Export alerts and Agentic Triage reports to Elastic SIEM

Important

The Corelight Investigator export feature is currently not compatible with Elastic Datastreams. You must use a standard Elastic index as the destination to prevent export failures.

Integrate Corelight Investigator (Investigator) with your Elastic instance to send network security alerts and Agentic Triage reports directly to an Elastic index. This allows for centralized monitoring, search, and analysis of Corelight data within your existing Elastic environment.

  • Alerts: A continuous stream of individual security alerts from your enabled detection rules.

  • Agentic Triage reports: Pre-analyzed, evidence-backed threat assessments produced by Corelight’s Lux AI for your highest-risk entities. Each report includes a confidence verdict, supporting evidence, and recommended next steps.

For details on both export types, see Alert & Agentic Triage Exports.

Prerequisites

Before you begin, ensure you have the following:

  • Elastic: An active Elastic Cloud account or a self-managed Elastic Stack deployment.

  • Corelight: An operational Corelight Investigator instance.

  • Permissions:

    • In Elastic: A username and password with permission to ingest data into the target index.

    • In Investigator: Administrator privileges are required to configure exports. Analyst-level users can only view existing configurations.

  • Firewall configuration:

    If your firewall restricts inbound traffic, create a rule to allow HTTPS (port 443) traffic from the Corelight Investigator source IP addresses for your region. These addresses are for alert export only. For sensor log ingest firewall requirements, see Firewall configuration.

    Region

    Source IP (CIDR)

    North America (us-west-2)

    198.29.17.0/29

    Europe (eu-central-1)

    198.29.22.0/29

    Middle East (me-central-1)

    198.29.23.0/29

Important

  • Alert duplication: If you have already configured log exports from Corelight Sensors managed by this Investigator instance, be aware that exporting alerts directly from Investigator may result in duplicate notice and Suricata alerts in Elastic.

  • The Elastic user interface and configuration steps are subject to change by Elastic. This guide is based on the interface at the time of publication.

Step 1: Configure an endpoint in Elastic

First, you need to prepare your Elastic instance to receive the alerts.

  1. Within your Elastic environment, set up a data ingestion endpoint. This can be a connector or an HTTP input.

  2. From your Elastic configuration, you’ll need to note three key pieces of information for the next step:

    1. The data ingestion URL.

    2. The Username and Password for authentication.

    3. The destination Index name where the alerts will be stored.

See the Elastic documentation for the most current instructions on creating data ingestion endpoints.

Step 2: Configure the exporter in Investigator

Next, use the details from Elastic to configure the connection in Investigator.

  1. In the Investigator UI, navigate to System Settings | Integrations.

  2. Click the Exports tab.

  3. Click the Elastic tile to open the Elastic Exporter configuration panel.

  4. Toggle the Enabled switch to the On position.

  5. Under Export Type, select one or both of the following:

    • Alerts. Exports all alerts from your enabled detection rules. This is the default.

    • Agentic Triage. Exports Agentic Triage reports. Requires the GPT (Private data) integration to be enabled.

    You can configure each exporter to send alerts only, Agentic Triage reports only, or both. When you select both, alerts and Agentic Triage reports are sent to the same destination. The Export Type column on the exports list shows which types are active for each exporter.

    Note

    The Export Type selector only appears when the GPT (Private data) integration is enabled for your tenant. If GPT (Private data) is not enabled, the exporter sends alerts only, which is the existing default behavior.

  6. Provide a descriptive Name for the exporter.

  7. Enter the URL, Username, Password, and Index from your Elastic instance.

  8. Optionally, enable Verify SSL (recommended). This ensures a secure connection by verifying the certificate and hostname provided by the exporter. If you enable this option, the certificate must be current, issued by a trusted issuer, and the hostname must be present in the certificate.

  9. If you selected Agentic Triage, configure the Agentic Triage Report Configurations section. Under Select Lux verdicts to send, select one or more verdicts to include in the export:

    • Needs human review. High-risk entities that require immediate investigation.

    • Suspicious. Entities with activity that warrants investigation.

    • Likely benign. Entities where the AI found evidence supporting a non-malicious explanation.

    Note

    An exported Agentic Triage report may appear more than once in your SIEM. To deduplicate, use the report_id field as a unique identifier when ingesting reports.

  10. Click Save.

Step 3: Verify the connection

Confirm alerts are sent successfully from Investigator to Elastic.

  1. Wait for a new alert to be generated in Investigator.

  2. In the Elastic UI, navigate to the Discover tab.

  3. Choose the data view corresponding to the index you configured.

  4. Use the search bar and time filter to locate the new alert.

If the alert appears in your Elastic index, the integration is working correctly. It may take 5-10 minutes for the data to initially appear in dashboards.

Step 4: Use the data in Elastic

Once data is successfully flowing into your Elastic index, use Elastic’s native tools to analyze it.