By Richard Bejtlich, Principal Security Strategist, Corelight In response to my previous article in this blog series, some readers asked “why monitor the network at all?” This question really struck me, as it relates to a core assumption of mine. In ... Read more
Corelight
Network Security Monitoring: Your best next move
By Richard Bejtlich, Principal Security Strategist, Corelight Welcome to the first in a regular series of blog posts on network security monitoring (NSM). In 2002 Bamm Visscher and I defined NSM as “the collection, analysis, and escalation of i ... Read more
Log enrichment with DNS host names
By Christian Kreibich, Senior Engineer, Corelight One of the first tasks for any incident responder when looking at network logs is to figure out the host names that were associated with an IP address in prior network activity. With Corelight’s 1.15 ... Read more
Network security monitoring vs supply chain backdoors
By Richard Bejtlich, Principal Security Strategist, Corelight On October 4, 2018, Bloomberg published a story titled “The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies,” with a subtitle “The attack by Chinese spies reached almost ... Read more
Corelight: a recipe I couldn’t refuse
By Joy Bonaguro, Head of People, Ops, and Data, Corelight It’s hard to beat a mission like transforming government for the 21st Century. That’s what I’ve been doing for more or less my entire professional life. From building information systems in Ne ... Read more