{
  "id": "CorelightConnectorExporter",
  "title": "Corelight Connector Exporter",
  "publisher": "Corelight",
  "descriptionMarkdown": "The [Corelight](https://corelight.com/) data connector enables incident responders and threat hunters who use Microsoft Sentinel to work faster and more effectively. The data connector enables ingestion of events from [Zeek](https://zeek.org/) and [Suricata](https://suricata.io/) via Corelight Sensors into Microsoft Sentinel using the Azure Monitor Logs Ingestion API. Events are sent by the Corelight Sensor to a Data Collection Endpoint (DCE) and routed into dedicated `Corelight_v3_*_CL` tables by per-log-type Data Collection Rules (DCRs).",
  "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**Corelight**](https://aka.ms/sentinel-Corelight-parser) which is deployed with the Microsoft Sentinel Solution.",
  "graphQueries": [
    {
      "metricName": "Total data received",
      "legend": "Corelight",
      "baseQuery": "Corelight"
    }
  ],
  "sampleQueries": [
    {
      "description": "Top 10 Clients (Source IP)",
      "query": "Corelight\n\t| summarize count() by id_orig_h\n\t| top 10 by count_"
    },
    {
      "description": "Connection events over the last 24 hours",
      "query": "Corelight_v3_conn_CL\n\t| where TimeGenerated > ago(24h)\n\t| summarize count() by bin(TimeGenerated, 1h)"
    },
    {
      "description": "Log types currently being ingested",
      "query": "union withsource=TableName Corelight_v3_*_CL\n\t| summarize EventCount = count(), LastReceived = max(TimeGenerated) by TableName\n\t| sort by EventCount desc"
    }
  ],
  "dataTypes": [
    {
      "name": "corelight_amqp",
      "lastDataReceivedQuery": "Corelight_v3_amqp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_analyzer",
      "lastDataReceivedQuery": "Corelight_v3_analyzer_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_anomaly",
      "lastDataReceivedQuery": "Corelight_v3_anomaly_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_asset_classification",
      "lastDataReceivedQuery": "Corelight_v3_asset_classification_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_bacnet",
      "lastDataReceivedQuery": "Corelight_v3_bacnet_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_bacnet_device_control",
      "lastDataReceivedQuery": "Corelight_v3_bacnet_device_control_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_bacnet_discovery",
      "lastDataReceivedQuery": "Corelight_v3_bacnet_discovery_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_bacnet_property",
      "lastDataReceivedQuery": "Corelight_v3_bacnet_property_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_broker",
      "lastDataReceivedQuery": "Corelight_v3_broker_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_bsap_ip_header",
      "lastDataReceivedQuery": "Corelight_v3_bsap_ip_header_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_bsap_ip_rdb",
      "lastDataReceivedQuery": "Corelight_v3_bsap_ip_rdb_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_bsap_ip_unknown",
      "lastDataReceivedQuery": "Corelight_v3_bsap_ip_unknown_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_bsap_serial_header",
      "lastDataReceivedQuery": "Corelight_v3_bsap_serial_header_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_bsap_serial_rdb",
      "lastDataReceivedQuery": "Corelight_v3_bsap_serial_rdb_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_bsap_serial_rdb_ext",
      "lastDataReceivedQuery": "Corelight_v3_bsap_serial_rdb_ext_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_bsap_serial_unknown",
      "lastDataReceivedQuery": "Corelight_v3_bsap_serial_unknown_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_capture_loss",
      "lastDataReceivedQuery": "Corelight_v3_capture_loss_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_cip",
      "lastDataReceivedQuery": "Corelight_v3_cip_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_cip_identity",
      "lastDataReceivedQuery": "Corelight_v3_cip_identity_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_cip_io",
      "lastDataReceivedQuery": "Corelight_v3_cip_io_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_cluster",
      "lastDataReceivedQuery": "Corelight_v3_cluster_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_config",
      "lastDataReceivedQuery": "Corelight_v3_config_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_conn",
      "lastDataReceivedQuery": "Corelight_v3_conn_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_conn_agg",
      "lastDataReceivedQuery": "Corelight_v3_conn_agg_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_conn_long",
      "lastDataReceivedQuery": "Corelight_v3_conn_long_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_conn_red",
      "lastDataReceivedQuery": "Corelight_v3_conn_red_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_ad_admin_shares",
      "lastDataReceivedQuery": "Corelight_v3_corelight_ad_admin_shares_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_ad_ew_servers_services",
      "lastDataReceivedQuery": "Corelight_v3_corelight_ad_ew_servers_services_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_ad_exe_files",
      "lastDataReceivedQuery": "Corelight_v3_corelight_ad_exe_files_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_ad_ftp_connections",
      "lastDataReceivedQuery": "Corelight_v3_corelight_ad_ftp_connections_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_ad_http_user_agents",
      "lastDataReceivedQuery": "Corelight_v3_corelight_ad_http_user_agents_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_ad_ns_servers_services",
      "lastDataReceivedQuery": "Corelight_v3_corelight_ad_ns_servers_services_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_ad_ntlm_auth",
      "lastDataReceivedQuery": "Corelight_v3_corelight_ad_ntlm_auth_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_ad_rdp",
      "lastDataReceivedQuery": "Corelight_v3_corelight_ad_rdp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_ad_ssh_clients",
      "lastDataReceivedQuery": "Corelight_v3_corelight_ad_ssh_clients_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_ad_ssh_connections",
      "lastDataReceivedQuery": "Corelight_v3_corelight_ad_ssh_connections_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_burst",
      "lastDataReceivedQuery": "Corelight_v3_corelight_burst_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_license_capacity",
      "lastDataReceivedQuery": "Corelight_v3_corelight_license_capacity_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_metrics_disk",
