Configuring and managing SIEM connectors

Coro integrates with Security Information and Event Management (SIEM) platforms and provides real-time access to ticket data, enabling integration with existing workflows.

Coro supports the following integrations:

• Fluency
• Generic webhook integrations
• Microsoft Sentinel
• Splunk

Managing SIEM connectors

After you configure a connector, Coro monitors its connection to the SIEM provider. If the endpoint becomes unavailable, Coro waits two hours before retrying the connection. If the retry fails, Coro disconnects the connector and updates its status to Disconnected:

Use the three-dot menu of a configured connector to:

• Edit: Modify the configuration settings of the connector.

• Delete: Delete the connector configuration.

  For MSP channel workspaces, Coro deletes the connector from the channel workspace and all connected descendant workspaces.

• Sync: Manually retry the connector configuration by sending a test event to verify connectivity with the SIEM provider.

Example of a Coro ticket data structure

The following example shows the JSON structure Coro sends to SIEM platforms for a Domain Impersonation ticket:

{
  "id": "OLvX-1479",
  "workspaceId": "coronmicrosofteom_OLvX_b",
  "ticketType": "emailPhishing",
  "ticketDetails": {
    "affectedUser": "user1.test@myyahoo.com",
    "service": "office365Enforcement",
    "locations": [],
    "emailMetadata": {
      "subject": "test",
      "senderEmail": "user1.test@myyahoo.com",
      "senderIp": "192.0.2.0",
      "recipients": [
        "testuser1@coro.onmicrosoft.com"
      ],
      "processedMessages": [
        {
          "messageId": "AAkALgAAAAAAHYQD6EapmEc2byAcQAC-Elv8AklmbFzgKuZeaN9sWir-hpwwAB8FbapwAA"
        }
      ]
    },
    "filesMetadata": [],
    "firstEventTime": 1713774078429,
    "lastEventTime": 1713774078429,
    "creationTime": 1713774078447,
    "processed": true,
    "processedTime": 1713774078429,
    "ticketTrigger": "domainImpersonation"
  }
}