Expand visibility around authentication and application anomalies with Corelight's new LDAP analyzer
Mar 20, 2023
|
By Vince Stoffer
Comprehensive visibility into network protocols is a hallmark of Zeek (and therefore Corelight) data. That's why we are very happy to announce that with our v27.2 release we are supporting a new analyzer for the LDAP protocol. You likely know LDAP as a workhorse for carrying directory information across the network. While it's an open standard, it's most often seen as part of several server implementations, especially Microsoft's Active Directory, OpenLDAP, and others.
Jan 31, 2023
|
By Sara Shuman
Corelight Investigator furthers its commitment to delivering next-level analytics through the expansion of its machine learning models. Security teams are now enabled with additional supervised and deep learning models, including: We continue to provide complete transparency behind our evidence -- showing the logic behind our machine learning models and detections, allowing analysts to quickly and easily validate the alerts.
Jan 17, 2023
|
By Ed Amoroso, founder and CEO of TAG Cyber (guest)
Editor's note: This is the first in five-part series authored by Ed Amoroso, founder and CEO of TAG Cyber, which will focuses on how the Corelight platform reduces network security risks to the so-called Everywhere Cloud (EC). Such security protection addresses threats to devices and assets on any type of network, including both perimeter and zero-trust based.
Dec 13, 2022
|
By Vince Stoffer
Corelight Labs, our amazing research team, has been hard at work on another content collection which we are excited to introduce: the Corelight Entity Collection. Corelight evidence is powerful and comprehensive. So comprehensive, in fact, that it can sometimes be hard to know where to start. Providing customers faster ways to find meaningful context in our data was the driving force behind the creation of the Entity Collection.
Dec 8, 2022
|
By John Gamble
Today, as a part of our v27 software release, we are launching enhanced IDS rules management functionality, extending analyst visibility around hosts, devices, users, and more, and upgrading the Corelight Software Sensor to give customers more NDR deployment flexibility.
Dec 5, 2022
|
By Tim Wojtulewicz
As we shared at ZeekWeek 2022 in October, we’re thrilled to announce emerging support for Zeek on Windows, thanks to an open-source contribution from Microsoft. Part of its integration of Zeek into its Defender for Endpoint security platform, this contribution provides fully-native build support for Windows platforms and opens up a range of future technical possibilities in this vast ecosystem.
Nov 30, 2022
|
By Corelight Labs Team
On Nov. 22, 2022 Microsoft announced research findings about an ongoing supply chain attack against IoT devices running Boa web servers. The Boa web server, an open-source small-footprint web server suitable for embedded applications, was discontinued in 2005, but many software development kits still use this lightweight server on IoT hardware. Since being discontinued, vulnerabilities were discovered in Boa that make every version out there exploitable.
Nov 8, 2022
|
By Corelight Labs Team
The Corelight Labs team prides itself on the ability to create novel Zeek and Suricata detection content that delves deep into packet streams by leveraging the full power of these tools. However this level of additional sophistication is not always required: sometimes there are straightforward approaches that only require queries over standard Zeek logs. It’s always valuable when developing detections to keep in mind that “sometimes simple does just fine.”
Oct 18, 2022
|
By Todd Morneau
As organizations continue to rapidly adopt cloud services, they struggle to expand network detection and response (NDR) capabilities to their hybrid and multi-cloud environments. Network visibility is critical for security operations center (SOC) teams to secure their cloud environments and ensure they can elevate threat detection and incident investigation capabilities. However, traditional NDR solutions require management, configuration and often lack the security context needed.
Oct 10, 2022
|
By Jean Schaffer
“Knowing what’s on your network is the first step for any organization to reduce risk.” -CISA Director, Jen Easterly. On October 3, the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.
Mar 20, 2023
|
By Corelight
When organizations need to know not only what type of malicious activity potentially occurred within their networks and clouds but also gather the remnants of that activity as evidence — they turn to Corelight. Corelight's customers include Fortune 500 companies, major government agencies, and large research universities. Based in San Francisco, this open-core security company was founded by the creators of the widely-used network security technology, Zeek.
Feb 16, 2023
|
By Corelight
The current tempo in information security is getting increasingly faster. We continue to chase quicker detections and faster responses. But does that align with reality? Troves of data is being ingested at wire speed w/filtering, comparing, correlating, identifying, and other transform operations in the event lifecycle. This comes with an increased risk of missed events/alerts, indiscernible log activity from various origins, and the potential for analysis paralysis/desensitization/burnout…
Feb 8, 2023
|
By Corelight
Monitoring network traffic is essential to SecOps. Security teams need to streamline network detection, data routing, and analysis for faster incident response. Corelight, Cribl, and Elastic combine to provide a unique solution that transforms the noise of network traffic into effectively routed, optimized data.
