Corelight (@corelight_inc) header
Corelight (@corelight_inc) profile picture

Corelight

@corelight_inc

Corelight transforms network data into definitive evidence, powering AI-driven detection and expert-authored workflows, and enabling the AI SOC ecosystem.

 San Francisco and Columbus
corelight.com/
Joined October 2016
  • Tweets3.6K
  • Following609
  • Followers4.2K
2.1KMedia
Photo by Corelight (@corelight_inc)Photo by Corelight (@corelight_inc)Photo by Corelight (@corelight_inc)Photo by Corelight (@corelight_inc)Photo by Corelight (@corelight_inc)Photo by Corelight (@corelight_inc)Photo by Corelight (@corelight_inc)Photo by Corelight (@corelight_inc)Photo by Corelight (@corelight_inc)Photo by Corelight (@corelight_inc)
Now available on demand, our PHP2Shell tactical briefing covers CVE-2026-109618 and CVE-2026-109619 and how to use Corelight’s open-source detections to investigate suspicious HTTP activity. Zee Kallab, Yacin Nadji, and Ed Smith walk through the complementary signals from Zeek behavioral detections and Suricata signatures, the HTTP visibility required, and where to find the published detection details. Watch the briefing 👉 go.corelight.com/tactical-br…
Image from Corelight (@corelight_inc)
134
Monitoring network streams inside the Black Hat USA NOC always brings surprising attendee missteps, this time set to a mental playlist of '90s radio hits. Corelight Sr. Manager, Technical Marketing Engineering Mark Overholser breaks down two leaky application findings from the show floor. First, an Android sports betting app transmitted ad telemetry and device IDs across unencrypted NATS pub-sub streams. Second, a stock trading application passed market data in the clear alongside an X.509 certificate that expired in 2011. Both cases show how third-party software can quietly expose sensitive user and device metadata inside custom binary traffic without anyone realizing it. Discover how encrypted traffic analytics catches cleartext hiding inside custom binary protocols. Read the full NOC playlist analysis: corelight.com/blog/black-hat…
Graphic for Corelight highlighting 'Corelight in the Black Hat USA NOC: A playlist of attendee mistakes.' Features an invite to 'Read the blog' with a person smiling in front of a Black Hat USA banner. Text mentions Mark Overholser, Sr. Manager, TME, Corelight."

ALT Graphic for Corelight highlighting 'Corelight in the Black Hat USA NOC: A playlist of attendee mistakes.' Features an invite to 'Read the blog' with a person smiling in front of a Black Hat USA banner. Text mentions Mark Overholser, Sr. Manager, TME, Corelight."

26
Undocumented AI usage can put enterprise data at risk. Passive network monitoring surfaces over 180 AI services running across local wires. On-sensor detection then flags baseline deviations, like an unauthorized foreign LLM or an unapproved AI coding tool appearing in an unexpected department.
92
Unstructured prompts produce non-deterministic outputs from frontier LLMs. The Corelight Agent Builder Library packages domain-specific investigation playbooks, schema documentation, and custom skills into structured blueprints to guide agents through structured investigation steps across SIEM AI agents.
1
2
134
Autonomous security verdicts should reduce manual triage without creating black-box scores that analysts must re-investigate. Transparent AI workflows lead with explicit findings, map the full logical reasoning chain, and export pre-investigated verdicts directly into existing SIEM and ticketing tools for validation.
118
While security tools and threat vectors continuously evolve, trust remains the foundation of effective partnership. Success in complex, mission-driven environments depends on stepping back from the technology itself to focus on asking better questions and solving the hard problems that matter most. Tracey Conn, AVP, SLED, shares a core lesson from her career on why curiosity and understanding the mission matter just as much as technology. #CybersecurityAwarenessMonth
This image promotes Cybersecurity Awareness Month with the title "Perspectives from the security community." It features the Corelight logo and an inset photo of a person smiling outdoors, identified as Tracey Conn, AVP, SLED.

ALT This image promotes Cybersecurity Awareness Month with the title "Perspectives from the security community." It features the Corelight logo and an inset photo of a person smiling outdoors, identified as Tracey Conn, AVP, SLED.

