@corelight_inc

Corelight transforms network data into definitive evidence, powering AI-driven detection and expert-authored workflows, and enabling the AI SOC ecosystem.

 San Francisco and Columbus
corelight.com/
Joined October 2016
  • Tweets3.6K
  • Following609
  • Followers4.2K
2KMedia
Corelight’s Threat R&D team was building detections for DFS-based coercion attacks when a test server crashed. The crash in mup.sys uncovered CVE-2026-70111, a null dereference crash causing denial-of-service affecting Windows Server 2019, 2022, and 2025. An attacker can coerce an affected server to connect to a rogue server, which returns a malformed DFS referral response. When mup.sys processes it, the server crashes. The exchange runs over internal SMB traffic, so detection requires east-west coverage. The research explains how Suricata identifies the malformed response and Zeek conn.log records sessions going silent and connections resetting after reboot. Read the research 👉 corelight.com/blog/cve-2026-…
2
2
213
Adapting to the fast changes in cybersecurity requires more than learning new technology. Community makes a difference. While technology provides the foundation, real-world context gained from face-to-face community connection is what shapes effective, adaptable problem-solving. Alissar Abdin, Strategic Account Development Representative, tells us why stepping away from the screen and connecting with peers has been the most important lesson of their career. #CybersecurityAwarenessMonth
This image is a graphic for Corelight, featuring the text: "Cybersecurity Awareness Month. Perspectives from the security community." It shows a photograph of a person identified as Alissar Abdin, labeled as a Strategic Account Development Representative.

ALT This image is a graphic for Corelight, featuring the text: "Cybersecurity Awareness Month. Perspectives from the security community." It shows a photograph of a person identified as Alissar Abdin, labeled as a Strategic Account Development Representative.

Image with black background featuring a quote in white and teal text. At the top, the text reads: "What's one lesson from your career in security that has shaped how you approach the job today?" Below, the quote states: "The tech is critical, but human connection and community are what keep us adaptable.” The author is noted as Alissar Abdin. In the top right corner, a logo for "Corelight" is displayed.

ALT Image with black background featuring a quote in white and teal text. At the top, the text reads: "What's one lesson from your career in security that has shaped how you approach the job today?" Below, the quote states: "The tech is critical, but human connection and community are what keep us adaptable.” The author is noted as Alissar Abdin. In the top right corner, a logo for "Corelight" is displayed.

A black and green graphic with the Corelight logo. Text reads: "Perspectives from the security community. Follow Corelight throughout Cybersecurity Awareness Month for more perspectives from across the industry."

ALT A black and green graphic with the Corelight logo. Text reads: "Perspectives from the security community. Follow Corelight throughout Cybersecurity Awareness Month for more perspectives from across the industry."

1
2
124
Identity is important, but it can’t give defenders the full picture of attacker intent. Ali Islam Khan, Vice President of Corelight Labs, explains why network behavior can help teams audit what an identity is actually doing, especially as nation-state actors increasingly use open-source tools and living-off-the-land techniques. That same data foundation matters as AI becomes part of more security workflows. Without high-fidelity data, the quality of what security teams get back from AI suffers. Watch now 👇
1
2
102
What can an AI agent answer when the evidence it needs isn’t in the data? In Corelight’s research, switching between the tested frontier models made relatively little difference to performance on a capture-the-flag exercise. Holding the model fixed and changing the network data produced much larger differences in the questions the agent could answer. Corelight co-founder and Chief Strategy Officer Greg Bell joins James Wilson on Risky Biz to discuss the findings and why data needs to be a first-class citizen when designing an agentic SOC. Listen to the conversation 👉 youtube.com/watch?v=S1GjydKz…
The image is a graphic for "Risky Business: Episode 855" featuring Corelight. It includes a "Watch now" button and highlights Greg Bell as the Co-Founder and Chief Strategy Officer.

ALT The image is a graphic for "Risky Business: Episode 855" featuring Corelight. It includes a "Watch now" button and highlights Greg Bell as the Co-Founder and Chief Strategy Officer.

