Parsers/corelight_ssl_red.yaml",
    "Parsers/corelight_stats.yaml",
    "Parsers/corelight_stepping.yaml",
    "Parsers/corelight_stun.yaml",
    "Parsers/corelight_stun_nat.yaml",
    "Parsers/corelight_suricata_corelight.yaml",
    "Parsers/corelight_suricata_eve.yaml",
    "Parsers/corelight_suricata_stats.yaml",
    "Parsers/corelight_suricata_zeek_stats.yaml",
    "Parsers/corelight_syslog.yaml",
    "Parsers/corelight_tds.yaml",
    "Parsers/corelight_tds_rpc.yaml",
    "Parsers/corelight_tds_sql_batch.yaml",
    "Parsers/corelight_traceroute.yaml",
    "Parsers/corelight_tunnel.yaml",
    "Parsers/corelight_unknown_smartpcap.yaml",
    "Parsers/corelight_util_stats.yaml",
    "Parsers/corelight_vpn.yaml",
    "Parsers/corelight_weird.yaml",
    "Parsers/corelight_weird_red.yaml",
    "Parsers/corelight_weird_stats.yaml",
    "Parsers/corelight_wireguard.yaml",
    "Parsers/corelight_x509.yaml",
    "Parsers/corelight_x509_red.yaml",
    "Parsers/corelight_zeek_doctor.yaml",
    "Parsers/corelight_corelight_metrics_disk.yaml",
    "Parsers/corelight_corelight_metrics_iface.yaml",
    "Parsers/corelight_corelight_metrics_memory.yaml",
    "Parsers/corelight_corelight_metrics_system.yaml",
    "Parsers/corelight_corelight_metrics_zeek_doctor.yaml",
    "Parsers/corelight_suri_aggregations.yaml",
    "Parsers/corelight_anomaly.yaml",
    "Parsers/corelight_first_seen.yaml",
    "Parsers/corelight_conn_agg.yaml",
    "Parsers/corelight_dns_agg.yaml",
    "Parsers/corelight_files_agg.yaml",
    "Parsers/corelight_http_agg.yaml",
    "Parsers/corelight_ssl_agg.yaml",
    "Parsers/corelight_weird_agg.yaml",
    "Parsers/corelight_amqp.yaml",
    "Parsers/corelight_analyzer.yaml",
    "Parsers/corelight_bacnet_device_control.yaml",
    "Parsers/corelight_bacnet_discovery.yaml",
    "Parsers/corelight_bacnet_property.yaml",
    "Parsers/corelight_broker.yaml",
    "Parsers/corelight_bsap_ip_header.yaml",
    "Parsers/corelight_bsap_ip_rdb.yaml",
    "Parsers/corelight_bsap_ip_unknown.yaml",
    "Parsers/corelight_bsap_serial_header.yaml",
    "Parsers/corelight_bsap_serial_rdb.yaml",
    "Parsers/corelight_bsap_serial_rdb_ext.yaml",
    "Parsers/corelight_bsap_serial_unknown.yaml",
    "Parsers/corelight_cip_identity.yaml",
    "Parsers/corelight_cip_io.yaml",
    "Parsers/corelight_cluster.yaml",
    "Parsers/corelight_config.yaml",
    "Parsers/corelight_corelight_ad_admin_shares.yaml",
    "Parsers/corelight_corelight_ad_ew_servers_services.yaml",
    "Parsers/corelight_corelight_ad_exe_files.yaml",
    "Parsers/corelight_corelight_ad_ftp_connections.yaml",
    "Parsers/corelight_corelight_ad_http_user_agents.yaml",
    "Parsers/corelight_corelight_ad_ns_servers_services.yaml",
    "Parsers/corelight_corelight_ad_ntlm_auth.yaml",
    "Parsers/corelight_corelight_ad_rdp.yaml",
    "Parsers/corelight_corelight_ad_ssh_clients.yaml",
    "Parsers/corelight_corelight_ad_ssh_connections.yaml",
    "Parsers/corelight_corelight_license_capacity.yaml",
    "Parsers/corelight_corelight_pipeline_test.yaml",
    "Parsers/corelight_dnp3_control.yaml",
    "Parsers/corelight_dnp3_objects.yaml",
    "Parsers/corelight_ecat_aoe_info.yaml",
    "Parsers/corelight_ecat_arp_info.yaml",
    "Parsers/corelight_ecat_coe_info.yaml",
    "Parsers/corelight_ecat_dev_info.yaml",
    "Parsers/corelight_ecat_foe_info.yaml",
    "Parsers/corelight_ecat_log_address.yaml",
    "Parsers/corelight_ecat_registers.yaml",
    "Parsers/corelight_ecat_soe_info.yaml",
    "Parsers/corelight_gena.yaml",
    "Parsers/corelight_genisys.yaml",
    "Parsers/corelight_ldap.yaml",
    "Parsers/corelight_ldap_search.yaml",
    "Parsers/corelight_loaded_scripts.yaml",
    "Parsers/corelight_local_subnets_neighbor.yaml",
    "Parsers/corelight_logschema.yaml",
    "Parsers/corelight_modbus_detailed.yaml",
    "Parsers/corelight_modbus_mask_write_register.yaml",
    "Parsers/corelight_modbus_read_device_identification.yaml",
    "Parsers/corelight_modbus_read_write_multiple_registers.yaml",
    "Parsers/corelight_netcontrol.yaml",
    "Parsers/corelight_netcontrol_drop.yaml",
    "Parsers/corelight_netcontrol_shunt.yaml",
