Threat Intelligence

6/5/2018
03:15 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Corelight Expands Product Portfolio with New Network Visibility Sensors

New models cover any site from branch offices to large data centers; the company also releases software to improve manageability and threat intelligence capabilities.

San Francisco, Calif.—June 5, 2018—Corelight, providers of the most powerful network visibility solution for cybersecurity, today added two new products  - the Corelight AP 200 Sensor and Corelight AP 3000 Sensor - to its portfolio. In addition, the company also rolled out several new features in its latest software release, including support for threat intel feeds and a new web app for sensor configuration and management.

Built by the creators of the Bro Network Security Monitor (aka “Bro”), Corelight Sensors make Bro simple to deploy and extend its functionality with higher performance capabilities and a suite of enterprise features such as log filtering and forking, sensor health monitoring, and streaming data export to Splunk, Elastic, Kafka, Syslog, S3, and more. Corelight’s new sensor models help round out the company’s product offerings, enabling new deployment scenarios including branch offices, large data centers, and monitoring of high-speed links.

“Since launching the first Corelight AP 1000 Sensor in 2016, we have remained committed to making sure that every new feature and model stays true to the original intent of Bro - to provide the right amount of actionable data at the right time, with the security, performance, and manageability that enterprises need,” said Brian Dye, Chief Product Officer for Corelight. “Simply put, there is no one-size-fits-all approach to network data. Our new sensor models make it possible for enterprises of all size to harness the power of Bro.”

The new Corelight AP 200 Sensor is a 1U half-depth rack mountable appliance that can monitor up to 2 Gbps of traffic, making it an ideal solution for enterprises with smaller satellite offices, branch locations or high-value enclaves that want real-time actionable insight into network data for faster incident response.

The Corelight AP 3000 Sensor builds on the power and performance of the company’s flagship Corelight AP 1000 Sensor, and can handle up to 25 Gbps to reliably scale Bro in demanding environments such as high-speed networks or Science DMZs, transforming  network traffic into high-fidelity data for analytics engines. The AP 3000 also offers shunting, a technique which optimizes analysis of certain kinds of network traffic (for example large-scale data transfers, often called ‘elephant flows’) to further improve Sensor performance. This ensures that organizations with these traffic patterns can allocate Sensor resources to the network flows that are most relevant to them.  

In addition, Corelight also unveiled new features as part of its latest software release (1.14), starting with a modern web-based user interface that dramatically streamlines sensor configuration, management, monitoring, and more. Version 1.14 also includes support for the  Bro Intelligence Framework, making it possible for customers to import and match against the threat intel feeds of their choice. Many threat intelligence companies already export in the Bro Intelligence Framework format - examples include the Anomali Threat Intelligence Platform and the ThreatConnect intel feed - and customers can easily adapt other intelligence feeds to the Bro format as well.

“You can’t defend against what you are not aware of. Good threat intel plays a critical role in providing a full picture of what could be lurking on your network,” said Dye. “We want to give our customers the ability to integrate the feeds that they have come to rely on. This was a popular feature in Bro and we are pleased to now offer it to all Corelight customers.”

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RobiP
50%
50%
RobiP,
User Rank: Strategist
6/11/2018 | 11:16:02 AM
Supporting Bro @ scale
The new AP 200 allows enterprises to make an investment to get familiar with the Bro framework at a very low price point.
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-13435
PUBLISHED: 2018-08-16
** DISPUTED ** An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method to disable passcode authentication. NOTE: the vendor indicates that this is not an attack of interest w...
CVE-2018-13446
PUBLISHED: 2018-08-16
** DISPUTED ** An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. ...
CVE-2018-14567
PUBLISHED: 2018-08-16
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVE-2018-15122
PUBLISHED: 2018-08-16
An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a compiled .NET object (such as DLL or EXE) with an embedded resource file by clicking on the resource.
CVE-2018-11509
PUBLISHED: 2018-08-16
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.