Read the Gartner® Competitive Landscape: Network Detection and Response Report
START HERE
Why Open NDR
WHY CORELIGHT
Evidence-based security
Detections & analytics
Faster investigation
Complete visibility
SOLUTIONS
Cloud security
Encrypted traffic
Federal
Ransomware
Threat hunting
CORELIGHT LABS
Recent research
Mission and team
Polaris program
STRATEGIC PARTNERS
Overview
Crowdstrike
Google Cloud
Microsoft
Splunk
Elastic
Close your ransomware case with Open NDR
OVERVIEW
Open NDR Platform
Analytics & detections
MITRE ATT&CK®
PRODUCTS
Zeek®-based evidence
IDS
Smart PCAP
Investigator
SENSORS
Appliances
Cloud
Software
Virtual
Fleet Manager
View all products
SERVICES
Training
ALLIANCES
CrowdStrike
View all
USE CASES
Case Studies
Find hidden attackers with Open NDR
TECHNOLOGY INTEGRATIONS
Partner ecosystem
Technology partners directory
FOR PARTNERS
Deal registration
Become a Channel Partner
Partner Academy sign up
Alliance Academy sign up
Corelight announces cloud enrichment for AWS, GCP, and Azure
Corelight's partner program
BLOG
Read the latest
EVENTS
Meet with us
RESOURCE CENTER
Document Library
GLOSSARY
NDR (Network Detection & Response)
NDR vs. XDR vs. EDR
Cloud Security Solutions
Intrusion Detection System (IDS)
Packet Capture (PCAP)
Signature-Based Detection
IDS False Positive
10 Considerations for Implementing an XDR Strategy
READ NOW
Don't trust. Verify with evidence
ABOUT US
About Corelight
Leadership
Investors
JOIN US
Careers
Current openings
NEWS & EVENTS
Newsroom
Media coverage
Events
The Power of Open-Source Tools for Network Detection and Response
The Evolving Role of NDR
SUPPORT SERVICES
Open a ticket
Account login
Technical bulletins
Report a security vulnerability
WORLD-CLASS SUPPORT
Support overview
Detecting 5 Current APTs without heavy lifting
Network Detection and Response
By Richard Bejtlich – May 5, 2022
Editor's note: This is the second in a series of Corelight blog posts focusing on evidence-based security strategy. Catch up on all of the posts here. Read more »