@corelight_inc

Corelight transforms network data into definitive evidence, powering AI-driven detection and expert-authored workflows, and enabling the AI SOC ecosystem.

 San Francisco and Columbus
corelight.com/
Joined October 2016
  • Tweets3.6K
  • Following609
  • Followers4.2K
2KMedia
Corelight has released open-source Zeek and Suricata detections for php2shell, two serious PHP remote code execution (RCE) vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Developed as part of a coordinated response with OpenAI, PHP, and other organizations, the detections flag suspicious HTTP activity and advertised PHP versions for patch review. Read the analysis and access the detections 👉 corelight.com/blog/php2shell…
1
3
418
It's easy to put your entire focus on technology when designing security controls, but ignoring human behavior can backfire. Security tools and policies only work as well as the people using them. Cloud Security Engineer Taylor Guffey shares a valuable lesson from her career. #CybersecurityAwarenessMonth
1
96
Can a smarter model make up for missing evidence? Corelight tested the same investigation across multiple frontier LLMs. Model performance varied, but the ranking of the network data sources stayed largely consistent. Each model hit a similar knowledge ceiling based on the evidence available to it. Better reasoning helps with what the model can see. It cannot reconstruct evidence that was never captured. Read the research: explore.corelight.com/provab…
3
127
Exfiltration rarely looks like an emergency because attackers hide data transfers inside trusted protocols like DNS, SMB, and HTTP/S. By the time stolen data appears on an extortion site, the response window has already closed. Detecting exfiltration requires analyzing protocol behavior directly to spot unauthorized outbound transfers before data leaves the building.
1
137
Compromised eMudhra intermediate CAs can be used to issue certificates for any hostname. Clients that haven’t received trust updates may still accept them. Corelight is open-sourcing a Zeek package to help defenders identify affected certificates in network traffic and completed handshakes that may indicate client acceptance. The detection covers TLS 1.2 and earlier. The analysis also explains how to check historical Zeek logs for affected certificates. Get the Zeek detection 👉 corelight.com/blog/detect-co…
1
2
120
🚨 Corelight has released open-source detections for PHP2Shell. Join our tactical briefing tomorrow as we walk through how to use them to investigate suspicious HTTP activity. Join Zee Kallab, Yacin Nadji, and Ed Smith for a technical discussion of the complementary signals from Zeek behavioral detections and Suricata signatures, and the HTTP visibility required to put them to work. The session covers CVE-2026-109618 and CVE-2026-109619, with guidance on where to find the published detection details. 📅 October 23 | 10 AM PT Register for the briefing 👉 go.corelight.com/tactical-br…
2
134
Complexity is unavoidable. It expands the attack surface and makes incidents harder to understand and resolve. Corelight Co-Founder and Chief Strategy Officer Greg Bell sees automation as an increasingly important part of how security teams respond. Speed has to be balanced with accuracy. Faster conclusions don’t help if they’re wrong, and teams can’t take forever to resolve an incident. Greg shares why AI is one ingredient in that shift, alongside better data, better intelligence and workforce enablement, and why security needs to become less handcrafted over time. Watch now 👇
69
A detection should give an analyst somewhere to go next. For AI/ML detections, that means more than a verdict. Analysts need the supporting network evidence so they can inspect the activity, validate the conclusion, and continue the investigation. That evidence also gives detection engineers something concrete to refine and tune. Explore transparent detections: corelight.com/cp/ai-soc?utm_…
A person is working on a computer with code visible on the screen. The image features the logo and name, "Corelight." The text reads: "Raise the ceiling by investing in better evidence." There is a button labeled "Read Provably Better Data." The background includes a softly lit workspace.

ALT A person is working on a computer with code visible on the screen. The image features the logo and name, "Corelight." The text reads: "Raise the ceiling by investing in better evidence." There is a button labeled "Read Provably Better Data." The background includes a softly lit workspace.