101
When your environment negotiates encryption using both legacy defaults and new Post-Quantum Cryptography ciphers, routine traffic patterns suddenly look anomalous. Attempting to decrypt all network traffic at scale quickly becomes an expensive compute bonfire. For most high-throughput environments, trying to inspect every encrypted payload simply isn't scalable or cost-effective. Corelight researcher Josh Porto shows how defenders maintain high-confidence visibility through the PQC transition without relying on line-rate decryption. Discover how investigators maintain clear network evidence through changing encryption standards. Explore the analysis: corelight.com/blog/pqc-the-u…
Two hands are pointing at a computer screen with code, surrounded by digital graphics. Text reads: "Corelight. Post-quantum cryptography. The upgrade nobody asked for (but everyone's getting)." A button says "Read the blog."

ALT Two hands are pointing at a computer screen with code, surrounded by digital graphics. Text reads: "Corelight. Post-quantum cryptography. The upgrade nobody asked for (but everyone's getting)." A button says "Read the blog."

2
131
The typical small PCAP + BTest approach works well for testing Zeek packages, but sometimes a PCAP isn’t available, shareable, or practical for the behavior you need to test. Here is how detection engineers can use BTest and the assert statement introduced in Zeek 6.1.0 to write script-layer unit tests for auxiliary functions. 🧵⬇️
1
130
more replies
BTest doesn’t have a script-layer unit testing library like pytest, but its basic functions can be emulated using assert, introduced in Zeek 6.1.0. Using assert makes the intent of the test clear and, when a test fails, clearly flags which test case failed.
1
61
This gives Zeek package developers a straightforward way to unit test auxiliary functions without having to construct PCAPs for every test case. How is your team currently handling unit testing for custom Zeek scripts and packages?
36
Attackers increasingly use legitimate admin utilities and valid API keys to map systems and escalate privilege after an initial breach. Signature-based EDR can treat this as normal admin activity, while automated attacks can move faster than human operators can triage an alert. Chrissie Padilla, Manager of Network Security Training, shares what security teams should be paying more attention to right now. #CybersecurityAwarenessMonth
80
Asking an AI assistant about a suspicious IP usually yields basic entity summaries. Arming AI agents with custom skills and protocol field logic allows SOC teams to turn broad log queries into deep, automated forensic investigations.
1
2
205
95% vs. 26%. In a Volt Typhoon-inspired CTF, GPT-5.4 answered 95% of investigative questions using Corelight data, compared with 26% using NetFlow. The model did not change. The evidence did. The finding points to a knowledge ceiling for AI-assisted investigations: when the required evidence is missing, a stronger model cannot recover it. See the findings: explore.corelight.com/provab…
1
121
What the network means has changed. Cloud properties, remote workforces, and AI workloads have expanded the surface defenders need to understand. At the same time, network data is increasingly being consumed by systems and agents alongside analysts. Corelight Field CTO Vince Stoffer explains why that makes network evidence and interoperability increasingly important, and why security leaders need to think about the modern SOC as a whole system instead of a collection of isolated tools. Watch now 👇
1
93
Opaque AI alerts create additional work for security teams because analysts have to manually double-check unverified conclusions. Delivering transparent, explainable AI workflows in the SOC requires pairing automated findings with the underlying network evidence used to generate them. 🧵👇
1
129
Defensible AI triage must expose its complete reasoning chain directly to defenders. By presenting the finding, the supporting evidence, and the recommended next move in a transparent interface, Corelight ensures analysts can rapidly validate automated conclusions and act with confidence.
1
63
Grounding AI investigations in transparent workflows allows security teams to validate automated decisions rapidly, build trust in agentic outputs, and execute response actions with confidence. How does your team currently verify automated AI conclusions before acting on an alert? Tell us below.
52
Corelight has been named a winner at The 2026 A.I. Awards, taking home Best Use of AI in Cybersecurity! 🏆 As AI becomes part of more security workflows, we're focused on helping defenders investigate faster, work from high-quality network evidence, and understand how conclusions are reached. We're proud to see this work recognized and grateful to the teams across Corelight who continue to make it possible. See the full list of winners: cloud-awards.com/ai-awards/2…
Award graphic announcing Corelight as the winner for "Best Use of AI in Cybersecurity" at the 2026 A.I. Awards. The Corelight logo is displayed at the bottom.

ALT Award graphic announcing Corelight as the winner for "Best Use of AI in Cybersecurity" at the 2026 A.I. Awards. The Corelight logo is displayed at the bottom.

