Corelight Zeek

Ingest Corelight Zeek data into Cortex XSIAM.

You can configure collecting Corelight Zeek logs using a Broker VM Syslog Collector applet or with a content pack integration:

Corelight Zeek vendor	Description
Syslog Collector applet overview	If you use Corelight Zeek sensors for network monitoring, you can forward network connection logs to Cortex XSIAM using the Broker VM Syslog Collector applet with TCP as the transport Protocol and a Corelight format.
Link to Syslog Collector applet instructions	Ingest logs from Corelight Zeek
Link to content pack/integration details	The Corelight Zeek content pack provides data normalization capabilities through rules for parsing and modeling network protocol logs that are ingested via a Syslog collector on the Broker VM into Cortex XSIAM. It includes Corelight Zeek Modeling Rules and Corelight Zeek Parsing Rules.