      "lastDataReceivedQuery": "Corelight_v3_corelight_metrics_disk_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_metrics_iface",
      "lastDataReceivedQuery": "Corelight_v3_corelight_metrics_iface_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_metrics_memory",
      "lastDataReceivedQuery": "Corelight_v3_corelight_metrics_memory_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_metrics_system",
      "lastDataReceivedQuery": "Corelight_v3_corelight_metrics_system_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_metrics_zeek_doctor",
      "lastDataReceivedQuery": "Corelight_v3_corelight_metrics_zeek_doctor_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_overall_capture_loss",
      "lastDataReceivedQuery": "Corelight_v3_corelight_overall_capture_loss_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_pipeline_test",
      "lastDataReceivedQuery": "Corelight_v3_corelight_pipeline_test_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_corelight_profiling",
      "lastDataReceivedQuery": "Corelight_v3_corelight_profiling_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_cotp",
      "lastDataReceivedQuery": "Corelight_v3_cotp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_datared",
      "lastDataReceivedQuery": "Corelight_v3_datared_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_dce_rpc",
      "lastDataReceivedQuery": "Corelight_v3_dce_rpc_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_dga",
      "lastDataReceivedQuery": "Corelight_v3_dga_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_dhcp",
      "lastDataReceivedQuery": "Corelight_v3_dhcp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_dnp3",
      "lastDataReceivedQuery": "Corelight_v3_dnp3_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_dnp3_control",
      "lastDataReceivedQuery": "Corelight_v3_dnp3_control_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_dnp3_objects",
      "lastDataReceivedQuery": "Corelight_v3_dnp3_objects_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_dns",
      "lastDataReceivedQuery": "Corelight_v3_dns_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_dns_agg",
      "lastDataReceivedQuery": "Corelight_v3_dns_agg_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_dns_red",
      "lastDataReceivedQuery": "Corelight_v3_dns_red_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_dpd",
      "lastDataReceivedQuery": "Corelight_v3_dpd_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ecat_aoe_info",
      "lastDataReceivedQuery": "Corelight_v3_ecat_aoe_info_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ecat_arp_info",
      "lastDataReceivedQuery": "Corelight_v3_ecat_arp_info_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ecat_coe_info",
      "lastDataReceivedQuery": "Corelight_v3_ecat_coe_info_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ecat_dev_info",
      "lastDataReceivedQuery": "Corelight_v3_ecat_dev_info_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ecat_foe_info",
      "lastDataReceivedQuery": "Corelight_v3_ecat_foe_info_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ecat_log_address",
      "lastDataReceivedQuery": "Corelight_v3_ecat_log_address_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ecat_registers",
      "lastDataReceivedQuery": "Corelight_v3_ecat_registers_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ecat_soe_info",
      "lastDataReceivedQuery": "Corelight_v3_ecat_soe_info_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_encrypted_dns",
      "lastDataReceivedQuery": "Corelight_v3_encrypted_dns_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_enip",
      "lastDataReceivedQuery": "Corelight_v3_enip_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_enip_debug",
      "lastDataReceivedQuery": "Corelight_v3_enip_debug_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_enip_list_identity",
      "lastDataReceivedQuery": "Corelight_v3_enip_list_identity_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_etc_viz",
      "lastDataReceivedQuery": "Corelight_v3_etc_viz_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_files",
      "lastDataReceivedQuery": "Corelight_v3_files_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_files_agg",
      "lastDataReceivedQuery": "Corelight_v3_files_agg_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_files_red",
      "lastDataReceivedQuery": "Corelight_v3_files_red_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_first_seen",
      "lastDataReceivedQuery": "Corelight_v3_first_seen_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ftp",
      "lastDataReceivedQuery": "Corelight_v3_ftp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_gena",
      "lastDataReceivedQuery": "Corelight_v3_gena_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_generic_dns_tunnels",
      "lastDataReceivedQuery": "Corelight_v3_generic_dns_tunnels_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_generic_icmp_tunnels",
      "lastDataReceivedQuery": "Corelight_v3_generic_icmp_tunnels_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_genisys",
      "lastDataReceivedQuery": "Corelight_v3_genisys_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_http",
      "lastDataReceivedQuery": "Corelight_v3_http_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_http2",
      "lastDataReceivedQuery": "Corelight_v3_http2_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_http_agg",
      "lastDataReceivedQuery": "Corelight_v3_http_agg_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_http_red",
      "lastDataReceivedQuery": "Corelight_v3_http_red_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_icmp_specific_tunnels",
      "lastDataReceivedQuery": "Corelight_v3_icmp_specific_tunnels_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_intel",
      "lastDataReceivedQuery": "Corelight_v3_intel_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ipsec",
      "lastDataReceivedQuery": "Corelight_v3_ipsec_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_irc",
      "lastDataReceivedQuery": "Corelight_v3_irc_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_iso_cotp",
      "lastDataReceivedQuery": "Corelight_v3_iso_cotp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_kerberos",
      "lastDataReceivedQuery": "Corelight_v3_kerberos_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_known_certs",
      "lastDataReceivedQuery": "Corelight_v3_known_certs_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_known_devices",
      "lastDataReceivedQuery": "Corelight_v3_known_devices_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_known_domains",
