Using Corelight-update to update a sensor running on the same host¶
If Corelight-update is installed on the same host as a microsensor, no network connectivity information is needed. The only requirement is to define the local path where the files will be placed for the sensor. Any package bundles will not be moved, they will just get installed.
sensors:
- name: # sensor name
type: localhost
intel_path: "/etc/corelight/intel/intel.dat" # microsensors and localhost ONLY
input_path: "/etc/corelight/input_files/" # microsensors and localhost ONLY
suricata_path: "/etc/corelight/rules/suricata.rules" # microsensors and localhost ONLY
bundle_path: "/etc/corelight/corelight.bundle" # microsensors ONLY