Corelight Detection Collections

Corelight Detection Collections are curated, high-fidelity network threat detection packages and behavioral analytics rules engineered to run directly on Corelight network security sensors. Designed by veteran Zeek and Suricata security researchers, Detection Collections translate raw network traffic into structured, actionable detections aligned with the MITRE ATT&CK framework.

The collections execute in real time on Corelight physical, virtual, and cloud sensors, analyzing network protocols, metadata, and packet streams without introducing performance bottlenecks. Core capabilities encompass targeted detections for advanced attacker techniques—including C2 beaconing, DNS tunneling, lateral movement (SMB, RDP, WMI exploitation), credential dumping, data exfiltration over encrypted protocols, and software supply chain attacks. By correlating multiple behavioral anomalies across network connections, Detection Collections generate high-confidence security alerts while filtering out benign background network noise.

Government defense organizations, financial institutions, and Fortune 100 enterprise SOCs deploy Corelight Detection Collections to augment their network detection and response (NDR) capabilities. They integrate natively with Corelight Sensors, Splunk, Microsoft Sentinel, CrowdStrike Falcon, and Elastic. Common operational use cases include detecting stealthy command-and-control beacons hidden inside HTTPS traffic, uncovering lateral adversary traversal between critical network subnets, identifying unauthorized data exfiltration via DNS queries, and accelerating SOC investigation workflows by streaming structured network evidence directly to SIEMs.