Threat Intelligence

6/5/2018
03:15 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Corelight Expands Product Portfolio with New Network Visibility Sensors

New models cover any site from branch offices to large data centers; the company also releases software to improve manageability and threat intelligence capabilities.

San Francisco, Calif.—June 5, 2018—Corelight, providers of the most powerful network visibility solution for cybersecurity, today added two new products  - the Corelight AP 200 Sensor and Corelight AP 3000 Sensor - to its portfolio. In addition, the company also rolled out several new features in its latest software release, including support for threat intel feeds and a new web app for sensor configuration and management.

Built by the creators of the Bro Network Security Monitor (aka “Bro”), Corelight Sensors make Bro simple to deploy and extend its functionality with higher performance capabilities and a suite of enterprise features such as log filtering and forking, sensor health monitoring, and streaming data export to Splunk, Elastic, Kafka, Syslog, S3, and more. Corelight’s new sensor models help round out the company’s product offerings, enabling new deployment scenarios including branch offices, large data centers, and monitoring of high-speed links.

“Since launching the first Corelight AP 1000 Sensor in 2016, we have remained committed to making sure that every new feature and model stays true to the original intent of Bro - to provide the right amount of actionable data at the right time, with the security, performance, and manageability that enterprises need,” said Brian Dye, Chief Product Officer for Corelight. “Simply put, there is no one-size-fits-all approach to network data. Our new sensor models make it possible for enterprises of all size to harness the power of Bro.”

The new Corelight AP 200 Sensor is a 1U half-depth rack mountable appliance that can monitor up to 2 Gbps of traffic, making it an ideal solution for enterprises with smaller satellite offices, branch locations or high-value enclaves that want real-time actionable insight into network data for faster incident response.

The Corelight AP 3000 Sensor builds on the power and performance of the company’s flagship Corelight AP 1000 Sensor, and can handle up to 25 Gbps to reliably scale Bro in demanding environments such as high-speed networks or Science DMZs, transforming  network traffic into high-fidelity data for analytics engines. The AP 3000 also offers shunting, a technique which optimizes analysis of certain kinds of network traffic (for example large-scale data transfers, often called ‘elephant flows’) to further improve Sensor performance. This ensures that organizations with these traffic patterns can allocate Sensor resources to the network flows that are most relevant to them.  

In addition, Corelight also unveiled new features as part of its latest software release (1.14), starting with a modern web-based user interface that dramatically streamlines sensor configuration, management, monitoring, and more. Version 1.14 also includes support for the  Bro Intelligence Framework, making it possible for customers to import and match against the threat intel feeds of their choice. Many threat intelligence companies already export in the Bro Intelligence Framework format - examples include the Anomali Threat Intelligence Platform and the ThreatConnect intel feed - and customers can easily adapt other intelligence feeds to the Bro format as well.

“You can’t defend against what you are not aware of. Good threat intel plays a critical role in providing a full picture of what could be lurking on your network,” said Dye. “We want to give our customers the ability to integrate the feeds that they have come to rely on. This was a popular feature in Bro and we are pleased to now offer it to all Corelight customers.”

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RobiP
50%
50%
RobiP,
User Rank: Strategist
6/11/2018 | 11:16:02 AM
Supporting Bro @ scale
The new AP 200 allows enterprises to make an investment to get familiar with the Bro framework at a very low price point.
Weaponizing IPv6 to Bypass IPv4 Security
John Anderson, Principal Security Consultant, Trustwave Spiderlabs,  6/12/2018
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Why CISOs Need a Security Reality Check
Joel Fulton, Chief Information Security Officer for Splunk,  6/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12557
PUBLISHED: 2018-06-19
An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could ...
CVE-2018-12559
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g., outside of the /home directory tree) by passing directory traversal sequ...
CVE-2018-12560
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring.
CVE-2018-12561
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by manipulating (for example) the domain parameter of the samba URL.
CVE-2018-12562
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).