Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

6/5/2018
03:15 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Corelight Expands Product Portfolio with New Network Visibility Sensors

New models cover any site from branch offices to large data centers; the company also releases software to improve manageability and threat intelligence capabilities.

San Francisco, Calif.—June 5, 2018—Corelight, providers of the most powerful network visibility solution for cybersecurity, today added two new products  - the Corelight AP 200 Sensor and Corelight AP 3000 Sensor - to its portfolio. In addition, the company also rolled out several new features in its latest software release, including support for threat intel feeds and a new web app for sensor configuration and management.

Built by the creators of the Bro Network Security Monitor (aka “Bro”), Corelight Sensors make Bro simple to deploy and extend its functionality with higher performance capabilities and a suite of enterprise features such as log filtering and forking, sensor health monitoring, and streaming data export to Splunk, Elastic, Kafka, Syslog, S3, and more. Corelight’s new sensor models help round out the company’s product offerings, enabling new deployment scenarios including branch offices, large data centers, and monitoring of high-speed links.

“Since launching the first Corelight AP 1000 Sensor in 2016, we have remained committed to making sure that every new feature and model stays true to the original intent of Bro - to provide the right amount of actionable data at the right time, with the security, performance, and manageability that enterprises need,” said Brian Dye, Chief Product Officer for Corelight. “Simply put, there is no one-size-fits-all approach to network data. Our new sensor models make it possible for enterprises of all size to harness the power of Bro.”

The new Corelight AP 200 Sensor is a 1U half-depth rack mountable appliance that can monitor up to 2 Gbps of traffic, making it an ideal solution for enterprises with smaller satellite offices, branch locations or high-value enclaves that want real-time actionable insight into network data for faster incident response.

The Corelight AP 3000 Sensor builds on the power and performance of the company’s flagship Corelight AP 1000 Sensor, and can handle up to 25 Gbps to reliably scale Bro in demanding environments such as high-speed networks or Science DMZs, transforming  network traffic into high-fidelity data for analytics engines. The AP 3000 also offers shunting, a technique which optimizes analysis of certain kinds of network traffic (for example large-scale data transfers, often called ‘elephant flows’) to further improve Sensor performance. This ensures that organizations with these traffic patterns can allocate Sensor resources to the network flows that are most relevant to them.  

In addition, Corelight also unveiled new features as part of its latest software release (1.14), starting with a modern web-based user interface that dramatically streamlines sensor configuration, management, monitoring, and more. Version 1.14 also includes support for the  Bro Intelligence Framework, making it possible for customers to import and match against the threat intel feeds of their choice. Many threat intelligence companies already export in the Bro Intelligence Framework format - examples include the Anomali Threat Intelligence Platform and the ThreatConnect intel feed - and customers can easily adapt other intelligence feeds to the Bro format as well.

“You can’t defend against what you are not aware of. Good threat intel plays a critical role in providing a full picture of what could be lurking on your network,” said Dye. “We want to give our customers the ability to integrate the feeds that they have come to rely on. This was a popular feature in Bro and we are pleased to now offer it to all Corelight customers.”

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RobiP
50%
50%
RobiP,
User Rank: Strategist
6/11/2018 | 11:16:02 AM
Supporting Bro @ scale
The new AP 200 allows enterprises to make an investment to get familiar with the Bro framework at a very low price point.
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-5285
PUBLISHED: 2019-11-15
Null pointer dereference vulnerability exists in K11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime in NSS before 3.26, which causes the TLS/SSL server using NSS to crash.
CVE-2009-5047
PUBLISHED: 2019-11-15
Jetty 6.x before 6.1.22 suffers from an escape sequence injection vulnerability from two different vectors: 1) "Cookie Dump Servlet" and 2) Http Content-Length header. 1) A POST request to the form at "/test/cookie/" with the "Age" parameter set to a string throws a &qu...
CVE-2013-4584
PUBLISHED: 2019-11-15
Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers not being applied to STARTTLS connections
CVE-2013-7087
PUBLISHED: 2019-11-15
ClamAV before 0.97.7 has WWPack corrupt heap memory
CVE-2013-7088
PUBLISHED: 2019-11-15
ClamAV before 0.97.7 has buffer overflow in the libclamav component