Corelight transforms network data into definitive evidence, powering AI-driven detection and expert-authored workflows, and enabling the AI SOC ecosystem.
San Francisco and Columbus
Joined October 2016
- Tweets3.6K
- Following609
- Followers4.2K
- Likes2.8K
Pinned Tweet
Now available on demand, our PHP2Shell tactical briefing covers CVE-2026-109618 and CVE-2026-109619 and how to use Corelight’s open-source detections to investigate suspicious HTTP activity.
Zee Kallab, Yacin Nadji, and Ed Smith walk through the complementary signals from Zeek behavioral detections and Suricata signatures, the HTTP visibility required, and where to find the published detection details.
Watch the briefing 👉 go.corelight.com/tactical-br…
What should happen before an AI agent closes an investigation?
The answer should be more than a confidence score. Analysts need to see the investigative path, the evidence collected along the way, and the reasoning behind the final determination.
That makes speed useful without asking defenders to treat the result as a black box.
Explore agentic triage: corelight.com/cp/ai-soc?utm_…
It's easy to put your entire focus on technology when designing security controls, but ignoring human behavior can backfire. Security tools and policies only work as well as the people using them.
Cloud Security Engineer Taylor Guffey shares a valuable lesson from her career.
#CybersecurityAwarenessMonth
Can a smarter model make up for missing evidence?
Corelight tested the same investigation across multiple frontier LLMs. Model performance varied, but the ranking of the network data sources stayed largely consistent.
Each model hit a similar knowledge ceiling based on the evidence available to it.
Better reasoning helps with what the model can see. It cannot reconstruct evidence that was never captured.
Read the research: explore.corelight.com/provab…
Exfiltration rarely looks like an emergency because attackers hide data transfers inside trusted protocols like DNS, SMB, and HTTP/S.
By the time stolen data appears on an extortion site, the response window has already closed. Detecting exfiltration requires analyzing protocol behavior directly to spot unauthorized outbound transfers before data leaves the building.
Compromised eMudhra intermediate CAs can be used to issue certificates for any hostname. Clients that haven’t received trust updates may still accept them.
Corelight is open-sourcing a Zeek package to help defenders identify affected certificates in network traffic and completed handshakes that may indicate client acceptance.
The detection covers TLS 1.2 and earlier. The analysis also explains how to check historical Zeek logs for affected certificates.
Get the Zeek detection 👉 corelight.com/blog/detect-co…
🚨 Corelight has released open-source detections for PHP2Shell. Join our tactical briefing tomorrow as we walk through how to use them to investigate suspicious HTTP activity.
Join Zee Kallab, Yacin Nadji, and Ed Smith for a technical discussion of the complementary signals from Zeek behavioral detections and Suricata signatures, and the HTTP visibility required to put them to work.
The session covers CVE-2026-109618 and CVE-2026-109619, with guidance on where to find the published detection details.
📅 October 23 | 10 AM PT
Register for the briefing 👉 go.corelight.com/tactical-br…
Complexity is unavoidable. It expands the attack surface and makes incidents harder to understand and resolve.
Corelight Co-Founder and Chief Strategy Officer Greg Bell sees automation as an increasingly important part of how security teams respond. Speed has to be balanced with accuracy. Faster conclusions don’t help if they’re wrong, and teams can’t take forever to resolve an incident.
Greg shares why AI is one ingredient in that shift, alongside better data, better intelligence and workforce enablement, and why security needs to become less handcrafted over time.
Watch now 👇
A detection should give an analyst somewhere to go next.
For AI/ML detections, that means more than a verdict. Analysts need the supporting network evidence so they can inspect the activity, validate the conclusion, and continue the investigation.
That evidence also gives detection engineers something concrete to refine and tune.
Explore transparent detections: corelight.com/cp/ai-soc?utm_…
ALT A person is working on a computer with code visible on the screen. The image features the logo and name, "Corelight." The text reads: "Raise the ceiling by investing in better evidence." There is a button labeled "Read Provably Better Data." The background includes a softly lit workspace.
Threat hunting often stalls when analysts have to translate investigative intent into proprietary query syntax across complex data schemas.
When incident response speed matters, wrestling with syntax errors or searching documentation slows down investigation workflows
Corelight Natural Language Query (NLQ) translates plain-English questions directly into executed LogScale Query Language (LQL) syntax against Corelight Investigator data.
Instead of writing syntax from scratch, analysts ask questions naturally while NLQ generates, validates, and runs the underlying query across network logs in seconds.
Corelight Product Management Leader Adam Pumphrey highlights how NLQ eliminates syntax barriers for tier-1 analysts while accelerating complex hunting workflows for senior defenders.
By automating language translation into precise network queries, SOC teams spend less time building searches and more time investigating evidence.
Monitoring network traffic inside the Black Hat USA NOC revealed sensitive endpoint data being transmitted without encryption on the conference network.
