Corelight Bright Ideas Blog: NDR & Threat Hunting Blog

Fuel for Security AI

By Brian Dye – April 30, 2024

The big idea behind Corelight has always been simple: ground truth is priceless. What really happened, both now and looking back in time. Whether it is used to detect attacks, investigate routine alerts, respond to new vulnerabilities or a full... Read more »

Streamlining Incident Response: How CrowdStrike Falcon EDR integration enhances threat detection

By Sahidya Devadoss – April 24, 2024

In the ever-evolving landscape of cybersecurity threats, staying ahead requires more than just threat detection; it demands comprehensive correlation and analysis for informed decision-making. Understanding the context surrounding an alert is... Read more »

Black Hat NOC: Findings from Europe & thoughts for Asia 2024

By Dustin Lee – April 5, 2024

How quickly a year passes. 2023 was Corelight’s first year participating in the Black Hat Network Operations Center (NOC). It was a tremendous opportunity and responsibility in which we collaborated with teams from Cisco, Palo Alto Networks, Arista,... Read more »

Hunt of the Month: Detecting AsyncRAT Malware Over HTTPS

By Corelight Labs Team – March 20, 2024

All code discussed in this blog can be pulled from https://github.com/corelight/zeek-asyncrat-detector Read more »

Focus Terrapin patching efforts with Zeek

By Ben Reardon – March 8, 2024

In this blog, we will demonstrate how Zeek’s metadata approach can help focus patching efforts related to the recent SSH “Terrapin” attack. One of the interesting aspects to bear in mind as you read this is that Zeek provides visibility of the... Read more »

Dual Defenses: 9 Reasons Why Open NDR Is Essential Alongside NGFW

By Ed Smith – March 1, 2024

Securing a network against the myriad of evolving cyber threats requires more than just a robust firewall or endpoint protection platform; it demands a multifaceted approach. Corelight’s Open Network Detection and Response (NDR) Platform complements... Read more »

Inside the Mind of a Cybersecurity Threat Hunter Part 2: Identifying Persistence Techniques

By Allen Marin – February 26, 2024

In this second post of our threat hunting with Corelight and CrowdStrike blog series we dive into Persistence, which is one the many tactical categories outlined in the MITRE ATT&CK framework. In our previous blog, we reviewed some of the common... Read more »

Dual Defenses: 10 Reasons Why NDR Is Essential Alongside EDR

By Ed Smith – January 10, 2024

Over the last few years, the evolution of cybersecurity strategies has seen a significant shift toward a more layered, nuanced, and, in many cases, advanced approach. Among these advancements, Network Detection and Response (NDR) has emerged as a... Read more »

How Corelight Uses AI to Empower SOC Teams

By Vince Stoffer – November 15, 2023

The explosion of interest in artificial intelligence (AI) and specifically large language models (LLMs) has recently taken the world by storm. The duality of the power and risks that this technology holds is especially pertinent to cybersecurity. On... Read more »

Turning the tables on the infiltrator

By Ben Reardon – October 16, 2023

This article was originally featured in TechBeacon. Read more »