What is Network Evidence? The Foundation of Modern NDR

Home/Resources/Glossary/

As a security practitioner, on one hand, you must believe your prevention tools will stop attacks. On the other hand, you must prepare diligently for the moment they don’t. When prevention fails (and in a world of zero-days and supply chain compromises, "when" is the operative word, not "if"), what do defenders reach for? They reach for evidence that is:

Continuous & automatic: Collected like a security camera: always on, regardless of whether an event seems "benign" at the time.
Neutral: Uncolored by vendor bias. It reports exactly what happened (e.g., a DNS reply) in near-real time.
Richly detailed: Coarse-grained data isn't enough to distinguish a normal user from lateral movement.
Well-structured: To facilitate data ingestion for the powerful data science and AI agents transforming the SOC in 2026.

While most security tools focus on generating alerts, network evidence focuses on providing the ground truth. It is the authoritative, AI-ready record of every connection, session, and flow across your environment.

Network evidence is the sweet spot of security data. It sits perfectly between the overwhelming weight of full Packet Capture (PCAP), which is often too expensive to retain, and the thin, context-poor summaries of NetFlow or firewall logs. By transforming raw traffic into structured, context-enriched logs, network evidence provides the definitive foundation for detection, triage, and threat hunting.

The four pillars of network evidence

An evidence-first analytics approach delivers broad, deep, and accurate insights by focusing on four strategic pillars:

Pillar	How it transforms the SOC
High-fidelity detection	Eliminates visibility gaps in east-west, encrypted, and cloud traffic, providing the authoritative source of truth needed to expose threats that evade traditional perimeter tools.
Accelerated triage	Combats information overload by linking every event with a unique ID (UID), allowing analysts to cut investigation time in half by following a pre-correlated narrative.
Confident response	Guarantees an immutable historical record, allowing investigators to reconstruct the full attack timeline and determine root cause without guesswork or post-breach chaos.
AI-ready evidence	Delivers evidence in a structured, open format (JSON/TSV), ensuring data is ready for immediate integration with any SIEM, data lake, or emerging AI/ML security platform.

High-fidelity detection: Exposing the invisible

The cornerstone of an evidence-first strategy is the ability to see what others miss. Traditional security tools often suffer from "visibility gaps": blind spots created by encrypted traffic, unmanaged devices, and east-west movement within the network. High-fidelity network evidence eliminates these gaps by providing a deep, protocol-level view of every interaction.

While basic tools might identify that a connection occurred, network evidence reveals the intent of that connection. This depth is critical because modern attackers don't just "break in"; they blend in using sophisticated techniques that evade signature-based defenses. High-fidelity detection empowers your team to:

Unmask encrypted threats: Analyze handshake properties and behavioral characteristics to find C2 or exfiltration hiding in encrypted tunnels without the overhead of decryption.

Monitor east-west traffic: Gain total visibility into internal movements that bypass perimeter firewalls, identifying lateral movement before it reaches your crown jewels.

Go beyond ports: Inspect over 70 protocols to identify "living off the land" techniques, such as attackers using legitimate administrative tools (like SMB or PowerShell) for malicious purposes.

Accelerated triage: Evidence-first vs. alert-first

Most security teams suffer from alert fatigue, a constant barrage of low-fidelity notifications from disparate tools. An evidence-first approach flips the script. Instead of starting with a noisy alert and trying to find data to support it, you start with high-quality evidence that fuels more accurate analytics.

For example, when investigating a framework like the Sliver C2 (Command-and-Control), an alert-first tool might flag a single suspicious connection. However, network evidence allows an analyst to:

Verify:
See the telltale HTTP header ordering unique to Sliver.

Scope:
Trace the lateral movement from the infected host to the rest of the network.

Confirm:
Prove whether exfiltration actually occurred by looking at the data transfer volumes.

Confident response: Defensible disclosure beyond the breach

One of the most critical roles of network evidence is enabling defensible disclosure. This is the process of notifying stakeholders of an incident in a manner that the disclosing party can competently and intelligently justify.

When a breach occurs, leadership is often forced to rely on hunches or the claims of the intruder. High-quality network evidence changes the conversation from "we think" to "we know" by answering key questions:

Scope:
Exactly which data stores did the intruder access?

Timeline:
When did the intrusion start, and more importantly, when did it end?

Validation:
Can we prove the attacker has been fully removed from the environment?

AI-ready evidence: Fueling the future SOC

The effectiveness of AI in the SOC depends entirely on the data used to train and prompt it. Low-fidelity, fragmented logs lead to "hallucinations" and inaccurate assessments. Corelight’s network evidence is designed to be AI-ready out of the box, providing the structured, high-context data that modern Large Language Models (LLMs) and ML engines require.

By delivering evidence in open, machine-readable formats (JSON/TSV), Corelight ensures that your data is a portable asset, not a proprietary secret. This "AI-readiness" allows your organization to:

Automate correlation: Use AI security agents to instantly link disparate logs via the Unique ID (UID), accelerating the path from raw data to a complete attack narrative.

Train precision models: Feed high-fidelity Zeek logs into custom machine learning models to detect subtle anomalies specific to your unique network environment.

Eliminate vendor lock-in: Maintain true data ownership with open standards, allowing you to pivot between different SIEMs, data lakes, or AI platforms as your security stack evolves.

Transforming traffic into network evidence: How it works

Evidence doesn't just exist, it is engineered. The Corelight Sensor acts as the engine that transforms raw network packets into the structured evidence security teams rely on. This process occurs in four distinct stages:

Data capture and cleanup: The sensor captures a copy of all traffic out-of-band. It then deduplicates and cleans the data, discarding redundant multicast traffic to ensure a clean, efficient dataset for analysis.
Context enrichment: The sensor applies live, external context before the logs are even generated. This includes threat intelligence (IOCs and YARA rules) and asset identification to associate IP addresses with known devices and users.
Deep protocol intelligence: Powered by Zeek, the sensor performs deep protocol parsing across 70+ data types. It translates raw packets into meaningful events, such as DNS replies or SSL handshakes, and links them all via a UID.
Optimized output and routing: Finally, the evidence is optimized. Data aggregation can reduce log volume by up to 80% without losing security context. This authoritative truth is then routed to Corelight Investigator, a SIEM or a cost-effective data lake for long-term forensics.

The gold standard for network evidence is Zeek^®, an open-source framework originally developed at Lawrence Berkeley National Lab over 30 years ago. Zeek is not a traditional IDS; it is a powerful network monitoring platform that generates neutral, detailed, and highly structured evidence. Corelight’s network evidence relies on Zeek because it is adaptable, scriptable, and battle-tested. It doesn't just record that a connection happened; it explains what happened inside that connection.

Because Zeek is open and scriptable, it evolves alongside the threat landscape and benefits from a global community of defenders who constantly contribute new scripts to detect the latest attacker Tactics, Techniques, and Procedures (TTPs). It provides the "forensic fidelity" needed to distinguish between a normal user login and sophisticated lateral movement. Corelight takes this powerful engine and scales it for the world’s most demanding enterprise environments, using Zeek as our foundation because it is the only platform that provides the necessary depth to fuel modern NDR analytics and support the next frontier of defense: AI-driven security orchestration.

Book a demo

We’re proud to protect some of the most sensitive, mission-critical enterprises and government agencies in the world. Learn how Corelight’s Open NDR Platform can help your organization mitigate cybersecurity risk.

Book a demo