80
Threat hunting often stalls when analysts have to translate investigative intent into proprietary query syntax across complex data schemas. When incident response speed matters, wrestling with syntax errors or searching documentation slows down investigation workflows
1
114
Corelight Natural Language Query (NLQ) translates plain-English questions directly into executed LogScale Query Language (LQL) syntax against Corelight Investigator data. Instead of writing syntax from scratch, analysts ask questions naturally while NLQ generates, validates, and runs the underlying query across network logs in seconds.
1
48
Corelight Product Management Leader Adam Pumphrey highlights how NLQ eliminates syntax barriers for tier-1 analysts while accelerating complex hunting workflows for senior defenders. By automating language translation into precise network queries, SOC teams spend less time building searches and more time investigating evidence.
36
Monitoring network traffic inside the Black Hat USA NOC revealed sensitive endpoint data being transmitted without encryption on the conference network. Using encrypted traffic analytics, the NOC team identified unencrypted Splunk Forwarder and BigFix streams exposing potentially sensitive user, device, and configuration information. Corelight Sr. Manager, Technical Marketing Engineering Mark Overholser highlights how self-hosted solutions configured without an encrypted communication channel can expose sensitive information when mobile clients roam to uncontrolled networks. Discover how researchers detect cleartext leaks hidden inside custom binary protocols. See the full NOC analysis 👉 corelight.com/blog/black-hat…
A digital poster from Corelight with the text: "Uncovering cleartext leaks in binary traffic. Encrypted traffic analytics exposed unencrypted management streams, user UUIDs and system configs." A green button reads "Read the NOC findings." The background features curved, glowing lines.

ALT A digital poster from Corelight with the text: "Uncovering cleartext leaks in binary traffic. Encrypted traffic analytics exposed unencrypted management streams, user UUIDs and system configs." A green button reads "Read the NOC findings." The background features curved, glowing lines.

2
130
The energy sector experienced a 142% year-over-year increase in breaches, with roughly 80% crossing the boundary from IT to OT networks. Only 58% of energy organizations feel fully prepared when it comes to OT visibility. Join Corelight and Omdia Research on November 12 to learn to close critical blind spots, defend against AI-enabled attacks, and address compliance requirements across converged IT/OT infrastructure. Reserve your spot for the live webinar: go.corelight.com/bridging-it…
This image is an advertisement for a Corelight webinar titled "Bridging the IT and OT visibility divide to protect modern energy grids." It is scheduled for November 12, 2026, at 10:00 AM PST. The image features two people: Hollie Hennessy, identified as OT/IoT Cybersecurity Lead at Omdia, and Vince Stoffer, Field CTO at Corelight. There's a "Register today" button. The background is dark with subtle green wave patterns.

ALT This image is an advertisement for a Corelight webinar titled "Bridging the IT and OT visibility divide to protect modern energy grids." It is scheduled for November 12, 2026, at 10:00 AM PST. The image features two people: Hollie Hennessy, identified as OT/IoT Cybersecurity Lead at Omdia, and Vince Stoffer, Field CTO at Corelight. There's a "Register today" button. The background is dark with subtle green wave patterns.

2
97
Post-quantum cryptography can bring larger TLS handshakes and changes to traffic patterns across enterprise networks. Even as encryption algorithms change, defenders retain visibility into connection metadata and network evidence without relying on line-rate decryption.
2
144
If this host has been compromised, which other systems could the attacker target next? Exposure data helps identify what could be exploited. Network evidence helps reveal what is actually happening. In a working lab, we connected an AI agent to the Corelight and Tenable MCP servers to bring those perspectives together. One investigation traced a critical-severity alert to authorized vulnerability scanning. Another identified vulnerable systems on an administrator's workstation's observed network paths, helping assess the potential blast radius of a compromise. The agent had no shell access to any host. Everything it concluded came from network evidence and exposure data. Read the blog: corelight.com/blog/agentic-a…
1
114
Adapting to the fast changes in cybersecurity requires more than learning new technology. Community makes a difference. While technology provides the foundation, real-world context gained from face-to-face community connection is what shapes effective, adaptable problem-solving. Alissar Abdin, Strategic Account Development Representative, tells us why stepping away from the screen and connecting with peers has been the most important lesson of their career. #CybersecurityAwarenessMonth
This image is a graphic for Corelight, featuring the text: "Cybersecurity Awareness Month. Perspectives from the security community." It shows a photograph of a person identified as Alissar Abdin, labeled as a Strategic Account Development Representative.

