Splunk + Corelight Integration | Corelight

Corelight evidence in Splunk

Learn how Corelight makes investigations faster in this example with DNS activity:

Starting at the Splunk Enterprise Security dashboard, explore network notables…

Pivot to the Corelight Suricata log using Corelight's Unique Identifier (UID) to see if any alerts fired. Next pivot to the notice.log…

The notice.log shows a possible exploit. The same UID links to the connection.log for further investigation.

An analyst can then look for further context in the connection.log, and pivot again to the DNS log…

On the DNS log, tunneling to pirate.sea is evident. From here the analyst can block the domain with a firewall and notify their forensics team for investigation.