Corelight
It all comes down to the data: unlocking the potential of AI in the SOC
An AI-powered SOC must leverage exceptional best-in-class data quality to succeed. Corelight pursues three strategies to deliver it.
Corelight Bright Ideas Blog
This is the Custom Rich Text module
Feel free to edit this text to reflect your unique voice and message. Tell visitors what you do, why you do it, and what sets you apart.
- All
- Zeek
- Network Security Monitoring
- network security
- featured
- NDR
- network detection response
- Corelight
- cybersecurity
- network traffic analysis
- network visibility
- Bro
- SOC
- Corelight Labs
- Richard Bejtlich
- Product
- SIEM
- open source
- Announcements
- threat hunting
- BlackHat
- Industry
- Suricata
- Splunk
- DNS
- PCAP
- TLS
- open source community
- Corelight Sensor
- NSM
- Partnership
- HTTP
- MITRE ATT&CK
- GitHub
- Incident response
- network evidence
- Zeek Logs
- encrypted traffic
- SSH
- microsoft
- encrypted traffic collection
- JSON
- Detection
- IDS
- NOC
- command and control
- encryption
- ja3
- AWS
- HTTPS
- SSL
Corelight
Black Hat USA 2025: A grab bag and a half
From plaintext chat leaks to unencrypted SIP and LLM jailbreaks, the Black Hat USA 2025 NOC saw it all.
Mark Overholser
Sep 29, 2025
Corelight
Hunting GTPDOOR: The case of the "Black Hat Positive"
Recapping our learnings from the Black Hat NOC, using packet captures and Zeek scripting to decode threat payloads.
Ben Reardon
Sep 29, 2025
Corelight
Back in the Black Hat NOC: A familiar mission, a new crew
What stood out this year was the sheer volume of insecure application traffic. Corelight uncovered an unsecured corporate messaging app leaking...
Blake Cahen
Sep 29, 2025
Corelight
How to level up your technical documentation with Microsoft's style guide and LLMs
Speed up technical documentation with the open-source llm-styleguide-helper. It pairs Vale linting and AI to fix Microsoft Style Guide violations in...
Keith J. Jones
Sep 16, 2025
Corelight
Corelight data and LLMs
Accelerate alert analysis with Corelight’s LLM prompts for Suricata and Corelight data, featuring summaries, threat analysis, and next steps.
Stan Kiefer
Jul 31, 2025
Corelight
Corelight announces industry's first MCP server exposing detailed network data and alerts
Introducing the industry's first MCP server, enabling AI agents to securely query network data directly from your SIEM.
Ashish Malpani
Jul 31, 2025
Corelight
Unlock peak performance: hardware deduplication for enhanced network visibility
Optimize NDR performance and reduce costs with hardware-based deduplication, seamlessly integrated into your sensor workflow.
Varun Bobhate
Jul 28, 2025
Corelight
Data driven detection: Corelight’s approach to AI-powered NDR
Learn how Corelight combines Zeek data, ML, and GenAI workflows to fuel threat hunting, accelerate incident response, and disrupt advanced network...
Brian Dye
Jul 2, 2025
network detection response
Empowering your LLMs: Unlocking cybersecurity queries with Open WebUI knowledge bases
Learn how to use Open WebUI knowledge bases to enhance your LLMs with private, local cybersecurity data for better queries, analysis, and incident...
Keith J. Jones
Jul 2, 2025