Alert & Agentic Triage Exports¶

Stream alerts and Agentic Triage reports from Investigator directly into your SIEM.

Use the Alert & Agentic Triage Exports feature to stream network security data from Corelight Investigator into your SIEM platform. You can export alerts, a continuous stream of individual security findings from your enabled detection rules, and, if your tenant has Agentic Triage enabled, Agentic Triage reports, pre-analyzed threat assessments for your highest-risk entities. You can export one or both types per exporter.

For many security teams, a SIEM is the starting point for daily investigations. By exporting Corelight data, your team can see high-fidelity network findings alongside data from endpoint, identity, and other security tools, then pivot back to Investigator for deep-dive analysis when needed.

Understand alerts vs. detections¶

Before you begin, it’s important to understand the difference between the data you export and the findings you see in the Investigator UI. You might notice Investigator showing 60 detections, but your SIEM receives 6,000 events. This is expected.

Alerts: The raw, individual security indicators generated by your enabled detection rules. The exporter sends a continuous stream of every alert.
Detections: The aggregated findings you see in the Investigator UI. Investigator groups hundreds or even thousands of related alerts into a single, high-level detection to reduce noise.

This one-to-many relationship is key: one detection in the UI represents many underlying alerts. The exporter sends the alerts, giving your SIEM the most detailed data possible.

Understand Agentic Triage¶

If your tenant has Agentic Triage enabled, you can also export pre-analyzed threat assessment reports alongside your alert stream.

Agentic Triage is an automated investigation capability that runs daily and analyzes up to 10 of your highest-risk entities. It uses Corelight’s Lux AI to correlate detections, execute expert-authored playbooks, and produce a report with supporting evidence for each entity. Each report includes:

An AI confidence verdict: Needs human review, Suspicious, Likely benign, or Undetermined.
A detailed assessment with key findings and evidence citations.
Recommended next steps.

Exporting these reports gives your SOC a higher-fidelity, lower-volume queue alongside the raw alert stream. When you configure the export, you choose which verdicts to include, so your SIEM receives only the reports that match your team’s triage priorities.

Alerts and Agentic Triage reports differ in frequency and size. Alerts can be generated at any time and are approximately 5 KB each. Agentic Triage reports are generated once per day, with up to 10 reports created per cycle, and are approximately 80 KB each. For details on how Agentic Triage selects and analyzes entities, see Investigate threats using Agentic Triage.

Note

An exported Agentic Triage report may appear more than once in your SIEM. To deduplicate, use the report_id field as a unique identifier when ingesting reports.

For the full Agentic Triage workflow, see Investigate threats using Agentic Triage.

Choose your export type¶

When you configure an exporter, you select one or both Export Types:

Alerts: A continuous stream of every alert from your enabled detection rules. This is the default.
Agentic Triage: Pre-analyzed threat assessment reports for your highest-risk entities.

You have three options:

Alerts only: The exporter sends raw alerts. This is the existing default behavior.
Agentic Triage only: The exporter sends only Agentic Triage reports.
Both: The exporter sends alerts and Agentic Triage reports to the same destination.

You can also create separate exporters for each type if you prefer to manage them independently. The Export Type column on the exports list shows which types are active for each configured exporter.

Note

Agentic Triage export requires the GPT (Private data) integration to be enabled. If GPT (Private data) is not enabled for your tenant, the Agentic Triage option does not appear in the exporter configuration panel. See GPT integrations for details.

Filter Agentic Triage reports by verdict¶

When you enable the Agentic Triage export type, an Agentic Triage Report Configurations section appears in the exporter panel. Select one or more Lux AI verdicts to control which reports are sent to your SIEM:

Needs human review: The AI identified significant risk indicators that warrant immediate investigation.
Suspicious: The AI identified activity that warrants investigation but could not reach a high-confidence conclusion.
Likely benign: The AI reviewed the detections and found evidence supporting a non-malicious explanation.

Reports with an Undetermined verdict are not available for export.

