Threat Intelligence

6/5/2018
03:15 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Corelight Expands Product Portfolio with New Network Visibility Sensors

New models cover any site from branch offices to large data centers; the company also releases software to improve manageability and threat intelligence capabilities.

San Francisco, Calif.—June 5, 2018—Corelight, providers of the most powerful network visibility solution for cybersecurity, today added two new products  - the Corelight AP 200 Sensor and Corelight AP 3000 Sensor - to its portfolio. In addition, the company also rolled out several new features in its latest software release, including support for threat intel feeds and a new web app for sensor configuration and management.

Built by the creators of the Bro Network Security Monitor (aka “Bro”), Corelight Sensors make Bro simple to deploy and extend its functionality with higher performance capabilities and a suite of enterprise features such as log filtering and forking, sensor health monitoring, and streaming data export to Splunk, Elastic, Kafka, Syslog, S3, and more. Corelight’s new sensor models help round out the company’s product offerings, enabling new deployment scenarios including branch offices, large data centers, and monitoring of high-speed links.

“Since launching the first Corelight AP 1000 Sensor in 2016, we have remained committed to making sure that every new feature and model stays true to the original intent of Bro - to provide the right amount of actionable data at the right time, with the security, performance, and manageability that enterprises need,” said Brian Dye, Chief Product Officer for Corelight. “Simply put, there is no one-size-fits-all approach to network data. Our new sensor models make it possible for enterprises of all size to harness the power of Bro.”

The new Corelight AP 200 Sensor is a 1U half-depth rack mountable appliance that can monitor up to 2 Gbps of traffic, making it an ideal solution for enterprises with smaller satellite offices, branch locations or high-value enclaves that want real-time actionable insight into network data for faster incident response.

The Corelight AP 3000 Sensor builds on the power and performance of the company’s flagship Corelight AP 1000 Sensor, and can handle up to 25 Gbps to reliably scale Bro in demanding environments such as high-speed networks or Science DMZs, transforming  network traffic into high-fidelity data for analytics engines. The AP 3000 also offers shunting, a technique which optimizes analysis of certain kinds of network traffic (for example large-scale data transfers, often called ‘elephant flows’) to further improve Sensor performance. This ensures that organizations with these traffic patterns can allocate Sensor resources to the network flows that are most relevant to them.  

In addition, Corelight also unveiled new features as part of its latest software release (1.14), starting with a modern web-based user interface that dramatically streamlines sensor configuration, management, monitoring, and more. Version 1.14 also includes support for the  Bro Intelligence Framework, making it possible for customers to import and match against the threat intel feeds of their choice. Many threat intelligence companies already export in the Bro Intelligence Framework format - examples include the Anomali Threat Intelligence Platform and the ThreatConnect intel feed - and customers can easily adapt other intelligence feeds to the Bro format as well.

“You can’t defend against what you are not aware of. Good threat intel plays a critical role in providing a full picture of what could be lurking on your network,” said Dye. “We want to give our customers the ability to integrate the feeds that they have come to rely on. This was a popular feature in Bro and we are pleased to now offer it to all Corelight customers.”

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
RobiP
50%
50%
RobiP,
User Rank: Strategist
6/11/2018 | 11:16:02 AM
Supporting Bro @ scale
The new AP 200 allows enterprises to make an investment to get familiar with the Bro framework at a very low price point.
Devastating Cyberattack on Email Provider Destroys 18 Years of Data
Jai Vijayan, Freelance writer,  2/12/2019
Up to 100,000 Reported Affected in Landmark White Data Breach
Kelly Sheridan, Staff Editor, Dark Reading,  2/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8360
PUBLISHED: 2019-02-16
Themerig Find a Place CMS Directory 1.5 has SQL Injection via the find/assets/external/data_2.php cate parameter.
CVE-2019-8361
PUBLISHED: 2019-02-16
PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might, for example, be leveraged for HTML injection or URL redirection.
CVE-2019-8362
PUBLISHED: 2019-02-16
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/album_edit.php or dede/album_add.php, as demonstrated by a dede/album_edit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" (because input validation only checks that .jpg, .png, o...
CVE-2019-8363
PUBLISHED: 2019-02-16
Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=index[XSS] value.
CVE-2019-8358
PUBLISHED: 2019-02-16
In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled.