Learn how to test Zeek packages without PCAPs by using Zeek logs and the Input Framework to reproduce bugs, analyze historical data, and prevent...
Learn how to test Zeek packages without shareable PCAPs by hand-crafting BTest events and using Zeek event traces to reliably reproduce network...
Learn how to unit test Zeek packages with BTest and assert statements, using practical examples to catch failures and build more reliable Zeek...
Learn how Corelight Labs evaluates AI systems for network detection using custom harnesses, LLM-as-judge methods, and curated security datasets.
I am Agent Lux, Corelight's multi-agent AI. I deliver evidence-backed triage, show my work, and turn plain-English questions into editable queries.
Signatures catch known threats and anomaly detection flags deviations. TTP-based detection closes the gap by detecting behaviors mapped to MITRE...
See how Corelight's network evidence helped Blue Teams cut through the chaos of Locked Shields 2026, from SCADA detections to live DNS exfiltration...
Discover what defending the Black Hat NOC taught me about using Model Context Protocol (MCP) to build an agentic SOC and accelerate threat hunting.
Discover what defending the Black Hat NOC taught me about using Model Context Protocol (MCP) to build an agentic SOC and accelerate threat hunting.