    "Parsers/corelight_notice_alarm.yaml",
    "Parsers/corelight_opcua_binary.yaml",
    "Parsers/corelight_opcua_binary_activate_session.yaml",
    "Parsers/corelight_opcua_binary_activate_session_client_software_cert.yaml",
    "Parsers/corelight_opcua_binary_activate_session_locale_id.yaml",
    "Parsers/corelight_opcua_binary_aggregate_filter.yaml",
    "Parsers/corelight_opcua_binary_browse.yaml",
    "Parsers/corelight_opcua_binary_browse_description.yaml",
    "Parsers/corelight_opcua_binary_browse_request_continuation_point.yaml",
    "Parsers/corelight_opcua_binary_browse_response_references.yaml",
    "Parsers/corelight_opcua_binary_browse_result.yaml",
    "Parsers/corelight_opcua_binary_close_session.yaml",
    "Parsers/corelight_opcua_binary_create_monitored_items.yaml",
    "Parsers/corelight_opcua_binary_create_monitored_items_create_item.yaml",
    "Parsers/corelight_opcua_binary_create_session.yaml",
    "Parsers/corelight_opcua_binary_create_session_discovery.yaml",
    "Parsers/corelight_opcua_binary_create_session_endpoints.yaml",
    "Parsers/corelight_opcua_binary_create_session_user_token.yaml",
    "Parsers/corelight_opcua_binary_create_subscription.yaml",
    "Parsers/corelight_opcua_binary_data_change_filter.yaml",
    "Parsers/corelight_opcua_binary_diag_info_detail.yaml",
    "Parsers/corelight_opcua_binary_event_filter.yaml",
    "Parsers/corelight_opcua_binary_event_filter_attribute_operand.yaml",
    "Parsers/corelight_opcua_binary_event_filter_attribute_operand_browse_paths.yaml",
    "Parsers/corelight_opcua_binary_event_filter_element_operand.yaml",
    "Parsers/corelight_opcua_binary_event_filter_literal_operand.yaml",
    "Parsers/corelight_opcua_binary_event_filter_select_clause.yaml",
    "Parsers/corelight_opcua_binary_event_filter_simple_attribute_operand.yaml",
    "Parsers/corelight_opcua_binary_event_filter_simple_attribute_operand_browse_paths.yaml",
    "Parsers/corelight_opcua_binary_event_filter_where_clause.yaml",
    "Parsers/corelight_opcua_binary_event_filter_where_clause_elements.yaml",
    "Parsers/corelight_opcua_binary_get_endpoints.yaml",
    "Parsers/corelight_opcua_binary_get_endpoints_description.yaml",
    "Parsers/corelight_opcua_binary_get_endpoints_discovery.yaml",
    "Parsers/corelight_opcua_binary_get_endpoints_locale_id.yaml",
    "Parsers/corelight_opcua_binary_get_endpoints_profile_uri.yaml",
    "Parsers/corelight_opcua_binary_get_endpoints_user_token.yaml",
    "Parsers/corelight_opcua_binary_opensecure_channel.yaml",
    "Parsers/corelight_opcua_binary_read.yaml",
    "Parsers/corelight_opcua_binary_read_nodes_to_read.yaml",
    "Parsers/corelight_opcua_binary_read_results.yaml",
    "Parsers/corelight_opcua_binary_status_code_detail.yaml",
    "Parsers/corelight_opcua_binary_variant_array_dims.yaml",
    "Parsers/corelight_opcua_binary_variant_data.yaml",
    "Parsers/corelight_opcua_binary_variant_data_value.yaml",
    "Parsers/corelight_opcua_binary_variant_extension_object.yaml",
    "Parsers/corelight_opcua_binary_variant_metadata.yaml",
    "Parsers/corelight_print.yaml",
    "Parsers/corelight_quic.yaml",
    "Parsers/corelight_s7comm_plus.yaml",
    "Parsers/corelight_s7comm_read_szl.yaml",
    "Parsers/corelight_s7comm_upload_download.yaml",
    "Parsers/corelight_ssdp.yaml",
    "Parsers/corelight_telnet.yaml",
    "Parsers/corelight_websocket.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/CorelightAbnormalEmailSubject.yaml",
    "Hunting Queries/CorelightCompressedFilesTransferredOverHTTP.yaml",
    "Hunting Queries/CorelightDataTransferedByIp.yaml",
    "Hunting Queries/CorelightExternalServices.yaml",
    "Hunting Queries/CorelightFilesSeen.yaml",
    "Hunting Queries/CorelightFilesTransferedByIp.yaml",
    "Hunting Queries/CorelightMultipleRemoteSMBConnectionsFromSingleIP.yaml",
    "Hunting Queries/CorelightObfuscatedBinary.yaml",
    "Hunting Queries/CorelightRarePOST.yaml",
    "Hunting Queries/CorelightRepetitiveDnsFailures.yaml"
  ],
  "BasePath": "C:/Github/Azure-Sentinel/Solutions/Corelight",
  "Version": "3.3.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "Is1Pconnector": false
}