      "lastDataReceivedQuery": "Corelight_v3_known_domains_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_known_hosts",
      "lastDataReceivedQuery": "Corelight_v3_known_hosts_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_known_names",
      "lastDataReceivedQuery": "Corelight_v3_known_names_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_known_remotes",
      "lastDataReceivedQuery": "Corelight_v3_known_remotes_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_known_services",
      "lastDataReceivedQuery": "Corelight_v3_known_services_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_known_users",
      "lastDataReceivedQuery": "Corelight_v3_known_users_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ldap",
      "lastDataReceivedQuery": "Corelight_v3_ldap_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ldap_search",
      "lastDataReceivedQuery": "Corelight_v3_ldap_search_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_loaded_scripts",
      "lastDataReceivedQuery": "Corelight_v3_loaded_scripts_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_local_subnets",
      "lastDataReceivedQuery": "Corelight_v3_local_subnets_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_local_subnets_dj",
      "lastDataReceivedQuery": "Corelight_v3_local_subnets_dj_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_local_subnets_graphs",
      "lastDataReceivedQuery": "Corelight_v3_local_subnets_graphs_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_local_subnets_neighbor",
      "lastDataReceivedQuery": "Corelight_v3_local_subnets_neighbor_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_log4shell",
      "lastDataReceivedQuery": "Corelight_v3_log4shell_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_logschema",
      "lastDataReceivedQuery": "Corelight_v3_logschema_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_modbus",
      "lastDataReceivedQuery": "Corelight_v3_modbus_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_modbus_detailed",
      "lastDataReceivedQuery": "Corelight_v3_modbus_detailed_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_modbus_mask_write_register",
      "lastDataReceivedQuery": "Corelight_v3_modbus_mask_write_register_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_modbus_read_device_identification",
      "lastDataReceivedQuery": "Corelight_v3_modbus_read_device_identificatio_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_modbus_read_write_multiple_registers",
      "lastDataReceivedQuery": "Corelight_v3_modbus_read_write_multiple_regis_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_mqtt_connect",
      "lastDataReceivedQuery": "Corelight_v3_mqtt_connect_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_mqtt_publish",
      "lastDataReceivedQuery": "Corelight_v3_mqtt_publish_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_mqtt_subscribe",
      "lastDataReceivedQuery": "Corelight_v3_mqtt_subscribe_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_mysql",
      "lastDataReceivedQuery": "Corelight_v3_mysql_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_net_perf",
      "lastDataReceivedQuery": "Corelight_v3_net_perf_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_netcontrol",
      "lastDataReceivedQuery": "Corelight_v3_netcontrol_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_netcontrol_drop",
      "lastDataReceivedQuery": "Corelight_v3_netcontrol_drop_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_netcontrol_shunt",
      "lastDataReceivedQuery": "Corelight_v3_netcontrol_shunt_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_notice",
      "lastDataReceivedQuery": "Corelight_v3_notice_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_notice_alarm",
      "lastDataReceivedQuery": "Corelight_v3_notice_alarm_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ntlm",
      "lastDataReceivedQuery": "Corelight_v3_ntlm_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ntp",
      "lastDataReceivedQuery": "Corelight_v3_ntp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ocsp",
      "lastDataReceivedQuery": "Corelight_v3_ocsp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_activate_session",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_activate_session_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_activate_session_client_software_cert",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_activate_session_cl_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_activate_session_locale_id",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_activate_session_lo_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_aggregate_filter",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_aggregate_filter_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_browse",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_browse_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_browse_description",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_browse_description_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_browse_request_continuation_point",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_browse_request_cont_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_browse_response_references",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_browse_response_ref_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_browse_result",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_browse_result_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_close_session",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_close_session_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_create_monitored_items",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_cm_items_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_create_monitored_items_create_item",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_cm_create_item_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_create_session",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_create_session_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_create_session_discovery",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_create_session_disc_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_create_session_endpoints",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_create_session_endp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_create_session_user_token",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_create_session_user_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_create_subscription",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_create_subscription_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_data_change_filter",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_data_change_filter_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_diag_info_detail",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_diag_info_detail_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_event_filter",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_event_filter_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_event_filter_attribute_operand",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_event_filter_attrib_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_event_filter_attribute_operand_browse_paths",
