CORELIGHT + MICROSOFT SECURITY

SUPERCHARGE MICROSOFT SECURITY OPERATIONS PLATFORM WITH POWERFUL NETWORK EVIDENCE

By transforming all network traffic into rich comprehensive evidence, Corelight gives security teams using Microsoft Sentinel the visibility to understand exactly what is happening across the enterprise. Along with native integration with Microsoft Sentinel, Corelight also integrates with Microsoft Defender for Endpoint and Microsoft Defender Vulnerability Management to help streamline investigations, accelerate responses, and remediate incidents quickly and easily.

For instance, Corelight pre-correlates its logs and detections with endpoint and relevant vulnerability data from Defender directly at the sensor, so organizations can better understand and prioritize the most vulnerable endpoints across the enterprise. Going one step further, this unique integration enables fast and easy isolation of those endpoints that show signs of compromise, such that when Corelight detects a compromise, analysts can use Corelight Investigator to quickly assess the threat and isolate devices with a single click.

• Complete network visibility across hybrid environments, including IT, IoT, and ICS
• Quickly pivot between pre-correlated network telemetry and endpoint data
• Simplify investigations with risk-based alert prioritization
• Easily identify and isolate vulnerable and compromised hosts with one click