90
Identity-based attacks become especially difficult to spot when an attacker looks like a legitimate user. Once an attacker gains access, the challenge shifts from access control to seeing what that apparently legitimate identity is doing across the network. Tracey Conn, AVP, SLED, shares the one thing security teams should be paying attention to right now. #CybersecurityAwarenessMonth
A promotional graphic for Cybersecurity Awareness Month by Corelight. It features the text "Perspectives from the security community" and includes a photo of a smiling person wearing sunglasses and a jean jacket. The name "Tracey Conn" and the title "AVP, SLED" are also displayed.

ALT A promotional graphic for Cybersecurity Awareness Month by Corelight. It features the text "Perspectives from the security community" and includes a photo of a smiling person wearing sunglasses and a jean jacket. The name "Tracey Conn" and the title "AVP, SLED" are also displayed.

Corelight graphic with a quote by Tracey Conn discussing the importance of identifying legitimate identities across the network to improve security.

ALT Corelight graphic with a quote by Tracey Conn discussing the importance of identifying legitimate identities across the network to improve security.

A graphic with a dark green and black background features the Corelight logo and text. It reads: "Perspectives from the security community. Follow Corelight throughout Cybersecurity Awareness Month for more perspectives from across the industry."

ALT A graphic with a dark green and black background features the Corelight logo and text. It reads: "Perspectives from the security community. Follow Corelight throughout Cybersecurity Awareness Month for more perspectives from across the industry."

1
1
1
159
When a new vulnerability is disclosed, the evidence needed to investigate it may already be in your network logs. In an offline replay of proof-of-concept traffic for Citrix NetScaler CVE-2026-88772, Zeek's existing DTLS analyzer recorded a handshake length mismatch. For defenders retaining those logs, that creates an opportunity to search historical traffic, including activity recorded before the vulnerability was disclosed. Corelight Labs researcher Deepali Prasad walks through how to search for the diagnostic and correlate findings with connection records and appliance evidence. A matching diagnostic warrants investigation, but doesn't confirm compromise. Read the analysis: corelight.com/blog/hunting-c…
The image is a graphic related to threat research, featuring the text: "A NetScaler zero-day. A clue in existing Zeek logs. Investigate suspicious DTLS traffic associated with CVE-2026-88772." It includes a "Read the analysis" button and the Corelight logo. There is a triangular caution symbol in the lower right corner.

ALT The image is a graphic related to threat research, featuring the text: "A NetScaler zero-day. A clue in existing Zeek logs. Investigate suspicious DTLS traffic associated with CVE-2026-88772." It includes a "Read the analysis" button and the Corelight logo. There is a triangular caution symbol in the lower right corner.

1
2
241
With AI systems transitioning into everyday workflows, securing them requires rethinking how we monitor their infrastructure. Without clear insight into how these systems exchange data, security teams can risk running blind. Alissar Abdin, Strategic Account Development Representative, shares why protocol-level visibility is essential to building an effective AI security posture. #CybersecurityAwarenessMonth
Image featuring a green and black digital banner with the logo "Corelight" in the top right corner. The text reads, "Cybersecurity Awareness Month: Perspectives from the security community." A circular inset at the bottom left shows a portrait of a person in business attire. Text below the portrait reads "Alissar Abdin, Strategic Account Development Representative."

ALT Image featuring a green and black digital banner with the logo "Corelight" in the top right corner. The text reads, "Cybersecurity Awareness Month: Perspectives from the security community." A circular inset at the bottom left shows a portrait of a person in business attire. Text below the portrait reads "Alissar Abdin, Strategic Account Development Representative."

The image features a quote on a dark background with a green border and Corelight logo. The quote reads: "What's one thing you think security teams should be paying more attention to right now? 'We can't secure the future of AI if we can't see the infrastructure driving it.' – Alissar Abdin.

ALT The image features a quote on a dark background with a green border and Corelight logo. The quote reads: "What's one thing you think security teams should be paying more attention to right now? 'We can't secure the future of AI if we can't see the infrastructure driving it.' – Alissar Abdin.

A digital banner featuring the Corelight logo at the top. The text reads: "Perspectives from the security community. Follow Corelight throughout Cybersecurity Awareness Month for more perspectives from across the industry." The background has a gradient with green neon accents.

ALT A digital banner featuring the Corelight logo at the top. The text reads: "Perspectives from the security community. Follow Corelight throughout Cybersecurity Awareness Month for more perspectives from across the industry." The background has a gradient with green neon accents.

1
139
Load more