The image features a quote on a dark background with green accents. It reads, "What's one lesson from your career in security that has shaped how you approach the job today?" followed by, "You can't force urgency. You have to understand the mission, uncover a problem that genuinely matters, and earn the right to help solve it." The quote is attributed to Tracey Conn. The Corelight logo is displayed in the top right corner.

ALT The image features a quote on a dark background with green accents. It reads, "What's one lesson from your career in security that has shaped how you approach the job today?" followed by, "You can't force urgency. You have to understand the mission, uncover a problem that genuinely matters, and earn the right to help solve it." The quote is attributed to Tracey Conn. The Corelight logo is displayed in the top right corner.

The image features a dark background with green rectangular outlines. At the top, there is the Corelight logo. The text reads, "Perspectives from the security community. Follow Corelight throughout Cybersecurity Awareness Month for more perspectives from across the industry.

ALT The image features a dark background with green rectangular outlines. At the top, there is the Corelight logo. The text reads, "Perspectives from the security community. Follow Corelight throughout Cybersecurity Awareness Month for more perspectives from across the industry.

81
There’s never certainty in the context of a crisis. For Corelight CISO Bernard Brantley, incident response is about building enough structure and consistency that teams can make decisions quickly, learn from them, and keep moving. That starts with knowing what matters in your environment, creating repeatable incident response processes, and using retrospectives to improve them. Bernard’s advice to CISOs goes beyond process: make the program your own. Watch now. 👇
1
95
What should happen before an AI agent closes an investigation? The answer should be more than a confidence score. Analysts need to see the investigative path, the evidence collected along the way, and the reasoning behind the final determination. That makes speed useful without asking defenders to treat the result as a black box. Explore agentic triage: corelight.com/cp/ai-soc?utm_…
Image from Corelight (@corelight_inc)
Image from Corelight (@corelight_inc)
Image from Corelight (@corelight_inc)
Image from Corelight (@corelight_inc)
94
It's easy to put your entire focus on technology when designing security controls, but ignoring human behavior can backfire. Security tools and policies only work as well as the people using them. Cloud Security Engineer Taylor Guffey shares a valuable lesson from her career. #CybersecurityAwarenessMonth
Image from Corelight (@corelight_inc)
Image from Corelight (@corelight_inc)
Image from Corelight (@corelight_inc)
1
111
Can a smarter model make up for missing evidence? Corelight tested the same investigation across multiple frontier LLMs. Model performance varied, but the ranking of the network data sources stayed largely consistent. Each model hit a similar knowledge ceiling based on the evidence available to it. Better reasoning helps with what the model can see. It cannot reconstruct evidence that was never captured. Read the research: explore.corelight.com/provab…
Image from Corelight (@corelight_inc)
Image from Corelight (@corelight_inc)
Image from Corelight (@corelight_inc)
Image from Corelight (@corelight_inc)
3
143
Exfiltration rarely looks like an emergency because attackers hide data transfers inside trusted protocols like DNS, SMB, and HTTP/S. By the time stolen data appears on an extortion site, the response window has already closed. Detecting exfiltration requires analyzing protocol behavior directly to spot unauthorized outbound transfers before data leaves the building.
1
149
Compromised eMudhra intermediate CAs can be used to issue certificates for any hostname. Clients that haven’t received trust updates may still accept them. Corelight is open-sourcing a Zeek package to help defenders identify affected certificates in network traffic and completed handshakes that may indicate client acceptance. The detection covers TLS 1.2 and earlier. The analysis also explains how to check historical Zeek logs for affected certificates. Get the Zeek detection 👉 corelight.com/blog/detect-co…
Image from Corelight (@corelight_inc)
1
2
131
🚨 Corelight has released open-source detections for PHP2Shell. Join our tactical briefing tomorrow as we walk through how to use them to investigate suspicious HTTP activity. Join Zee Kallab, Yacin Nadji, and Ed Smith for a technical discussion of the complementary signals from Zeek behavioral detections and Suricata signatures, and the HTTP visibility required to put them to work. The session covers CVE-2026-109618 and CVE-2026-109619, with guidance on where to find the published detection details. 📅 October 23 | 10 AM PT Register for the briefing 👉 go.corelight.com/tactical-br…
Image from Corelight (@corelight_inc)
2
143
Complexity is unavoidable. It expands the attack surface and makes incidents harder to understand and resolve. Corelight Co-Founder and Chief Strategy Officer Greg Bell sees automation as an increasingly important part of how security teams respond. Speed has to be balanced with accuracy. Faster conclusions don’t help if they’re wrong, and teams can’t take forever to resolve an incident. Greg shares why AI is one ingredient in that shift, alongside better data, better intelligence and workforce enablement, and why security needs to become less handcrafted over time. Watch now 👇
77
A detection should give an analyst somewhere to go next. For AI/ML detections, that means more than a verdict. Analysts need the supporting network evidence so they can inspect the activity, validate the conclusion, and continue the investigation. That evidence also gives detection engineers something concrete to refine and tune. Explore transparent detections: corelight.com/cp/ai-soc?utm_…
A person is working on a computer with code visible on the screen. The image features the logo and name, "Corelight." The text reads: "Raise the ceiling by investing in better evidence." There is a button labeled "Read Provably Better Data." The background includes a softly lit workspace.

