Firewall configuration¶

Corelight Investigator requires two types of network connectivity, each with different firewall requirements:

Sensor log ingest: Your sensors send log data to Investigator through Amazon Kinesis Data Streams over HTTPS (port 443). Kinesis uses AWS-managed IP addresses that cover broad ranges and can change over time, so allowing outbound HTTPS traffic to the regional Kinesis DNS endpoint is usually the simplest approach.

For regional Kinesis endpoints, see the AWS help topic Amazon Kinesis Data Streams endpoints and quotas. If your firewall requires IP-based rules rather than DNS-based rules, see AWS IP address ranges.
Alert export: When Investigator exports alerts to external systems (such as your SIEM), it connects from the following Corelight IP addresses. If your firewall restricts inbound traffic, create a rule to allow HTTPS (port 443) traffic from the source IP addresses for your region.