Corelight Agent Builder Library: AI Investigation Demo

What happens when you ask a generic SIEM AI assistant and a Corelight-powered threat hunter agent the exact same question about a suspicious IP? The difference is not the model. It is the investigation expertise.

In this demo, we walk through a side-by-side comparison using Elastic's agent builder. A default AI assistant returns a surface-level summary. An agent built with the Corelight Agent Builder Library identifies lateral movement, flags potential ransomware and data exfiltration, surfaces IDS alerts, maps involved hosts, and recommends next steps.

The Corelight Agent Builder Library is a free set of expert-authored resources, including playbooks, schema docs, skills, tools, and prompts, that you can plug into any AI agent framework to give your agents real network forensics expertise. Works with any LLM, any SIEM, and in air-gapped environments with local models.