Corelight Bright Ideas Blog: NDR & Threat Hunting Blog

Unparalleled Visibility and Threat Detection for SSE Environments

By Ed Smith – September 10, 2024

As organizations embrace digital transformation, security teams face growing challenges in maintaining visibility across diverse on-prem, cloud, and hybrid environments. With the rapid adoption of Secure Access Service Edge (SASE) and Security... Read more »

Dual Defenses: 9 Reasons Why Open NDR Is Essential Alongside NGFW

By Ed Smith – March 1, 2024

Securing a network against the myriad of evolving cyber threats requires more than just a robust firewall or endpoint protection platform; it demands a multifaceted approach. Corelight’s Open Network Detection and Response (NDR) Platform complements... Read more »

Dual Defenses: 10 Reasons Why NDR Is Essential Alongside EDR

By Ed Smith – January 10, 2024

Editor’s Note (May 2025): This post has been updated to highlight how the Volt Typhoon and Salt Typhoon cyber-espionage campaigns exemplify that EDR evasion is real and why Network Detection and Response (NDR) is essential in modern defense... Read more »

Key takeaways from RSA 2023: #BetterTogether and AI in security

By Ed Smith – May 8, 2023

Whether or not you made it to RSA 2023, here are two key themes we saw throughout this year’s conference. Read more »

Explore Corelight evidence in Humio Community Edition

By Ed Smith – April 19, 2022

Now available: A free and easy way to learn about Humio and Corelight. Read more »

Microsoft + Corelight partner to stop IoT attacks

By Ed Smith – November 2, 2021

When you hear the term “Internet of Things,” (IoT) do you picture home devices like lightbulbs, smart assistants, and wifi-connected refrigerators? Perhaps you think of enterprise devices like video conferencing systems, smart sensors, or security... Read more »

Take the Corelight challenge: Splunk’s Boss of the SOC

By Ed Smith – October 18, 2021

Looking for some threat hunting and incident response practice that's more game than work? Check out the new Capture the Flag (CTF) challenges from Corelight, now available on Splunk’s Boss of the SOC (BOTS) website - just in time for .conf! Read more »

Corelight ECS mapping: Unified Zeek data for more efficient analytics

By Ed Smith – January 27, 2020

In addition to other great news we’ve recently shared, I’m pleased to announce that Corelight sensors now support the Elastic Common Schema (ECS) via our Corelight ECS Mapping. Read more »

New Corelight app for Splunk: Making network-based threat hunting easier

By Ed Smith – November 18, 2019

Want to use Zeek (formerly Bro) network data in Splunk ES, but don’t know how to start or where to look? Read more »