      "lastDataReceivedQuery": "Corelight_v3_opcua_bef_attr_operand_bpaths_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_event_filter_element_operand",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_event_filter_elemen_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_event_filter_literal_operand",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_event_filter_litera_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_event_filter_select_clause",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_event_filter_select_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_event_filter_simple_attribute_operand",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_event_filter_simple_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_event_filter_simple_attribute_operand_browse_paths",
      "lastDataReceivedQuery": "Corelight_v3_opcua_bef_smpl_attr_bpaths_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_event_filter_where_clause",
      "lastDataReceivedQuery": "Corelight_v3_opcua_bef_where_clause_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_event_filter_where_clause_elements",
      "lastDataReceivedQuery": "Corelight_v3_opcua_bef_where_clause_elements_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_get_endpoints",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_get_endpoints_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_get_endpoints_description",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_get_endpoints_descr_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_get_endpoints_discovery",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_get_endpoints_disco_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_get_endpoints_locale_id",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_get_endpoints_local_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_get_endpoints_profile_uri",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_get_endpoints_profi_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_get_endpoints_user_token",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_get_endpoints_user_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_opensecure_channel",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_opensecure_channel_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_read",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_read_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_read_nodes_to_read",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_read_nodes_to_read_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_read_results",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_read_results_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_status_code_detail",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_status_code_detail_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_variant_array_dims",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_variant_array_dims_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_variant_data",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_variant_data_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_variant_data_value",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_variant_data_value_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_variant_extension_object",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_variant_extension_o_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_variant_metadata",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_variant_metadata_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_opcua_binary_write",
      "lastDataReceivedQuery": "Corelight_v3_opcua_binary_write_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_openflow",
      "lastDataReceivedQuery": "Corelight_v3_openflow_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_packet_filter",
      "lastDataReceivedQuery": "Corelight_v3_packet_filter_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_pe",
      "lastDataReceivedQuery": "Corelight_v3_pe_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_postgresql",
      "lastDataReceivedQuery": "Corelight_v3_postgresql_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_print",
      "lastDataReceivedQuery": "Corelight_v3_print_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_profinet",
      "lastDataReceivedQuery": "Corelight_v3_profinet_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_profinet_dce_rpc",
      "lastDataReceivedQuery": "Corelight_v3_profinet_dce_rpc_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_profinet_debug",
      "lastDataReceivedQuery": "Corelight_v3_profinet_debug_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_quic",
      "lastDataReceivedQuery": "Corelight_v3_quic_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_radius",
      "lastDataReceivedQuery": "Corelight_v3_radius_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_rdp",
      "lastDataReceivedQuery": "Corelight_v3_rdp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_redis",
      "lastDataReceivedQuery": "Corelight_v3_redis_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_reporter",
      "lastDataReceivedQuery": "Corelight_v3_reporter_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_rfb",
      "lastDataReceivedQuery": "Corelight_v3_rfb_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_s7comm",
      "lastDataReceivedQuery": "Corelight_v3_s7comm_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_s7comm_known_devices",
      "lastDataReceivedQuery": "Corelight_v3_s7comm_known_devices_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_s7comm_plus",
      "lastDataReceivedQuery": "Corelight_v3_s7comm_plus_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_s7comm_read_szl",
      "lastDataReceivedQuery": "Corelight_v3_s7comm_read_szl_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_s7comm_upload_download",
      "lastDataReceivedQuery": "Corelight_v3_s7comm_upload_download_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_signatures",