How the alert export works¶

The alert export is designed for one main job: streaming all your alert data to an external system. Here’s a simple breakdown of what it does and doesn’t do.

What it does	What it doesn’t do
Streams all alerts: Sends a complete, unfiltered stream of every alert from your enabled analytics in near real-time.	Filter alerts: Cannot send only a subset of alerts. If a rule is turned on, its alerts will be sent.
Includes full details: Exports contain the full event record. This can include the full `Suricata` payload if that option is enabled on your sensor. For a complete reference, see the Alert export schema.	Send summarized detections: Only sends the raw alerts. It cannot send the aggregated detection objects that you see in the UI.
Sends to multiple places: You can set up multiple exporters to send the same data to different destinations (for example, Splunk and CrowdStrike).

When to use the API instead of the alert export¶

The alert exporter is the most common method for sending data to a SIEM. However, you should use the Investigator API if you need more control over the data being sent.

Choose the API if your goal is to:

Filter alerts before sending: The Alerts API lets you pull only the alerts that match specific criteria you define, such as severity or time range. In contrast, the exporter sends an unfiltered stream of all enabled alerts.
Get summarized detections: The Detections API is the only way to pull the aggregated findings that you see in the Investigator UI. This is ideal for creating a lower-volume feed that mirrors the UI or for use in automation playbooks.

For more information, see the Investigator API.

Work with exported alerts in your SIEM¶

Once alerts flow into your SIEM, you can use the data in the following ways:

Group alerts to see the bigger picture¶

To manage the high volume of raw alerts, you can group them using the same logic as Investigator. The simple recipe below helps you turn a stream of individual events into more meaningful findings.

The correlation recipe

To replicate the way Investigator groups alerts, combine the following two fields in your SIEM:

Concept	Field Name
Source IP	`alert_entity.entity_name`
Rule ID	`alert_info.content_id`

Example: Grouping alerts in Splunk

The following search counts the raw alerts associated with each unique combination of a source IP and rule ID.

sourcetype="corelight-investigator" | stats count by alert_entity.entity_name, alert_info.content_id

sourcetype="corelight-investigator": Starts with your Corelight data.
| stats count: Uses the stats command to count the number of events.
by alert_entity.entity_name, alert_info.content_id: Groups the counts by the Source IP and Rule ID fields.

Pivot from your SIEM back to Investigator¶

Every exported alert includes a powerful workflow feature: the alert-to-detection-url field. This is a direct link from the raw alert in your SIEM back to the full, correlated detection in the Corelight Investigator UI. By making this URL a clickable link in your SIEM, an analyst can instantly pivot from a single piece of evidence to the complete investigative picture.

Explore data with dashboards and reports¶

The exported data is structured and includes rich metadata like source/destination IPs, ports, and MITRE ATT&CK® tactics. Use these fields in your SIEM to build dashboards, reports, and visualizations to track trends and security posture. Many integrations, like the one for CrowdStrike Falcon Next-Gen SIEM, automatically populate pre-built Corelight dashboards for you.

Manage exports¶

As an admin user, you have full control over exports on the Integrations page. Analyst users can view configured exports but cannot make changes.

Admins can:

Configure one or more exporters: You can export to multiple destinations, including multiple instances of the same platform (for example, a test and a production Splunk instance).
Choose export types per exporter: Each exporter can send Alerts, Agentic Triage reports, or both. The Export Type column on the exports list shows what each exporter is configured to send.
Edit, disable, or delete an exporter: Once an exporter is configured, click its name to open a side panel with management options.

Important

Potential for duplicate alerts

If you have already configured log exports directly on one or more of your Corelight Sensors, be aware that exporting alerts from Investigator will duplicate some notice and Suricata alerts.

Set up an export¶

To set up an export, select one of the guides linked below. Each guide provides step-by-step instructions for connecting Investigator to a specific platform.

Once configured, you can use the data to power SIEM dashboards, correlate Corelight findings with other security events, and create a unified triage workflow.