Corelight Bright Ideas Blog: NDR & Threat Hunting Blog

Black Hat NOC: Findings from Europe & thoughts for Asia 2024

By Dustin Lee – April 5, 2024

How quickly a year passes. 2023 was Corelight’s first year participating in the Black Hat Network Operations Center (NOC). It was a tremendous opportunity and responsibility in which we collaborated with teams from Cisco, Palo Alto Networks, Arista,... Read more »

Black Hat NOC USA 2023: A tale of sharp needles in a stack of dull needles

By Ben Reardon – September 15, 2023

During Black Hat 2023 in Las Vegas, our Corelight team worked effectively and speedily with our first-rate Black Hat NOC partners Arista, Cisco, Lumen, NetWitness and Palo Alto Networks. I was fortunate enough to be a member of the NOC team at the... Read more »

Detecting Gozi Banking Malware

By Keith J. Jones – September 7, 2023

As a principal security researcher on Corelight’s Labs team, I help to solve difficult network security research problems at scale. Corelight’s customers might recognize some of my work if you see the packages “VPN Insights” or “App ID” on your... Read more »

Detections and Findings using Corelight in the Black Hat Asia NOC

By Dustin Lee – August 3, 2023

As promised, we wanted to dedicate a blog to detections and findings from the network operations center (NOC) at Black Hat Asia 2023 as a follow up to our Lessons Learned blog. Some of these discoveries may not surprise the seasoned analyst or... Read more »

Detecting Storm-0558 using Corelight evidence

By Chris Brown – August 1, 2023

While there have been many intrusions, compromises, breaches, and incidents that have made news in the IT and InfoSec industries throughout 2022 and into this year, when events or threats like Storm-0558 gain coverage by mainstream media, we often... Read more »

Pingback: ICMP Tunneling Malware

By Corelight Labs Team – May 6, 2021

Recently, Trustwave reported on a new malware family which they discovered during a breach investigation. The backdoor, dubbed Pingback, executes on Windows systems and communicates with its controller via ICMP messages. ICMP (Internet Control... Read more »

What did I just see? Detection, inference, and identification

By Richard Bejtlich – July 29, 2019

In the course of my network security monitoring work at Corelight, I’ve encountered the terms detection, inference, and identification. In this post I will examine what these terms mean, and how they can help you describe the work you do when... Read more »

There’s more to Bro than great network data

By Vince Stoffer – September 5, 2018

Corelight recently released our 1.15 software update which includes some fantastic new features, including our first group of curated Bro Packages which we’re calling the “Core Collection.” In this blog post, I’ll tell you a bit more about how... Read more »

Databricks + Corelight – A powerful combination for cybersecurity, incident response and threat hunting

By Alan Saldich – July 16, 2018

Incident response, threat hunting and cybersecurity in general relies on great data. Just like the rest of the world where virtually everything these days is data-driven, from self-driving cars to personalized medicine, effective security strategies... Read more »

That’s a Wrap! The Bay Area’s First Open-Source Bro Meetup

By John Gamble – January 17, 2018

Last Tuesday Corelight hosted the Bay Area’s first meetup for the open-source Bro network security monitor and we saw a great turnout of Bro fanatics and first-timers alike at our San Francisco headquarters. Read more »