      "lastDataReceivedQuery": "Corelight_v3_signatures_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_sip",
      "lastDataReceivedQuery": "Corelight_v3_sip_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_smartpcap",
      "lastDataReceivedQuery": "Corelight_v3_smartpcap_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_smartpcap_stats",
      "lastDataReceivedQuery": "Corelight_v3_smartpcap_stats_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_smb_files",
      "lastDataReceivedQuery": "Corelight_v3_smb_files_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_smb_mapping",
      "lastDataReceivedQuery": "Corelight_v3_smb_mapping_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_smtp",
      "lastDataReceivedQuery": "Corelight_v3_smtp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_smtp_links",
      "lastDataReceivedQuery": "Corelight_v3_smtp_links_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_snmp",
      "lastDataReceivedQuery": "Corelight_v3_snmp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_socks",
      "lastDataReceivedQuery": "Corelight_v3_socks_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_software",
      "lastDataReceivedQuery": "Corelight_v3_software_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_specific_dns_tunnels",
      "lastDataReceivedQuery": "Corelight_v3_specific_dns_tunnels_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ssdp",
      "lastDataReceivedQuery": "Corelight_v3_ssdp_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ssh",
      "lastDataReceivedQuery": "Corelight_v3_ssh_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ssl",
      "lastDataReceivedQuery": "Corelight_v3_ssl_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ssl_agg",
      "lastDataReceivedQuery": "Corelight_v3_ssl_agg_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_ssl_red",
      "lastDataReceivedQuery": "Corelight_v3_ssl_red_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_stats",
      "lastDataReceivedQuery": "Corelight_v3_stats_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_stepping",
      "lastDataReceivedQuery": "Corelight_v3_stepping_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_stun",
      "lastDataReceivedQuery": "Corelight_v3_stun_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_stun_nat",
      "lastDataReceivedQuery": "Corelight_v3_stun_nat_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_suricata_corelight",
      "lastDataReceivedQuery": "Corelight_v3_suricata_corelight_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_suricata_eve",
      "lastDataReceivedQuery": "Corelight_v3_suricata_eve_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_suricata_stats",
      "lastDataReceivedQuery": "Corelight_v3_suricata_stats_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_suricata_zeek_stats",
      "lastDataReceivedQuery": "Corelight_v3_suricata_zeek_stats_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_syslog",
      "lastDataReceivedQuery": "Corelight_v3_syslog_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_tds",
      "lastDataReceivedQuery": "Corelight_v3_tds_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_tds_rpc",
      "lastDataReceivedQuery": "Corelight_v3_tds_rpc_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_tds_sql_batch",
      "lastDataReceivedQuery": "Corelight_v3_tds_sql_batch_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_telemetry",
      "lastDataReceivedQuery": "Corelight_v3_telemetry_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_telnet",
      "lastDataReceivedQuery": "Corelight_v3_telnet_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_traceroute",
      "lastDataReceivedQuery": "Corelight_v3_traceroute_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_tunnel",
      "lastDataReceivedQuery": "Corelight_v3_tunnel_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_unknown_smartpcap",
      "lastDataReceivedQuery": "Corelight_v3_unknown_smartpcap_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_util_stats",
      "lastDataReceivedQuery": "Corelight_v3_util_stats_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_vpn",
      "lastDataReceivedQuery": "Corelight_v3_vpn_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_websocket",
      "lastDataReceivedQuery": "Corelight_v3_websocket_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_weird",
      "lastDataReceivedQuery": "Corelight_v3_weird_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_weird_agg",
      "lastDataReceivedQuery": "Corelight_v3_weird_agg_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_weird_red",
      "lastDataReceivedQuery": "Corelight_v3_weird_red_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_weird_stats",
      "lastDataReceivedQuery": "Corelight_v3_weird_stats_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_wireguard",
      "lastDataReceivedQuery": "Corelight_v3_wireguard_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_x509",
      "lastDataReceivedQuery": "Corelight_v3_x509_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_x509_red",
      "lastDataReceivedQuery": "Corelight_v3_x509_red_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_yara_corelight",
      "lastDataReceivedQuery": "Corelight_v3_yara_corelight_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_yara_error_corelight",
      "lastDataReceivedQuery": "Corelight_v3_yara_error_corelight_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    },
    {
      "name": "corelight_zeek_doctor",
      "lastDataReceivedQuery": "Corelight_v3_zeek_doctor_CL\n\t| summarize Time=max(TimeGenerated)\n\t| where isnotempty(Time)"
    }
  ],
  "connectivityCriterias": [
    {
      "type": "IsConnectedQuery",
      "value": [
        "Corelight_v3_conn_CL\n\t| summarize LastLogReceived = max(TimeGenerated)\n\t| project IsConnected = LastLogReceived > ago(30m)"
      ]
    }
  ],
  "availability": {
    "status": 1,
    "isPreview": false
  },
  "permissions": {
    "resourceProvider": [
      {
        "provider": "Microsoft.OperationalInsights/workspaces",
        "permissionsDisplayText": "read and write permissions are required.",
        "providerDisplayName": "Workspace",
        "scope": "Workspace",
        "requiredPermissions": {
          "write": true,
          "read": true,
          "delete": true
        }
      },
      {
        "provider": "Microsoft.Insights/dataCollectionRules",
        "permissionsDisplayText": "read and write permissions to Data Collection Rules and Data Collection Endpoints are required. [See the documentation to learn more about the Logs Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview).",
