Network visibility

By assigning a Unique Connection ID (UID) to every session at ingestion, Corelight network evidence enables a session-aware approach that automatically links events such as DNS queries, SSL handshakes, and file transfers into a cohesive narrative while maintaining contextual persistence across NAT or proxy boundaries. By normalizing fragmented packet data into authoritative sequences, this telemetry reduces data dimensionality and noise, ensuring high-fidelity attribution and providing a clear causal chain of activity that accelerates triage. 

By analyzing enriched metadata from RDP and SMB protocols, such as unusual session patterns or spikes in file renaming and deletion, security teams can identify the critical staging phase of an attack.

By automatically correlating incoming network evidence with high-fidelity threat intelligence at the point of ingestion, security teams gain immediate insight into known malicious infrastructure. This enrichment provides context such as threat scores, adversary attribution, and malware families from curated feeds of indicators of compromise. This proactive visibility transforms raw metadata into an actionable map of organizational risk, ensuring that connections to suspicious IPs, file hashes, or domains are instantly highlighted within the broader network narrative.

Corelight sensors identify and log cryptographic protocols and cipher suites observed in network traffic. Corelight’s Open NDR network evidence provides detailed telemetry on cryptographic protocols and algorithms in use by parsing SSL/TLS handshakes and SSH banners, identifying cipher suites, key lengths, and certificate details for risk assessment and transition planning.

Corelight network evidence is an authoritative record of digital transactions, decoupled from monitored assets and resistant to local log tampering. By capturing "off-the-wire" metadata, it offers the critical "negative evidence" necessary to prove that a sensitive database was not accessed during a breach, thereby limiting regulatory liability for mandates like GDPR and HIPAA. Ultimately, high-fidelity telemetry provides a centralized, standardized foundation for reporting, enabling organizations to demonstrate consistent security controls across fragmented hybrid environments to auditors and legal bodies.

Corelight network evidence provides zero-impact discovery by extracting identifying data from natural network communications rather than using intrusive active scans. Through the analysis of DHCP, HTTP User-Agents, and protocol-specific banners, telemetry enables precise device fingerprinting, asset classification, and service enumeration, creating a searchable inventory of hardware and potentially vulnerable applications. This methodology enables discovery of vulnerable assets, exposed services, and cryptographic mechanisms. 

Zeek is the gold standard for network security monitoring due to ongoing community contribution, performance at scale, and provably better high-fidelity data. Corelight leverages this open-source foundation to ensure its evidence is always transparent, community-vetted, and future-proof.

Corelight reduces log volume by up to 80% through aggregation, normalization, and intelligent filtering, focusing on compact, high-value Zeek metadata, allowing you to retain years of historical evidence cost-effectively.

Yes. Corelight provides critical visibility into East-West and encrypted traffic, areas often missed by perimeter tools. It analyzes TLS handshakes and protocol activity to expose threats and anomalies without requiring full decryption.

The UID automatically links all related logs (DNS, HTTP, file transfers) from a single connection into one narrative. This eliminates the need for analysts to manually stitch data together, enabling them to move from a high-level alert to a complete attack timeline instantly.

Absolutely. Corelight’s data is structured, open (JSON/TSV), and machine-readable, making it "AI-ready" out-of-the-box. You can feed this evidence directly into LLMs and ML models to train advanced detection capabilities without costly data engineering.