Export alerts and Agentic Triage reports using the generic HTTP exporter

• Alerts: A continuous stream of individual security alerts from your enabled detection rules.

• Agentic Triage reports: Pre-analyzed, evidence-backed threat assessments produced by Corelight’s Lux AI for your highest-risk entities. Each report includes a confidence verdict, supporting evidence, and recommended next steps.

For details on both export types, see Alert & Agentic Triage Exports.

To configure an export to a generic HTTP exporter in Investigator

1. From System Settings in the left navigation, choose Integrations and click the Exports tab.

2. Click HTTP Exporter.

3. Toggle on Enabled.

4. Under Export Type, select one or both of the following:

   • Alerts: Exports all alerts from your enabled detection rules (default).

   • Agentic Triage: Exports Agentic Triage reports. Requires the GPT (Private data) integration to be enabled.

   You can configure each exporter to send alerts only, Agentic Triage reports only, or both. When you select both, alerts and Agentic Triage reports are sent to the same destination. The Export Type column on the exports list shows which types are active for each exporter.

   Note

   The Export Type selector only appears when the GPT (Private data) integration is enabled for your tenant. If GPT (Private data) is not enabled, the exporter sends alerts only, which is the existing default behavior.

5. Provide a name for the exporter.

6. Provide the URL for your exporter.

7. Specify the authentication type.

   • None.

   • Basic. Provide a username and password for authentication.

   • Bearer. Provide a token value for authentication.

8. Optionally, add custom headers in the key/value format.

   You can add one or more custom headers to export additional information. Each header must have a key (without spaces) and a corresponding value.

9. Optionally, enable Verify SSL to verify the certificate and hostname provided by the exporter.

   If you enable this option, the certificates must be current and not expired and must be issued by a trusted issuer. Additionally, the hostname used to connect to the remote host must be present in the TLS certificate presented by the remote host, either as the Common Name or as an entry in the Subject Alternative Name extension.

10. If you selected Agentic Triage, configure the Agentic Triage Report Configurations section. Under Select Lux verdicts to send, select one or more verdicts to include in the export:

    • Needs human review: High-risk entities that require immediate investigation.

    • Suspicious: Entities with activity that warrants investigation.

    • Likely benign: Entities where the AI found evidence supporting a non-malicious explanation.

    Note

    An exported Agentic Triage report may appear more than once in your SIEM. To deduplicate, use the report_id field as a unique identifier when ingesting reports.

11. Click Save.