Corelight Bright Ideas Blog

Featured

Watch what happens when your AI agent actually knows how to investigate

See what a SOC agent does when it has real network forensics expertise behind it, from hypothesis to IDS alerts, timeline, and next steps.

Alyssa Ideboen Sep 29, 2026

Zeek

Hunting Citrix NetScaler Zero-Days with Corelight

Learn how to use Zeek logs and Corelight Investigator to discover Citrix NetScaler assets, monitor DTLS traffic, and hunt for zero-day exploitation...

Ben Reardon : Corelight Labs, Lead Security Researcher Sep 28, 2026

network detection response

Detecting Log4j exploits via Zeek when Java downloads Java

The blog covers a third log4j detection method, this one focused on the second-stage download that happens after the first stage completes.

Corelight Labs Team Dec 18, 2021

network detection response

Detecting Log4j via Zeek & LDAP traffic

We recently discussed some methods for detecting the Log4j exploit, and we’ve developed another method that one running Zeek® or a Corelight sensor...

Corelight Labs Team Dec 17, 2021

network detection response