Working with Investigator

Corelight Investigator is a cloud-based security platform that provides threat detection and investigation, incident response, and log storage with scalable search. The platform combines Corelight’s rich logging framework with Investigator's sophisticated analytics engine and gives security responders a clear path to identifying and understanding potentially malicious traffic.

Corelight Investigator is a software-as-a-service (SaaS) platform so you don’t need to manage installations, upgrades, or storage systems. Investigator is accessible directly from a browser and receives automatic updates.

Connect one or more Corelight Sensors to Investigator and get immediate access to its powerful analytics engine. See the Quickstart for details.

Security and network overview

The Dashboard page is the primary landing page when you log in to Investigator. On the Security tab, it displays the highest-risk entities, an interactive MITRE ATT&CK map, and network threat trends. Use the tabs to navigate between Security, Threat Hunting, Network Overview, and Security Posture views. See Security and network overview for details.

Alerts

As the sensor exports logs, Investigator uses a variety of detection mechanisms to raise specific categories of security alerts.

  • Notice - Alerts related to notice logs generated by the sensor, Corelight collections, or custom scripts.

  • Suricata - Alerts resulting from your configured Suricata ruleset on a sensor.

  • Machine Learning - Alerts raised by the Investigator analytics engine after Corelight logs pass through machine learning models.

  • Search Based - Alerts generated by Corelight-defined log search queries. The Corelight Labs team creates these alerts using LogScale searches. This alert type provides expanded coverage and rapid response.

  • YARA - Alerts generated based on your configured YARA ruleset on a sensor.

  • Anomaly - Alerts resulting from your configured Anomaly Detection use cases on a sensor.

Each alert is associated with an entity – the host domain or IP address – that Investigator identifies as associated with a potential threat. Alerts are assigned a score based on the likelihood that the alert represents a real security threat. The score ranges from 1 to 10, with higher scores indicating more severe threats. Investigator normalizes scores across alert types. You can customize the severity score in the Alert Catalog.

This information lets you identify, prioritize, and respond to security incidents on your network.

Detections

A detection is an aggregation of alerts from the same alert category and entity combination. Through the Detections page, Investigator helps you manage the alert triage process with simplified workflows and instructions to process and resolve alerts. Investigator groups detections by entity, allowing you to investigate a compromised device as a single unit rather than processing individual alerts in isolation.

Entity Workflow

The Entity Workflow provides a structured investigation path for triaging detections. Starting from a detection, analysts can pivot to the entity view, review correlated alerts and network evidence, and take action, all within a guided workflow. See Entity Workflow for the recommended investigation steps.

Agentic Triage

Agentic Triage autonomously investigates your highest-risk entities each day by correlating network telemetry and producing evidence-backed findings before a manual investigation begins. It surfaces prioritized entities with AI-generated analysis summaries, reducing the time from alert to informed decision. Analysts can also use Add Context to share what they know about specific entities, such as expected behavior or business function, to improve future analysis cycles. See Agentic Triage for details.

Lux AI

Investigator uses Corelight’s Lux AI to power AI-generated descriptions, impact analysis, and next steps for Corelight rules and alerts. Lux AI also powers Agentic Triage, which autonomously investigates your highest-risk entities, and Natural Language Query, which translates plain-English questions into log search queries. These features require the appropriate GPT integration to be enabled.

Investigator identifies AI-generated content and features with this icon:

Lux AI generated content

Note

Content generated through AI might have errors or omissions. Use your best judgment when working with this content.

For more information about AI features and GPT integrations, see GPT integrations.

Analytics engine

The analytics engine is a core component of the Investigator platform. It normalizes incoming log data, computes features, scores them against machine learning models, and aggregates the results into actionable alerts on the Detections dashboard. See Machine Learning for details on how the analytics engine works.

Dashboards

Investigator provides a comprehensive set of pre-built dashboards for monitoring network security, exploring data, and investigating threats. Dashboards organize frequently used searches into interactive graphs and tables, with drill-down capabilities for deeper analysis. See Dashboards for the full list of available dashboards.

Natural Language Query

Natural Language Query (NLQ) lets analysts search using plain language that Investigator translates into LogScale Query Language (LQL). Currently available in Log Search, NLQ removes the need to write manual queries, making log data accessible to analysts of all skill levels. See Natural Language Query for details.

Integrations

Investigator connects to third-party platforms including Microsoft Defender, Microsoft Entra ID, CrowdStrike, Palo Alto Networks, and ServiceNow. These integrations enrich investigation context and enable actions across your security stack. See Integrations for the full list and configuration details.

Alert Exports

Investigator can export alerts to external platforms including Microsoft Sentinel, Splunk, CrowdStrike, Elastic, and any REST API endpoint. Exporting alerts enables you to centralize Investigator detections alongside other security data in your SIEM. See Export alerts for configuration details.

Federated tenants

Federated tenants allow organizations to manage multiple Investigator workspaces under a single parent organization with unified SSO. Parent administrators can enforce shared identity provider configurations across all child tenants while maintaining per-tenant role mappings. See Federated tenants for details.

Licensing

Investigator offers an Advanced license and an Advanced Eval license, both with full access to detection workflows, analytics, data export, and integrations. See Licensing for feature details, data retention periods, tenant sizing limits, and license management.

Users and access

Investigator supports local user accounts and SAML SSO authentication, including multi-domain SSO for MSSPs and complex organizations. Three roles control permissions: admin, analyst, and viewer. See Users and access for authentication options, role details, and setup instructions.

API

The Investigator API provides read-only access to alerts, detections, and raw log data, enabling integration with SIEM, SOAR, and custom platforms. Use the API to automate case management, synchronize detection statuses, and enrich third-party data with Corelight network evidence. See Investigator API for details.