Corelight DefeNDRs
Gain clear, actionable intelligence from Corelight's network defense experts. Corelight DefeNDRs translates complex cybersecurity detection challenges into concise, practical episodes designed to support faster, smarter decision-making across modern security teams.
All Episodes
Episode 27 - Building Zeek's Community: Support, AI, and Real-World Use
Richard Bejtlich sits down with Michelle Pathe, Zeek's community liaison, to explore how Zeek stays open, supportive, and useful for practitioners. They discuss Michelle's role bridging maintainers and users, a CERN workshop that connected security teams across Europe, how Zeek gathers feedback without relying on telemetry, and the community’s approach to real-world use cases, training, and content that helps defenders get unstuck. They also cover plans for Berkeley workshops and how AI tools are reshaping how the Zeek ecosystem provides help while emphasizing accuracy and trusted information. The conversation highlights why building a strong, responsive community and practical resources matters for defenders who rely on Zeek to detect and understand threats in complex networks.Episode 26 - Zeek at 30: The Measure-First Mindset That Shaped Zeek (Part 2)
Richard Bejtlich sits down with Vern Paxson to celebrate Zeek's 30th anniversary and explore the discipline of measurement that underpins modern network visibility. They discuss the tension between configuration and data mindsets, why there is no such thing as a typical network, and how open source and community funding helped Zeek become a durable research and security resource. Vern reflects on the empirical discipline he brings from physics, the impact of AI tools on Zeek development, and practical guidance for researchers and practitioners navigating rapid change. The conversation also touches on NSF support, the evolution of Zeek as a project, and what motivates long-term work in instrumentation and telemetry.Episode 25 - Zeek at 30: Vern Paxson on Origins and Enduring Logs (Part 1)
Richard Bejtlich sits down with Vern Paxson, Corelight co-founder and Chief Scientist, to explore Zeek's 30-year journey from a Berkeley Lab research project to a data-rich backbone of modern NDR. They unpack how Zeek evolved from early TCP health measurements into a flexible, scriptable network analysis platform, the value of neutral, long-term logs over real-time alerts, comparisons to intrusion-detection approaches like Snort, and the challenges and opportunities of visibility in enterprise gear. The conversation also touches on the origins of libpcap, tcpdump, and BPF, the role of academia in building enduring tooling, and what this history means for defenders aiming to understand and defend today’s networks.Episode 24 - Speaking Security So Leaders, Boards, and Buyers Actually Listen
In this episode, Richard Bejtlich talks with Julie Parrish, CMO at Corelight, about how security professionals can communicate more effectively with CISOs, boards, and buyers who each measure success differently. Julie explains why practitioners should frame requests in terms of risk instead of raw technology, why CISOs need to connect security investments to reputation, compliance, and business continuity, and why marketers lose credibility when they lean on buzzwords, analogies, or FUD instead of clarity and education. The conversation also explores persona-based messaging, the value of expert-led content, and how AI-driven search is changing the way security companies think about discoverability and trust. For anyone trying to influence decisions in security, this episode is a practical look at how better communication leads to better outcomes.