Ingest logs from Corelight Zeek - Extend Cortex Cloud visibility into logs from Corelight Zeek. - Administrator Guide - Cortex CLOUD

If you use Corelight Zeek sensors for network monitoring, you can still take advantage of Cortex Cloud investigation and detection capabilities by forwarding your network connection logs to Cortex Cloud. This enables Cortex Cloud to examine your network traffic to detect anomalous behavior. Cortex Cloud can use Corelight Zeek logs as the sole data source, but can also use logs in conjunction with Palo Alto Networks or third-party firewall logs. For additional endpoint context, you can also use Cortex Cloud to collect and alert on endpoint data.

As soon as Cortex Cloud starts to receive logs, the app can begin stitching network connection logs with other logs to form network stories. Cortex Cloud can also analyze your logs to generate Analytics issues, and can apply IOC, BIOC, and Correlation Rule matching. You can also use queries to search your network connection logs.

To integrate your logs, you first need to set up an applet in a Broker VM within your network to act as a Syslog Collector. You then configure forwarding on your Corelight Zeek sensors (using the default Syslog export option of RFC5424 over TCP) to send logs to the Syslog Collector.