Jan 11, 2023
|
By Corelight
Networks are the transport fabric for all IT however in the modern world they have become harder to access and monitor. Attackers inevitably leave traces on the network, and for this reason defenders understand the value of high-quality network evidence. But given the rise of encryption, digital transformation, Zero Trust architectures, and SASE… is it even feasible to collect network evidence anymore? Maybe we should throw in the towel and do without it?
Dec 13, 2022
|
By Corelight
SANS research has shown that more organizations are using multiple cloud providers. Multicloud adoption can be driven by a variety of factors, such as competitive differentiation, mergers and acquisitions, and more. This event explores various results from the SANS 2022 Multicloud Survey, including multicloud adoption trends, how adoption decisions are made, and—most importantly—what cybersecurity teams are doing to cope with the onslaught of challenges brought about by so much change, complexity, and variation in the cloud services marketplace.
Nov 2, 2022
|
By Corelight
When conducting incident response, EDR and firewall technologies can only show you so much. The breadth of network traffic provides an unrivalled source of evidence and visibility. Open-source security technologies such as Zeek, Suricata, and Elastic can deliver powerful network detection and response capabilities, furthermore the global communities behind these tools can also serve as a force multiplier for security teams, often accelerating response times to zero-day exploits via community-driven intel sharing.
Oct 5, 2022
|
By Corelight
Corelight and Microsoft show the power of combining network evidence with endpoint telemetry using Defender365 and Sentinel to analyse, investigate, and understand the full breadth of an attack. During the session, we dive straight into the technology and how it can be applied using a simulated attack Demo.
Oct 4, 2022
|
By Corelight
When conducting incident response, EDR and firewall technologies can only show you so much. The breadth of network traffic provides an unrivaled source of evidence and visibility. Open source security technologies such as Zeek, Suricata, and Elastic can deliver powerful network detection and response capabilities, furthermore the global communities behind these tools can also serve as a force multiplier for security teams, often accelerating response times to zero-day exploits via community-driven intel sharing.
Sep 27, 2022
|
By Corelight
Amidst a record number of workloads moving to the cloud – security teams must not only confront the cyber-skills shortage, but also a general lack of cloud expertise. Corelight and guest Forrester will share best practices for building threat detection, hunting, and incident response capabilities to the cloud and upskilling your existing SecOps team. Watch this on demand webcast to learn.
Sep 26, 2022
|
By Corelight
See how Corelight + CrowdStrike Falcon XDR correlates suspicious telemetry from across attack surfaces to show the full picture of adversary activity, and accelerate detection and response.
- March 2023 (2)
- February 2023 (2)
- January 2023 (3)
- December 2022 (4)
- November 2022 (3)
- October 2022 (5)
- September 2022 (4)
- August 2022 (7)
- July 2022 (3)
- June 2022 (3)
- May 2022 (11)
- April 2022 (8)
- March 2022 (6)
- February 2022 (7)
- January 2022 (1)
- December 2021 (7)
- November 2021 (7)
- October 2021 (3)
- September 2021 (3)
- August 2021 (7)
- July 2021 (7)
Corelight gives you the high ground—a commanding view of your network that lets you outsmart and outlast adversaries.
From the Acropolis to the edge of space, defenders have sought the high ground in order to see farther and turn back attacks. Corelight delivers a commanding view of your network so you can outsmart and outlast adversaries. We capture, interpret, and connect the data that means everything to defenders.
Corelight gives apex defenders the information and tools they need to successfully detect and respond to threats. Corelight is built on Zeek, an open-source, global standard technology. Zeek provides rich, structured, security-relevant data to your entire SOC, making everyone from Tier 1 analysts to seasoned threat hunters far more effective.
The Open NDR Platform:
- Suricata: Suricata generates alerts that we embed directly into Zeek logs, putting every detection into context to save time, cut alert backlogs, and improve analytics.
- Zeek: The Zeek open source network security monitor generates lightweight metadata and detections to enable threat hunting and speed incident response.
- Smart PCAP: Smart PCAP links logs, extracted files, and insights with just the packets you need, to reduce storage costs while expanding retention times by a factor of 10.
Faster investigations, more effective threat hunts with the world's best network evidence.