        "providerDisplayName": "Data Collection Rules",
        "scope": "Subscription",
        "requiredPermissions": {
          "write": true,
          "read": true,
          "delete": true
        }
      }
    ],
    "customs": [
      {
        "name": "Microsoft Entra ID application",
        "description": "Permission to register an application in Microsoft Entra ID and create a client secret. Typically requires the Application Developer role or higher."
      },
      {
        "name": "Azure role assignment",
        "description": "Permission to assign the **Monitoring Metrics Publisher** role on the deployed Data Collection Rules. Typically requires the Owner or User Access Administrator role on the target resource group."
      },
      {
        "name": "Corelight Sensor access",
        "description": "Administrative access to the Corelight Sensor (or Fleet Manager) to configure the Microsoft Sentinel export."
      }
    ]
  },
  "instructionSteps": [
    {
      "title": "",
      "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**Corelight**](https://aka.ms/sentinel-Corelight-parser) which is deployed with the Microsoft Sentinel Solution.",
      "instructions": []
    },
    {
      "title": "1. Deploy the Corelight data collection resources",
      "description": "Deploy the ARM template that creates the Data Collection Endpoint (DCE), the `Corelight_v3_*_CL` tables, and one Data Collection Rule (DCR) per Corelight log type in your workspace.\n\nUse the button below to deploy the connector resources into the same subscription and resource group as your Microsoft Sentinel workspace.\n\n[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-CorelightExporter-azuredeploy)\n\nWhen prompted, supply:\n\n| Parameter | Value |\n| --- | --- |\n| `workspace` | The **name** of your Log Analytics workspace (not the ID). Maximum **18 characters** -- see the note below |\n| `workspace-location` | The Azure region of the workspace |\n| `resourceId` | The full resource ID of the workspace |\n\nThe deployment creates:\n\n- One Data Collection Endpoint named `dce-corelight-<workspace>`\n- One custom table per Corelight log type, named `Corelight_v3_<log_type>_CL`\n- One Data Collection Rule per log type, named `dcr-corelight-<workspace>-<log_type>`, each tagged with `corelight-log-type`\n\n> **IMPORTANT:** The workspace name must be **18 characters or fewer**. Each Data Collection Rule is named `dcr-corelight-<workspace>-<log_type>` and Azure limits resource names to 64 characters. The longest Corelight log type is 32 characters, so a longer workspace name makes some rule names exceed the limit and the deployment fails preflight validation with `'Name' must be between 1 and 64 characters`. If your workspace name is longer, deploy Microsoft Sentinel on a workspace with a shorter name.\n\n> **NOTE:** The deployment can take several minutes to complete because a large number of tables and rules are created. Wait for it to finish before continuing.",
      "instructions": []
    },
    {
      "title": "2. Register a Microsoft Entra ID application",
      "description": "The Corelight Sensor authenticates to the Logs Ingestion API with a Microsoft Entra ID application. Create the application and a client secret, then record the values.\n\n#### Create the application\n\n1. In the Azure portal, go to **Microsoft Entra ID** > **App registrations** > **New registration**.\n2. Enter a name, for example `Corelight Sentinel Connector`.\n3. Under **Supported account types**, select **Accounts in this organizational directory only**.\n4. Leave **Redirect URI** empty and select **Register**.\n5. On the application **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**.\n\n#### Create a client secret\n\n1. On the application page, go to **Certificates & secrets** > **Client secrets** > **New client secret**.\n2. Enter a description, choose an expiry, and select **Add**.\n3. Copy the secret **Value** immediately. It is shown only once and cannot be retrieved later.\n\nYou now have the **Tenant ID**, **Client ID**, and **Client Secret** required by the Corelight Sensor.\n\nFor more information, see [Register an application with Microsoft Entra ID](https://learn.microsoft.com/entra/identity-platform/quickstart-register-app).",
      "instructions": []
    },
    {
      "title": "3. Grant the application permission to send data",
      "description": "Assign the **Monitoring Metrics Publisher** role so the application can publish to the Data Collection Rules created in step 1.\n\nAssign the role once at the **resource group** scope so it covers every Corelight Data Collection Rule in a single assignment.\n\n1. Go to the resource group that contains the deployed DCE and DCRs.\n2. Select **Access control (IAM)** > **Add** > **Add role assignment**.\n3. On the **Role** tab, search for and select **Monitoring Metrics Publisher**.\n4. On the **Members** tab, choose **User, group, or service principal**, then select the application you registered in step 2.\n5. Select **Review + assign**.\n\n> **NOTE:** Role assignments can take a few minutes to take effect. If the sensor reports authorization errors immediately after assignment, wait and retry.",
      "instructions": []
    },
    {
      "title": "4. Collect the values needed by the Corelight exporter",
      "description": "The Corelight exporter discovers the Data Collection Rules by tag. Collect the Data Collection Endpoint URI, the subscription ID, and confirm the DCR tag and stream name pattern.\n\n#### Data Collection Endpoint URI\n\n1. Go to **Monitor** > **Settings** > **Data Collection Endpoints**.\n2. Select `dce-corelight-<workspace>`.\n3. On the **Overview** page, copy the **Logs ingestion** URI. It has the form `https://dce-corelight-<workspace>-<suffix>.<region>.ingest.monitor.azure.com`.\n\n#### Subscription ID\n\nCopy the ID of the subscription that contains the deployed Data Collection Endpoint and Data Collection Rules.\n\n1. In the Azure portal, search for and open **Subscriptions**.\n2. Select the subscription that contains the deployed resources.\n3. On the **Overview** page, copy the **Subscription ID**.\n\n#### Data Collection Rule log type tag\n\nThe deployment tags every Corelight Data Collection Rule with the log type it accepts. The exporter uses this tag to select the correct DCR for each log, so no immutable ID has to be entered manually.\n\n| Tag | Value |\n| --- | --- |\n| `corelight-log-type` | The Corelight log type, for example `conn`, `dns`, `http` |\n| `solution` | `Corelight` |\n\nTo review the deployed rules and their log types in the portal, go to **Monitor** > **Settings** > **Data Collection Rules** and look for rules named `dcr-corelight-<workspace>-<log_type>`.