CONTACT US
forrester wave report 2023

Forrester rates Corelight a strong performer

GET THE REPORT

ad-nav-crowdstrike

Corelight now powers CrowdStrike solutions and services

READ MORE

ad-images-nav_0013_IDS

Alerts, meet evidence.

LEARN MORE ABOUT OUR IDS SOLUTION

ad-images-nav_white-paper

5 Ways Corelight Data Helps Investigators Win

READ WHITE PAPER

glossary-icon

10 Considerations for Implementing an XDR Strategy

READ NOW

ad-images-nav_0006_Blog

Don't trust. Verify with evidence

READ BLOG

ad-nav-NDR-for-dummies

NDR for Dummies

GET THE WHITE PAPER

video

The Power of Open-Source Tools for Network Detection and Response

WATCH THE WEBCAST

ad-nav-ESG

The Evolving Role of NDR

DOWNLOAD THE REPORT

ad-images-nav_0006_Blog

Detecting 5 Current APTs without heavy lifting

READ BLOG

g2-medal-best-support-ndr-winter-2024

Network Detection and Response

SUPPORT OVERVIEW

 

World’s first 100G Zeek sensor

As we finished rolling out Corelight’s v21 software release, which saw the delivery of the world’s first 100G, 1U Zeek sensor, I was reminded of when I’d first read the “100G Intrusion Detection” paper written in 2015 at Berkeley Lab. The paper described the challenges they had getting to 100G Zeek processing in a cluster of servers, and this week I was struck by just how far we’ve come in the time since that paper was written. 

With the Corelight AP 5000 Sensor, we’ve delivered the world’s first 100G Zeek sensor, all in a 1 rack unit (RU) form factor. It’s a feat of physics, and a feat of engineering, putting as much silicon and electronics into the smallest form factor as possible while driving 100G speeds for both ingest AND processing while keeping fan speeds below lift-off rates! Indeed, the AP 5000 delivers maximum performance in the most compact form factor available on the market. 

This is important, namely because we see NDR workloads increasing across the industry. First, we’re seeing more and more Zeek packages developed by the open source community and by Corelight that customers want to deploy. We’ve also seen a common design paradigm where SOCs run Suricata to decorate Zeek log data ahead of arrival at the SIEM, and we added support for this functionality in recent product releases via a novel Zeek/Suricata data integration model and sensor CPU design architecture.. And new content arriving from the Corelight Labs team in our v21 release (15 RDP inferences and over 50 C2 detections and insights) – it was clear we needed to offer an updated platform to enable newer use cases or enhance existing ones. 

If you need 100G physical connections, the AP 5000 has you covered with two for monitoring/ingestion. Like all Corelight appliances, customers can manage the AP 5000 through Fleet Manager, a powerful pane of centralized configuration glass that is pure Corelight innovation. Whatever you can do on an AP 1001 or AP 3000, you can do more with an AP 5000, whether your security requirements are driving high throughput today, or whether you’re planning ahead for network growth. 

Last, if you’re looking for a platform that scales, the AP 5000 is it. It’ll generate Zeek logs, run any number of packages – Zeek or Content – and Suricata, while delivering the highest performance our portfolio has to offer. This is useful for deployments and SOCs where more than 10Gbps of monitoring is needed, particularly while running content and packages and/or Suricata – not to mention  new Corelight content and packages expected over the coming months.

“The world’s first 100G Zeek sensor in a 1RU form factor” remains a powerful message for me to think about, and have the privilege to say and evangelize. As a long time network architect,  I’ve always enjoyed working with vendors who give me as many “tools” in the proverbial toolbox as possible; it allows me to build my network the way I see fit, and not make compromises. The AP 5000 provides that rich set of tools and it’ll handle all the packages and content we have today, with plenty of horsepower left over for what’s next. We’ve come a long way from where the original white paper for “100G Zeek” started; delivering a compact 1RU that allows any natively-sized session on the 100G connection to flow where it may without being chopped up; and marrying it with Corelight-sourced advantages like Fleet Manager for simplified GUI configuration. 

I’m excited for what lies ahead for the AP 5000, and what new use cases you might think to solve with it.

 

Recent Posts