Export alerts and Agentic Triage reports to Splunk HEC SIEM

You can export alerts and Agentic Triage reports from Corelight Investigator (Investigator) directly to a Splunk HTTP Event Collector (Splunk HEC) instance. This integration allows you to forward data for analysis within your Splunk environment. The process requires configuring a HEC instance in Splunk and then setting up the export integration in Investigator.

  • Alerts: A continuous stream of individual security alerts from your enabled detection rules.

  • Agentic Triage reports: Pre-analyzed, evidence-backed threat assessments produced by Corelight’s Lux AI for your highest-risk entities. Each report includes a confidence verdict, supporting evidence, and recommended next steps.

For details on both export types, see Alert & Agentic Triage Exports.

Prerequisites

  • Splunk: An operational Splunk Cloud or Splunk Enterprise instance.

  • Corelight: An operational Corelight Investigator instance.

  • Permissions and credentials:

    • Splunk permissions: A user role with permission to create and manage HEC tokens and indexes.

    • Splunk HEC Credentials: You must have the HEC URL and Token available from your Splunk instance.

    • Investigator permissions: You must have administrator access in Corelight Investigator to configure exports. Analyst-level users can only view existing configurations.

  • Firewall configuration:

    If your firewall restricts inbound traffic, create a rule to allow HTTPS (port 443) traffic from the Corelight Investigator source IP addresses for your region. These addresses are for alert export only. For sensor log ingest firewall requirements, see Firewall configuration.

    Region

    Source IP (CIDR)

    North America (us-west-2)

    198.29.17.0/29

    Europe (eu-central-1)

    198.29.22.0/29

    Middle East (me-central-1)

    198.29.23.0/29

Important

  • Alert Duplication: Be aware that if you have already configured log export on one or more sensors, exporting alerts from Investigator will duplicate some notice and Suricata alerts.

  • The Splunk user interface and configuration steps are subject to change by Splunk. This guide is based on the interface at the time of publication.

Step 1: Configure the HTTP Event Collector in Splunk

Enable the HTTP Event Collector (HEC) in your Splunk instance and create a new token to obtain the Token and URL required for the Investigator configuration.

For complete, step-by-step instructions on this process, see the Splunk documentation: Enable HTTP Event Collector.

Step 2: Configure the exporter in Investigator

After you have the HEC Token and URL from Splunk, follow these steps in Investigator.

  1. From System Settings in the left navigation, choose Integrations and click the Exports tab.

  2. Click Splunk HEC.

  3. Toggle Enabled to the On position.

  4. Under Export Type, select one or both of the following:

    • Alerts. Exports all alerts from your enabled detection rules. This is the default.

    • Agentic Triage. Exports Agentic Triage reports. Requires the GPT (Private data) integration to be enabled.

    You can configure each exporter to send alerts only, Agentic Triage reports only, or both. When you select both, alerts and Agentic Triage reports are sent to the same destination. The Export Type column on the exports list shows which types are active for each exporter.

    Note

    The Export Type selector only appears when the GPT (Private data) integration is enabled for your tenant. If GPT (Private data) is not enabled, the exporter sends alerts only, which is the existing default behavior.

  5. Provide a Name for the exporter.

  6. Provide the following information about your HEC instance:

    1. URL: Enter the API URL generated when setting up the new connector in Splunk. Investigator automatically removes the /services/collector path if included. For example, https://<splunk-url-info>.splunkcloud.com is a valid entry.

    2. Token: Enter the API key (token) generated when setting up the new connector in Splunk.

    3. Splunk Index: Enter a value for the destination index.

  7. Optionally, enable Verify SSL (recommended). This ensures a secure connection by verifying the certificate and hostname provided by the exporter. If you enable this option, the certificate must be current, issued by a trusted issuer, and the hostname must be present in the certificate.

  8. If you selected Agentic Triage, configure the Agentic Triage Report Configurations section. Under Select Lux verdicts to send, select one or more verdicts to include in the export:

    • Needs human review. High-risk entities that require immediate investigation.

    • Suspicious. Entities with activity that warrants investigation.

    • Likely benign. Entities where the AI found evidence supporting a non-malicious explanation.

    Note

    An exported Agentic Triage report may appear more than once in your SIEM. To deduplicate, use the report_id field as a unique identifier when ingesting reports.

  9. Click Save.

Step 3: Verify the connection

After saving the exporter, confirm that data is flowing correctly from Investigator to Splunk.

  1. Wait for a new alert to be generated naturally within Corelight Investigator.

  2. In Splunk, navigate to the Search & Reporting app.

  3. Run a search query to find your data, specifying the index you configured for the HEC token.

    index="your_index_name" sourcetype="_json"

You should see new JSON-formatted events from Corelight alerts appear in the search results. This confirms the connection is working.

Step 4: Use the data in Splunk

Once data is flowing into Splunk, you can use the Splunk Search Processing Language (SPL) to search, visualize, and create dashboards. You can build panels that correlate Corelight’s rich network data with other log sources or create custom dashboards and alerts to monitor for specific threats identified by Corelight’s detection packages.

For more information, see the Splunk documentation.