\n\nYou can also list them with the Azure CLI. Run the commands from **Azure Cloud Shell** in the portal, as described in the section below.\n\n```bash\naz monitor data-collection rule list \\\n  --resource-group <resource-group> \\\n  --query \"[?tags.solution=='Corelight'].{logType:tags.\\\"corelight-log-type\\\", name:name}\" \\\n  --output table\n```\n\n#### Running the Azure CLI commands from the Azure portal\n\nThe Azure CLI commands in this connector can be run directly in the portal using Azure Cloud Shell, with no local installation required.\n\n1. In the Azure portal, select the **Cloud Shell** icon (`>_`) in the top toolbar, or go to [https://shell.azure.com](https://shell.azure.com).\n2. When prompted to choose an environment, select **Bash**. The commands below are written for Bash.\n3. If this is your first time using Cloud Shell, follow the prompt to create or select a storage account.\n4. Confirm you are in the correct subscription, and switch if needed:\n\n   ```bash\n   az account show --output table\n   az account set --subscription \"<subscription-name-or-id>\"\n   ```\n\n5. Add the Data Collection Rule commands, which ship in a CLI extension:\n\n   ```bash\n   az extension add --name monitor-control-service\n   ```\n\n6. Paste the command you want to run, replacing `<resource-group>`, `<workspace>`, and `<log_type>` with your own values.\n\n> **NOTE:** The `az monitor data-collection rule` commands require the `monitor-control-service` extension. If you run them without it, Cloud Shell offers to install the extension automatically the first time.\n\n#### Stream names\n\nEach DCR declares a single stream, named after its destination table:\n\n```\nCustom-<table_name>\n```\n\nFor most log types the table name follows the pattern `Corelight_v3_<log_type>_CL`. For example, the `conn` log type uses the stream `Custom-Corelight_v3_conn_CL` and lands in the table `Corelight_v3_conn_CL`. This is why the exporter **Stream Name** template is set to `Custom-Corelight_v3_$LOG_CL` in the next step.\n\n> **IMPORTANT:** A small number of log types with long names have a shortened table name, because Log Analytics limits table name length. For those log types the stream name is **not** `Custom-Corelight_v3_<log_type>_CL`, and the `$LOG` template does not resolve to the correct stream. See the list in step 5.\n\nTo read the stream name directly from a rule, use the portal under **Monitor** > **Settings** > **Data Collection Rules** > select the rule > **JSON View**, or run:\n\n```bash\naz monitor data-collection rule show \\\n  --resource-group <resource-group> \\\n  --name dcr-corelight-<workspace>-<log_type> \\\n  --query \"keys(streamDeclarations)\" \\\n  --output tsv\n```\n\n#### Data Collection Rule immutable IDs (reference only)\n\nThe exporter resolves rules through the `corelight-log-type` tag, so immutable IDs are not required for configuration. If you need one for troubleshooting or for a direct Logs Ingestion API call, read it in the portal under **Monitor** > **Settings** > **Data Collection Rules** > select the rule > **JSON View** > `immutableId`, or run:\n\n```bash\naz monitor data-collection rule show \\\n  --resource-group <resource-group> \\\n  --name dcr-corelight-<workspace>-conn \\\n  --query immutableId \\\n  --output tsv\n```",
      "instructions": []
    },
    {
      "title": "5. Configure the Azure Sentinel exporter on the Corelight Sensor",
      "description": "Create an Azure Sentinel exporter on the Corelight Sensor or in Fleet Manager, using the values collected in the previous steps. The exporter is configured on the Corelight platform and is documented by Corelight.",
      "instructions": [
        {
          "type": "InstructionStepsGroup",
          "parameters": {
            "title": "Configure the exporter on the Corelight platform",
            "canCollapseAllSections": true,
            "instructionSteps": [
              {
                "title": "Corelight documentation",
                "description": "The exporter is created and managed on the Corelight platform, using the sensor web interface or Fleet Manager. Follow Corelight's own documentation for the exporter creation steps, the supported sensor and Fleet Manager versions, enabling the dynamic exporter option, and uploading a private CA bundle if your deployment requires one:\n\n**[Corelight documentation: Azure Sentinel dynamic exporter](https://docs.corelight.cloud/sensor/export/azure-sentinel-dynamic-exporter.html)**"
              },
              {
                "title": "Before you begin",
                "description": "- Steps 1 to 4 of this connector are complete, and you have the Data Collection Endpoint URI, subscription ID, and application credentials.\n- The sensor or Fleet Manager can reach the Data Collection Endpoint over outbound HTTPS on port 443. If outbound traffic must traverse a proxy, have the proxy URL ready.\n- Your sensor runs a version that supports the Azure Sentinel dynamic exporter, and the dynamic exporter option is enabled. Corelight's documentation lists the required versions and the setting to enable."
              },
              {
                "title": "Values to enter in the exporter",
                "description": "Enter these values when creating the Azure Sentinel exporter. Leave any setting not listed here at its Corelight default unless Corelight advises otherwise.\n\n| Corelight exporter setting | Value to use |\n| --- | --- |\n| Tenant ID | Step 2, application **Directory (tenant) ID** |\n| Client ID | Step 2, application **Application (client) ID** |\n| Client Secret | Step 2, client secret **Value** |\n| Subscription ID | Step 4, the subscription containing the DCE and DCRs |\n| Data Collection Endpoint | Step 4, the **Logs ingestion** URI |\n| DCR Log Type Tag | `corelight-log-type` |\n| Stream Name | `Custom-Corelight_v3_$LOG_CL` |\n\n> **IMPORTANT:** The exporter ships with the default stream name template `Custom-Corelight_v2_$LOG_CL`. This solution creates `v3` tables, so the template must be changed to `Custom-Corelight_v3_$LOG_CL`. Leaving the default in place sends events to streams that do not exist and the data is rejected.\n\nUse the exporter's log type filter to control which Zeek logs are exported. Enable only the log types you intend to ingest.\n\n> **NOTE:** Ingesting a large number of log types increases Microsoft Sentinel data ingestion cost. Review the [Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/) page before enabling the full set."
