Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

This video walks through how Corelight Open NDR helps security teams detect EDR evasion by delivering complete visibility across all network assets. Using a real-world scenario, the video demonstrates how anomaly detection uncovers suspicious activity, mapping events directly to MITRE ATT&CK techniques. The investigation process highlights the detection of an anomalous user agent, which ultimately reveals a Linux privilege escalation toolkit.

Proven in the world’s most demanding environments, Corelight’s Open NDR Platform illuminates network blind spots and uncovers hidden threats to disrupt attacks before they escalate. Get unified visibility, multi-layered AI-driven threat detections, AI-powered triage workflows, and industry-leading forensic capabilities in one unified platform. Elite defense, now within reach of the enterprise.

In this video, we walk through the steps to enable Corelight's Anomaly Detection engine on a Corelight Sensor, and show what a sensor looks like after the baselining (learning) period has completed.