Using encrypted traffic analytics, the NOC team identified unencrypted Splunk Forwarder and BigFix streams exposing potentially sensitive user, device, and configuration information.
Corelight Sr. Manager, Technical Marketing Engineering Mark Overholser highlights how self-hosted solutions configured without an encrypted communication channel can expose sensitive information when mobile clients roam to uncontrolled networks.
Discover how researchers detect cleartext leaks hidden inside custom binary protocols. See the full NOC analysis 👉 corelight.com/blog/black-hat…
ALT A digital poster from Corelight with the text: "Uncovering cleartext leaks in binary traffic. Encrypted traffic analytics exposed unencrypted management streams, user UUIDs and system configs." A green button reads "Read the NOC findings." The background features curved, glowing lines.
The energy sector experienced a 142% year-over-year increase in breaches, with roughly 80% crossing the boundary from IT to OT networks.
Only 58% of energy organizations feel fully prepared when it comes to OT visibility.
Join Corelight and Omdia Research on November 12 to learn to close critical blind spots, defend against AI-enabled attacks, and address compliance requirements across converged IT/OT infrastructure.
Reserve your spot for the live webinar: go.corelight.com/bridging-it…
ALT This image is an advertisement for a Corelight webinar titled "Bridging the IT and OT visibility divide to protect modern energy grids." It is scheduled for November 12, 2026, at 10:00 AM PST. The image features two people: Hollie Hennessy, identified as OT/IoT Cybersecurity Lead at Omdia, and Vince Stoffer, Field CTO at Corelight. There's a "Register today" button. The background is dark with subtle green wave patterns.
Corelight has released open-source Zeek and Suricata detections for php2shell, two serious PHP remote code execution (RCE) vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.
Developed as part of a coordinated response with OpenAI, PHP, and other organizations, the detections flag suspicious HTTP activity and advertised PHP versions for patch review.
Read the analysis and access the detections 👉 corelight.com/blog/php2shell…
Post-quantum cryptography can bring larger TLS handshakes and changes to traffic patterns across enterprise networks.
Even as encryption algorithms change, defenders retain visibility into connection metadata and network evidence without relying on line-rate decryption.
If this host has been compromised, which other systems could the attacker target next?
Exposure data helps identify what could be exploited. Network evidence helps reveal what is actually happening.
In a working lab, we connected an AI agent to the Corelight and Tenable MCP servers to bring those perspectives together. One investigation traced a critical-severity alert to authorized vulnerability scanning. Another identified vulnerable systems on an administrator's workstation's observed network paths, helping assess the potential blast radius of a compromise.
The agent had no shell access to any host. Everything it concluded came from network evidence and exposure data.
Read the blog: corelight.com/blog/agentic-a…
Adapting to the fast changes in cybersecurity requires more than learning new technology. Community makes a difference. While technology provides the foundation, real-world context gained from face-to-face community connection is what shapes effective, adaptable problem-solving.
Alissar Abdin, Strategic Account Development Representative, tells us why stepping away from the screen and connecting with peers has been the most important lesson of their career.
#CybersecurityAwarenessMonth
ALT This image is a graphic for Corelight, featuring the text: "Cybersecurity Awareness Month. Perspectives from the security community." It shows a photograph of a person identified as Alissar Abdin, labeled as a Strategic Account Development Representative.
ALT Image with black background featuring a quote in white and teal text. At the top, the text reads: "What's one lesson from your career in security that has shaped how you approach the job today?" Below, the quote states: "The tech is critical, but human connection and community are what keep us adaptable.” The author is noted as Alissar Abdin. In the top right corner, a logo for "Corelight" is displayed.
ALT A black and green graphic with the Corelight logo. Text reads: "Perspectives from the security community. Follow Corelight throughout Cybersecurity Awareness Month for more perspectives from across the industry."
Identity is important, but it can’t give defenders the full picture of attacker intent.
Ali Islam Khan, Vice President of Corelight Labs, explains why network behavior can help teams audit what an identity is actually doing, especially as nation-state actors increasingly use open-source tools and living-off-the-land techniques.
That same data foundation matters as AI becomes part of more security workflows. Without high-fidelity data, the quality of what security teams get back from AI suffers.
Watch now 👇
What can an AI agent answer when the evidence it needs isn’t in the data?
In Corelight’s research, switching between the tested frontier models made relatively little difference to performance on a capture-the-flag exercise. Holding the model fixed and changing the network data produced much larger differences in the questions the agent could answer.
Corelight co-founder and Chief Strategy Officer Greg Bell joins James Wilson on Risky Biz to discuss the findings and why data needs to be a first-class citizen when designing an agentic SOC.
Listen to the conversation 👉 youtube.com/watch?v=S1GjydKz…
ALT The image is a graphic for "Risky Business: Episode 855" featuring Corelight. It includes a "Watch now" button and highlights Greg Bell as the Co-Founder and Chief Strategy Officer.