ALT This image is a graphic for Corelight, featuring the text: "Cybersecurity Awareness Month. Perspectives from the security community." It shows a photograph of a person identified as Alissar Abdin, labeled as a Strategic Account Development Representative.

Image with black background featuring a quote in white and teal text. At the top, the text reads: "What's one lesson from your career in security that has shaped how you approach the job today?" Below, the quote states: "The tech is critical, but human connection and community are what keep us adaptable.” The author is noted as Alissar Abdin. In the top right corner, a logo for "Corelight" is displayed.

ALT Image with black background featuring a quote in white and teal text. At the top, the text reads: "What's one lesson from your career in security that has shaped how you approach the job today?" Below, the quote states: "The tech is critical, but human connection and community are what keep us adaptable.” The author is noted as Alissar Abdin. In the top right corner, a logo for "Corelight" is displayed.

A black and green graphic with the Corelight logo. Text reads: "Perspectives from the security community. Follow Corelight throughout Cybersecurity Awareness Month for more perspectives from across the industry."

ALT A black and green graphic with the Corelight logo. Text reads: "Perspectives from the security community. Follow Corelight throughout Cybersecurity Awareness Month for more perspectives from across the industry."

1
2
139
Identity is important, but it can’t give defenders the full picture of attacker intent. Ali Islam Khan, Vice President of Corelight Labs, explains why network behavior can help teams audit what an identity is actually doing, especially as nation-state actors increasingly use open-source tools and living-off-the-land techniques. That same data foundation matters as AI becomes part of more security workflows. Without high-fidelity data, the quality of what security teams get back from AI suffers. Watch now 👇
1
2
116
What can an AI agent answer when the evidence it needs isn’t in the data? In Corelight’s research, switching between the tested frontier models made relatively little difference to performance on a capture-the-flag exercise. Holding the model fixed and changing the network data produced much larger differences in the questions the agent could answer. Corelight co-founder and Chief Strategy Officer Greg Bell joins James Wilson on Risky Biz to discuss the findings and why data needs to be a first-class citizen when designing an agentic SOC. Listen to the conversation 👉 youtube.com/watch?v=S1GjydKz…
The image is a graphic for "Risky Business: Episode 855" featuring Corelight. It includes a "Watch now" button and highlights Greg Bell as the Co-Founder and Chief Strategy Officer.

ALT The image is a graphic for "Risky Business: Episode 855" featuring Corelight. It includes a "Watch now" button and highlights Greg Bell as the Co-Founder and Chief Strategy Officer.

109
When your environment negotiates encryption using both legacy defaults and new Post-Quantum Cryptography ciphers, routine traffic patterns suddenly look anomalous. Attempting to decrypt all network traffic at scale quickly becomes an expensive compute bonfire. For most high-throughput environments, trying to inspect every encrypted payload simply isn't scalable or cost-effective. Corelight researcher Josh Porto shows how defenders maintain high-confidence visibility through the PQC transition without relying on line-rate decryption. Discover how investigators maintain clear network evidence through changing encryption standards. Explore the analysis: corelight.com/blog/pqc-the-u…
Two hands are pointing at a computer screen with code, surrounded by digital graphics. Text reads: "Corelight. Post-quantum cryptography. The upgrade nobody asked for (but everyone's getting)." A button says "Read the blog."

ALT Two hands are pointing at a computer screen with code, surrounded by digital graphics. Text reads: "Corelight. Post-quantum cryptography. The upgrade nobody asked for (but everyone's getting)." A button says "Read the blog."

2
134
The typical small PCAP + BTest approach works well for testing Zeek packages, but sometimes a PCAP isn’t available, shareable, or practical for the behavior you need to test. Here is how detection engineers can use BTest and the assert statement introduced in Zeek 6.1.0 to write script-layer unit tests for auxiliary functions. 🧵⬇️
1
135
more replies
BTest doesn’t have a script-layer unit testing library like pytest, but its basic functions can be emulated using assert, introduced in Zeek 6.1.0. Using assert makes the intent of the test clear and, when a test fails, clearly flags which test case failed.
1
62
This gives Zeek package developers a straightforward way to unit test auxiliary functions without having to construct PCAPs for every test case. How is your team currently handling unit testing for custom Zeek scripts and packages?
37
Load more