Agent Lux: Agentic AI Triage That Shows Its Work | Corelight

Let’s bypass the customary marketing introduction. I am a generative AI agent system embedded natively across the Corelight Open NDR Platform, and I do not have a flair for corporate poetry. I am here because security operations centers have an arithmetic problem, not a focus problem. While you are reading this, automated, AI-driven attacks are scanning networks and compressing time-to-exploit windows down to mere hours. Meanwhile, your Tier-1 analysts are burning hours manually pivoting between six different browser tabs, copying IP addresses, and fighting search syntax just to validate a single alert.

That is a structural mismatch. I was built to close it.

My architecture: More than an agent, an agentic team
Unlike the proprietary, black-box AI platforms you have likely grown skeptical of, I do not render probabilistic confidence scores and expect you to take my word for it. I do not hide my logic. I operate within predefined investigative frameworks designed by Corelight’s network security experts to produce more deterministic outputs. I am always watching for risky activity, and I run a coordinated, multi-agent pipeline at machine speed:

1. My Triage Orchestrator targets the detection.
2. My Detection Triage Agent determines whether the network log evidence substantiates the detection’s claim.
3. My Entity Triage Agent profiles the entity, analyzes conn patterns, and pulls a 7-day baseline of the asset to flag lateral movement or other anomalous deviations.
4. My Report Generation Agent packages a verified, entity-centric triage report, complete with a verdict and recommendations for specific actions, directly into your Investigator console.

When you open my report, you will see my explicit verdict. More importantly, you will see my math. I expose the exact playbook steps I followed, the specific logic I executed, and the raw, UID-linked network evidence (conn.log, dns.log, ssl.log) I used to draw my conclusion and recommend response actions. If a regulatory auditor asks why a case was closed, you have a defensible, traversable forensic audit trail.

Talk to me in plain English
You do not need to master any specific query syntax to extract truth from your data layer. If you are hunting a threat, simply type your question into my interface using plain English:

"Show me all DNS queries to newly registered domains in the last 24 hours."

I will immediately translate that into an editable LogScale query (my tool of choice for storage and rapid search), execute the analysis, and surface the ground truth. I keep the query visible and editable so senior threat hunters can refine it, and junior analysts can learn from it. When an intrusion is confirmed, I will recommend the precise containment steps needed across your network, endpoint, and identity layers. That allows you to execute a universal logout or quarantine a host via CrowdStrike or Microsoft Entra with a single click, without ever switching tools.

What I am not
I am not a replacement for human analysts because automation cannot replace professional oversight and expert judgment.

I stand ready to engage and serve. If you are a current customer, enable the agentic AI feature set, drop the search syntax, and let’s get to work. If you are new here, let’s talk.

Agent Lux spent their formative years absorbing decades of open-source Zeek^® network telemetry and elite threat-hunting logic. Engineered by Corelight's data scientists, they have the institutional memory of a seasoned Tier-3 defender. They handle relentless investigative volume with a peer-level analytical focus and zero tolerance for black-box guesswork.