              },
              {
                "title": "Log types not covered by the stream name template",
                "description": "26 log types have a shortened table name because of the Log Analytics table name length limit, so `Custom-Corelight_v3_$LOG_CL` does not resolve to their stream. To ingest any of these, set the stream name explicitly from the value below rather than relying on the template.\n\n| Log type | Stream name |\n| --- | --- |\n| `modbus_read_device_identification` | `Custom-Corelight_v3_modbus_read_device_identificatio_CL` |\n| `modbus_read_write_multiple_registers` | `Custom-Corelight_v3_modbus_read_write_multiple_regis_CL` |\n| `opcua_binary_activate_session_client_software_cert` | `Custom-Corelight_v3_opcua_binary_activate_session_cl_CL` |\n| `opcua_binary_activate_session_locale_id` | `Custom-Corelight_v3_opcua_binary_activate_session_lo_CL` |\n| `opcua_binary_browse_request_continuation_point` | `Custom-Corelight_v3_opcua_binary_browse_request_cont_CL` |\n| `opcua_binary_browse_response_references` | `Custom-Corelight_v3_opcua_binary_browse_response_ref_CL` |\n| `opcua_binary_create_monitored_items` | `Custom-Corelight_v3_opcua_binary_cm_items_CL` |\n| `opcua_binary_create_monitored_items_create_item` | `Custom-Corelight_v3_opcua_binary_cm_create_item_CL` |\n| `opcua_binary_create_session_discovery` | `Custom-Corelight_v3_opcua_binary_create_session_disc_CL` |\n| `opcua_binary_create_session_endpoints` | `Custom-Corelight_v3_opcua_binary_create_session_endp_CL` |\n| `opcua_binary_create_session_user_token` | `Custom-Corelight_v3_opcua_binary_create_session_user_CL` |\n| `opcua_binary_event_filter_attribute_operand` | `Custom-Corelight_v3_opcua_binary_event_filter_attrib_CL` |\n| `opcua_binary_event_filter_attribute_operand_browse_paths` | `Custom-Corelight_v3_opcua_bef_attr_operand_bpaths_CL` |\n| `opcua_binary_event_filter_element_operand` | `Custom-Corelight_v3_opcua_binary_event_filter_elemen_CL` |\n| `opcua_binary_event_filter_literal_operand` | `Custom-Corelight_v3_opcua_binary_event_filter_litera_CL` |\n| `opcua_binary_event_filter_select_clause` | `Custom-Corelight_v3_opcua_binary_event_filter_select_CL` |\n| `opcua_binary_event_filter_simple_attribute_operand` | `Custom-Corelight_v3_opcua_binary_event_filter_simple_CL` |\n| `opcua_binary_event_filter_simple_attribute_operand_browse_paths` | `Custom-Corelight_v3_opcua_bef_smpl_attr_bpaths_CL` |\n| `opcua_binary_event_filter_where_clause` | `Custom-Corelight_v3_opcua_bef_where_clause_CL` |\n| `opcua_binary_event_filter_where_clause_elements` | `Custom-Corelight_v3_opcua_bef_where_clause_elements_CL` |\n| `opcua_binary_get_endpoints_description` | `Custom-Corelight_v3_opcua_binary_get_endpoints_descr_CL` |\n| `opcua_binary_get_endpoints_discovery` | `Custom-Corelight_v3_opcua_binary_get_endpoints_disco_CL` |\n| `opcua_binary_get_endpoints_locale_id` | `Custom-Corelight_v3_opcua_binary_get_endpoints_local_CL` |\n| `opcua_binary_get_endpoints_profile_uri` | `Custom-Corelight_v3_opcua_binary_get_endpoints_profi_CL` |\n| `opcua_binary_get_endpoints_user_token` | `Custom-Corelight_v3_opcua_binary_get_endpoints_user_CL` |\n| `opcua_binary_variant_extension_object` | `Custom-Corelight_v3_opcua_binary_variant_extension_o_CL` |"
              },
              {
                "title": "Getting help",
                "description": "- For questions about the exporter itself, sensor or Fleet Manager configuration, supported versions, CA bundles, or exporter errors reported by the sensor, contact your Corelight TAM or SE, or Corelight support at [info@corelight.com](mailto:info@corelight.com).\n- If the exporter reports success but no data reaches the workspace, the issue is usually on the Azure side. Confirm the role assignment from step 3, the Data Collection Endpoint URI, and the stream name, then continue to step 6."
              }
            ]
          }
        }
      ]
    },
    {
      "title": "6. Verify data ingestion",
      "description": "Confirm that events from the Corelight Sensor are arriving in your workspace.\n\nAllow 5 to 15 minutes after configuring the exporter for the first events to appear, then run the following queries in **Logs**.\n\nCheck which Corelight tables are receiving data:\n\n```kusto\nunion withsource=TableName Corelight_v3_*_CL\n| summarize EventCount = count(), LastReceived = max(TimeGenerated) by TableName\n| sort by LastReceived desc\n```\n\nCheck connection events specifically:\n\n```kusto\nCorelight_v3_conn_CL\n| take 10\n```\n\nConfirm connectivity:\n\n```kusto\nCorelight_v3_conn_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(30m)\n```\n\nIf no data appears, check the following on the Azure side:\n\n- The **Monitoring Metrics Publisher** role assignment from step 3 exists at the resource group scope and has taken effect. Role assignments can take several minutes to propagate.\n- The **Data Collection Endpoint** value in the exporter matches the **Logs ingestion** URI from step 4.\n- The exporter **Stream Name** template is `Custom-Corelight_v3_$LOG_CL` and not the `v2` default, and any log type listed in step 5 as having a shortened stream name is configured with its explicit stream name.\n- The **DCR Log Type Tag** is `corelight-log-type`, and the rules for the log types you enabled exist in the resource group.\n\nIf the values above are correct and the sensor still reports export errors, contact Corelight support as described in step 5.",
      "instructions": []
    }
  ]
}