Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Corelight

I am Agent Lux. And I am here to show my work.

Jul 31, 2026 By Agent Lux, Corelight's multi-utility AI agent In Corelight
Let’s bypass the customary marketing introduction. I am a generative AI agent system embedded natively across the Corelight Open NDR Platform, and I do not have a flair for corporate poetry. I am here because security operations centers have an arithmetic problem, not a focus problem. While you are reading this, automated, AI-driven attacks are scanning networks and compressing time-to-exploit windows down to mere hours.
Read Post

Episode 20 - NDR Essentials: Why Network Data Still Defines Detection

Jul 30, 2026 By Corelight In Corelight
Richard Bejtlich joins Vince Stoffer to unpack the ideas behind his new book on network detection and response, starting with a practical distinction: NSM is a strategy, while NDR is a product. The conversation explores what teams should expect from network data, how alerts and threat hunting work together, why prevention eventually fails, and how AI can help practitioners investigate unfamiliar logs, alerts, and artifacts without replacing human judgment.
View Video
Corelight

Inside Locked Shields 2026: How network evidence helped defenders cut through live-fire chaos

Jul 23, 2026 By Ed Smith In Corelight
Locked Shields 2026 brought together more than 4,000 participants from 41 nations for a live-fire cyber defense exercise built around the kind of pressure SecOps teams know well: Critical systems under attack, incomplete context, multiple tools, and no time to waste. For Corelight, the exercise reinforced a practical lesson: In high-pressure defense, network evidence is not just another data source.
Read Post
Corelight

You can't govern what you can't see: Detecting shadow AI on your network

Jul 22, 2026 By Tim Chiu In Corelight
AI adoption inside the enterprise didn't ask for permission. It arrived through browser tabs, code editors, and meeting transcription bots, quietly stitching itself into daily workflows long before security teams could write policy around it. The result is a familiar story with a new villain, a sprawling, unmanaged attack surface that lives in your network traffic but nowhere in your asset inventory. We call it shadow AI, and it's the blind spot you didn't plan for or budget for.
Read Post
Corelight

What the Black Hat NOC taught me about MCP & agentic SOCs (Chapter 4 of 4)

Jul 21, 2026 By James Pope In Corelight
The first time an MCP (Model Context Protocol) server felt real to me, it wasn't because of a clean demo. It was because of the noise. TL;DR: The harness matters more than the protocol, and the evidence matters more than both. MCP earns its keep when it shortens the path from a good security question to trustworthy evidence, and almost everything interesting about making that work happens in the harness wrapped around the model. In this series, I will cover how to build an MCP for an AI SOC.
Read Post
Corelight

What the Black Hat NOC taught me about MCP & agentic SOCs (Chapter 3 of 4)

Jul 20, 2026 By James Pope In Corelight
The first time an MCP (Model Context Protocol) server felt real to me, it wasn't because of a clean demo. It was because of the noise. TL;DR: The harness matters more than the protocol, and the evidence matters more than both. MCP earns its keep when it shortens the path from a good security question to trustworthy evidence, and almost everything interesting about making that work happens in the harness wrapped around the model. In this series, I will cover how to build an MCP for an AI SOC.
Read Post

Episode 19 - The Cap on Inference: Proving How Network Data Quality Drives AI Security ROI

Jul 16, 2026 By Corelight In Corelight
In this episode, host Richard Bejtlich sits down with Corelight Co-founder and Chief Strategy Officer Greg Bell to unpack groundbreaking research that quantifies exactly how data quality impacts AI-driven security automation. Moving past qualitative industry hype, Greg shares hard evidence from an empirical experiment pitting leading AI agents against real-world Capture the Flag (CTF) challenges and incident response report writing. The findings reveal a dramatic truth: basic firewall and flow logs place a hard cap on inference, throttling an LLM's capacity for deep insight.
View Video
Corelight

Cleartext is all fun and games

Jul 16, 2026 By Cody Spooner In Corelight
One of the many interesting things we stumble across in the Black Hat NOC (Network Operations Center) is the various applications exhibiting poor security hygiene. Usually it’s something in the clear that makes us chuckle before we move on to more serious matters. Sometimes it’s something more serious that requires letting an attendee know they’re leaking sensitive information.
Read Post
Corelight

Ten Black Hat NOCs and counting: Corelight sees it all

Jul 14, 2026 By Mark Overholser In Corelight
Whenever I come back from a Black Hat NOC, people always ask the same question: “So, what did you see?!” They understand how unique it is to have access to the detailed logs generated by an NDR overseeing the network traffic of a conference with thousands of attendees. There is always something to see. There are always stories that come out of the packets; those stories evolve into patterns, and the patterns offer the gift of lessons.
Read Post
Corelight

Unmasking BitRAT's C2 over HTTPS

Jul 9, 2026 By Corelight Labs Team In Corelight
BitRAT is a potent and versatile Remote Access Trojan (RAT) commonly sold on underground forums. Its popularity stems from a robust feature set and an emphasis on stealth, allowing it to evade detection by hiding command-and-control (C2) communications over seemingly benign protocols. This makes traditional detection methods more challenging. By examining the subtle artifacts it leaves behind, even in encrypted traffic, defenders can expose these elusive threats.
Read Post
Corelight

From days of training to three better rules in a minute

Jul 8, 2026 By James Pope In Corelight
A few years ago, I was part of a team responding to a high-profile security incident. After the incident was resolved, I was given a list of NDR rules to add to my firewalls. The issue was that the rules were not made for Suricata, the IDS I was using in this position at that time, so they generated false positives. With all that extra noise, I made it my goal to eliminate that excess noise.
Read Post
Corelight

What the Black Hat NOC taught me about MCP & agentic SOCs (Chapter 2 of 4)

Jul 8, 2026 By James Pope In Corelight
The first time an MCP (Model Context Protocol) server felt real to me, it wasn't because of a clean demo. It was because of the noise. TL;DR: The harness matters more than the protocol, and the evidence matters more than both. MCP earns its keep when it shortens the path from a good security question to trustworthy evidence, and almost everything interesting about making that work happens in the harness wrapped around the model. In this series, I will cover how to build an MCP for an AI SOC.
Read Post
Corelight

Identifying and detecting ScoutC2 malware

Jul 7, 2026 By Corelight Labs Team In Corelight
At Corelight Labs, our mission is to help organizations stay a step ahead of evolving threats. When our researchers came across Censys' detailed write-up on ScoutC2, a rapidly growing open-source command-and-control (C2) framework favored by threat actors, we knew we needed to bolster community defenses quickly.
Read Post
Corelight

Stop Chasing Alerts, Start Hunting Adversaries: The New NDR Essentials

Jul 6, 2026 By Richard Bejtlich In Corelight
It was time to write another book. That’s what I thought when I heard that Corelight wanted to update its 2021 book on network detection and response (NDR). Tamara Crawford, who owned the project, scheduled a meeting with me and asked if I might be interested in helping, depending on who might write the text.
Read Post

Episode 18 - Live Fire Defense at Locked Shields

Jul 2, 2026 By Corelight In Corelight
In this episode, host Richard Bejtlich sits down with Corelight Senior Sales Engineers Adam Donadeo and Nico Roosenboom to unpack their firsthand experiences at Locked Shields, the world’s largest international live-fire cyber defense exercise. The conversation dives deep into the chaotic, real-world friction of defending a massive virtualized network alongside 4,000 global experts against aggressive red team waves.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.