ALT A person is working on a computer with code visible on the screen. The image features the logo and name, "Corelight." The text reads: "Raise the ceiling by investing in better evidence." There is a button labeled "Read Provably Better Data." The background includes a softly lit workspace.

85
Threat hunting often stalls when analysts have to translate investigative intent into proprietary query syntax across complex data schemas. When incident response speed matters, wrestling with syntax errors or searching documentation slows down investigation workflows
1
121
Corelight Natural Language Query (NLQ) translates plain-English questions directly into executed LogScale Query Language (LQL) syntax against Corelight Investigator data. Instead of writing syntax from scratch, analysts ask questions naturally while NLQ generates, validates, and runs the underlying query across network logs in seconds.
1
52
Corelight Product Management Leader Adam Pumphrey highlights how NLQ eliminates syntax barriers for tier-1 analysts while accelerating complex hunting workflows for senior defenders. By automating language translation into precise network queries, SOC teams spend less time building searches and more time investigating evidence.
37
Monitoring network traffic inside the Black Hat USA NOC revealed sensitive endpoint data being transmitted without encryption on the conference network. Using encrypted traffic analytics, the NOC team identified unencrypted Splunk Forwarder and BigFix streams exposing potentially sensitive user, device, and configuration information. Corelight Sr. Manager, Technical Marketing Engineering Mark Overholser highlights how self-hosted solutions configured without an encrypted communication channel can expose sensitive information when mobile clients roam to uncontrolled networks. Discover how researchers detect cleartext leaks hidden inside custom binary protocols. See the full NOC analysis 👉 corelight.com/blog/black-hat…
A digital poster from Corelight with the text: "Uncovering cleartext leaks in binary traffic. Encrypted traffic analytics exposed unencrypted management streams, user UUIDs and system configs." A green button reads "Read the NOC findings." The background features curved, glowing lines.

ALT A digital poster from Corelight with the text: "Uncovering cleartext leaks in binary traffic. Encrypted traffic analytics exposed unencrypted management streams, user UUIDs and system configs." A green button reads "Read the NOC findings." The background features curved, glowing lines.

2
138
The energy sector experienced a 142% year-over-year increase in breaches, with roughly 80% crossing the boundary from IT to OT networks. Only 58% of energy organizations feel fully prepared when it comes to OT visibility. Join Corelight and Omdia Research on November 12 to learn to close critical blind spots, defend against AI-enabled attacks, and address compliance requirements across converged IT/OT infrastructure. Reserve your spot for the live webinar: go.corelight.com/bridging-it…
This image is an advertisement for a Corelight webinar titled "Bridging the IT and OT visibility divide to protect modern energy grids." It is scheduled for November 12, 2026, at 10:00 AM PST. The image features two people: Hollie Hennessy, identified as OT/IoT Cybersecurity Lead at Omdia, and Vince Stoffer, Field CTO at Corelight. There's a "Register today" button. The background is dark with subtle green wave patterns.

ALT This image is an advertisement for a Corelight webinar titled "Bridging the IT and OT visibility divide to protect modern energy grids." It is scheduled for November 12, 2026, at 10:00 AM PST. The image features two people: Hollie Hennessy, identified as OT/IoT Cybersecurity Lead at Omdia, and Vince Stoffer, Field CTO at Corelight. There's a "Register today" button. The background is dark with subtle green wave patterns.

2
102
Load more