AI/ML detections

They focus on the evasive, insider, and novel threats that slip past signatures and endpoint detection and response (EDR). Coverage includes lateral movement, anomalous remote desktop protocol (RDP) activity, admin-share access, credential attacks, command-and-control (C2) activity, DNS abuse (tunneling and exfiltration), and living off the land (LOTL) techniques. As adversaries weaponize AI to operate at machine speed, models trained on your network's true behavior can catch what static rules were never built to see.

Four mechanisms work together. Peer-group modeling measures each host's behavior against its actual role, so an alert only fires when it's genuinely unusual for both the entity and its peers. Behavioral baselining learns what normal looks like on your specific network, not a generic template. Granular tuning lets you sharpen the signal further. High-fidelity, validated threat intelligence adds another layer of precision beyond noisy open-source feeds. The result is that analysts spend more time on real threats and less time chasing noise.

AI/ML detections are one layer in Corelight’s Open NDR Platform. They work in concert with signatures, YARA file analysis, indicators of compromise (IOCs) from threat intelligence, and behavioral analytics. Each layer covers the others' blind spots, giving you true defense in depth and broader MITRE ATT&CK coverage. AI/ML adds the depth needed to surface the evasive and novel threats that signatures and rules miss.

Many detections run directly on-sensor, with no cloud dependency. These lightweight, efficient models run on Corelight Sensors, lowering infrastructure costs and removing the need for centralized cloud analytics servers. Detection logic stays open, inspectable, and customizable, and telemetry is collected passively, out-of-band, so there's no risk of network downtime. Some AI/ML models require the visibility and data from multiple sensors, and those detections run in our SaaS solution, Investigator.

No. Corelight's AI is built to complement human judgment, not replace it. By automating data gathering, correlation, and initial analysis, it removes the manual grind that drives burnout and turnover, freeing your team to focus on proactive threat hunting and decisive response. You get AI-driven efficiency and stronger analyst retention, not a black box asking for blind faith.