---
url: https://docs.realmsec.info/integration/corelight_ndr.md
---

# Corelight NDR Integration

![Corelight NDR Architecture](../images/corelight_ndr_diagram.png)

### Send Corelight NDR Logs to Realm

This guide walks you through connecting [Corelight NDR](https://corelight.com/) to Realm. The integration uses a collector-based approach — a Realm Collector is deployed inside your network alongside the Corelight sensors, receives JSON log exports from Corelight, and forwards them through your data pipeline to your configured destination.

## Prerequisites

* Active Corelight NDR deployment with administrative access
* Access to the Realm Security console
* A Realm Collector installed and running within the same network segment that receives log traffic from your Corelight sensors. See the [Realm Collector install guide](/integration/collector) for setup instructions.
* The IP address or FQDN of the Realm Collector host
* The receiving port number assigned to the Corelight NDR stream (found in **Collectors > select collector** after creating the stream below)

## Setup Corelight NDR Source in Realm

1. Log in to the Realm console.
2. Go to **Sources > Add > Corelight NDR** and add a new Source.
   > **Name:** `Corelight NDR`\
   > **Description:** `Corelight NDR logs`
3. If a collector is already set up, go to **Collectors** and select your collector. If not, go to **Collectors > Add** and give it a name and description.
4. Add a Corelight NDR stream to the Collector. Click **Add Stream**.
   > **Product Format:** `Corelight NDR`\
   > **Source:** `Corelight NDR`
5. Click **Add Stream**.
6. Take note of the port assigned to the Corelight NDR stream. You will need it when configuring Corelight to forward logs to the Realm Collector.

## Configure Corelight NDR Log Export

Follow Corelight's documentation to export logs in JSON format, directing output to the IP address or FQDN of your Realm Collector on the port assigned to the Corelight NDR stream above.

> **Note:** The Realm Collector must be reachable from the Corelight sensors over the network. Ensure any firewalls or security groups between the sensors and the Collector allow TCP traffic on the assigned port.

## Support

If you encounter any issues or require assistance, contact Realm Security support.