network visibility

The Critical Role of Network Detection and Response in Improving Enterprise Security [Q&A with Vito Rallo of PwC]

| | Blog, Cyber Threats, Cybersecurity, Incident Response, Network Security, network visibility, thought leader interviews, threat detection, Threat Hunting
Vito Rallo is Director of Cyber Incident and Threat Management at PwC. He and his team provide offensive security and incident and threat management services to medium and large enterprises. Prior to ...
Bricata | Network Detection & Response | Visibility & Analytics | Threat Hunting

Now You Know – Q&A about Bricata with CEO John Trauth

| | Blog, Incident Response, NDR, network analysis, Network Security, network threat detection, network visibility
Bricata CEO John Trauth discusses how Bricata is helping the world’s largest organizations secure their networks by delivering the most complete network detection and response (NDR) capabilities available. 1) What was your ...
Bricata | Network Detection & Response | Visibility & Analytics | Threat Hunting
Give me my stats!

Give me my stats!

| | Corelight Labs, MyStatsInfo, network detection response, network security monitoring, network traffic analysis, network visibility, scripts, Zeek, zeek logs
By Keith J. Jones, Corelight Sr. Security Researcher I often develop packages for Zeek in cluster mode. In this configuration, it can be difficult to debug your package because it is a ...
Bright Ideas Blog
Mixed VLAN tags and BPF syntax

Mixed VLAN tags and BPF syntax

| | Berkeley Packet Filter, BPF syntax, dns, Linux, Network Security, network security monitoring, network visibility, port 443, Raspberry Pi, SPAN port, TCP, tcpdump, Ubiquiti, VLAN, Wireshark, Zeek
By Richard Bejtlich, Principal Security Strategist, Corelight This post contains a warning and a solution for anyone using BPF syntax when filtering traffic for network security monitoring.  Introduction I have been writing ...
Bright Ideas Blog

Zeek & Sigma: Fully Compatible for Cross-SIEM Detections

| | encrypted traffic collection, Joe Sandbox, Microsoft Azure, MISP, NDR, network detection response, Network Security, network traffic analysis, network visibility, partnership, SANS, SIEM, Sigma, SOC, SOC Prime, Yara, Zeek
By Alex Kirk, Corelight Global Principal for Suricata Corelight recently teamed up with SOC Prime, creators of advanced cyber analytics platforms, to add support for the entire Zeek data set into Sigma, ...
Bright Ideas Blog

Chocolate and Peanut Butter, Zeek and Suricata

| | Announcements, http, Network Security, network security monitoring, network traffic analysis, network visibility, pcap, SANS, SIEM, Suricata, UID, Zeek
By Brian Dye, Chief Product Officer, Corelight Some things just go well together. A privilege of working with very sophisticated defenders in the open source community is seeing the design patterns they ...
Bright Ideas Blog

The light shines even brighter: Updates to Corelight’s Encrypted Traffic Collection

| | agent forwarding, Announcements, Authentication, Chrome, dns, DoH, encrypted traffic, encrypted traffic collection, Firefox, network security monitoring, network traffic analysis, network visibility, reverse tunnel, SSH, Suricata, Zeek
By Vince Stoffer, Senior Director, Product Management, Corelight With Corelight’s latest software release, v19, we are excited to announce the expansion of our Encrypted Traffic Collection (ETC). The ETC was introduced in ...
Bright Ideas Blog
Detecting GnuTLS CVE-2020-13777 using Zeek

Detecting GnuTLS CVE-2020-13777 using Zeek

| | Apache, Corelight Labs, CVE-2020-13777, GnuTLS, mitm, Network Security, network security monitoring, network traffic analysis, network visibility, Open Source Community, openssl, pcap, Public Key Cryptography, TLS, TLS 1.2, TLS 1.3, Zeek
By Johanna Amann, Software Engineer, Corelight CVE-2020-13777 is a high severity issue in GnuTLS. In a nutshell, GnuTLS versions between 3.6.4 (released 2018-09-24) and 3.6.14 (2020-06-03) have a serious bug in their ...
Bright Ideas Blog
Watch over DNS traffic with Corelight & Splunk

Watch over DNS traffic with Corelight & Splunk

| | dns, network security monitoring, network traffic analysis, network visibility, NTA, partnership, SIEM, Splunk
By Roger Cheeks, Solutions Engineer, Corelight Corelight sensors put your organization in the best position to watch over DNS traffic with a rich, powerful Network Traffic Analysis (NTA) data set. This article ...
Bright Ideas Blog

The High Ground

| | Announcements, Industry, Network Security, network security monitoring, network traffic analysis, network visibility, Zeek
By Charles Strauss, Senior Brand Copywriter, Corelight Introducing Corelight’s new story + the value of NTA From the Greek Acropolis to the Space Race, defenders have sought the high ground. Up there, ...
Bright Ideas Blog
Load more