Corelight DefeNDRs

Richard Bejtlich

Gain clear, actionable intelligence from Corelight's network defense experts. Corelight DefeNDRs translates complex cybersecurity detection challenges into concise, practical episodes designed to support faster, smarter decision-making across modern security teams.

  1. Episode 13 - Battle-Hardened Research: Navigating the Intersection of AI and Open Source

    APR 23

    Episode 13 - Battle-Hardened Research: Navigating the Intersection of AI and Open Source

    Richard Bejtlich sits down with Ali Islam to pull back the curtain on how a security research lab functions within a modern security company. Moving beyond the "ivory tower" of academia, Ali explains why researchers must be battle-hardened by real-world threat actor techniques to remain effective in the field. The conversation dives into Corelight’s unique commitment to the open source community through the direct funding of Zeek and Suricata developers, ensuring that community-driven tools can scale to meet massive enterprise traffic demands. Finally, they explore the accelerating role of artificial intelligence in cybersecurity, weighing its ability to reduce analyst fatigue against the growing sophistication of AI-powered phishing and malware development.

    16 min
  2. Episode 12 - The Agentic SOC: Upleveling Analysts with AI Knowledge Multipliers

    APR 9

    Episode 12 - The Agentic SOC: Upleveling Analysts with AI Knowledge Multipliers

    Richard Bejtlich sits down with Stan Kiefer, Corelight’s Senior Manager for Data Science, to discuss how AI serves as a vital "abstraction layer" and "knowledge multiplier" for security analysts. Stan explains that while AI can synthesize complex information, it remains untrustworthy without high-fidelity network data at its center to provide verifiable evidence. The episode explores the shift toward an "agentic ecosystem" and a tiered architecture where a central orchestrator manages specialized sub-agents to accelerate detection and investigation. Looking toward the future, Stan envisions a hybrid SOC environment where adaptive systems learn an analyst's specific workflows to automate routine tasks, acting as a professional companion that can cut the time needed to reach competency in half.

    17 min
  3. Episode 11 - The AI Maturity Journey: Data, Agents, and the Shift from Craft to Art

    MAR 26

    Episode 11 - The AI Maturity Journey: Data, Agents, and the Shift from Craft to Art

    Richard Bejtlich talks with Vijit Nair, VP of Product at Corelight, about the evolving "AI Maturity Journey" for modern security teams. Vijit outlines a three-level spectrum of AI adoption, moving from basic human-driven assistance to automated swarms of agents, and eventually toward fully autonomous systems. They discuss why high-quality, unopinionated data remains the essential foundation for building trust in AI and how technologies like the Model Context Protocol (MCP) are turning human language into the primary interface for tool integration. The conversation explores the partnership between Corelight and CrowdStrike Charlotte AI as a real-world example of this connected ecosystem. Finally, Vijit and Richard reflect on how AI is "eating the craft" of security—automating away the mind-numbing manual tasks of a SOC—to allow analysts to focus on the "art" of judgment, creativity, and strategic defense.

    17 min
  4. Episode 10 - From Lab Research to Founder: Grit and The Leap into Cybersecurity

    MAR 12

    Episode 10 - From Lab Research to Founder: Grit and The Leap into Cybersecurity

    Richard Bejtlich sits down with Greg Bell, Corelight co-founder and Chief Strategy Officer, to explore the transition from elite academic research to the world of venture-backed startups. Greg shares the "light bulb moment" at Lawrence Berkeley National Laboratory that led a group of scientists to turn Zeek (formerly Bro) into a commercial reality. The conversation covers the "virtuous cycle" between open-source projects and sustainable business models, explaining why professional maintenance is critical for mission-critical software. Greg also offers practical perspective for the next generation of defenders, discussing the role of "applied curiosity" in a shifting job market and his personal experience with the "grit" required to leave a secure career for the uncertainty of a startup. Whether you are a network operator or interested in the mechanics of tech entrepreneurship, this episode offers a candid look at the challenges of bridging the gap between research and industry.

    19 min
  5. Episode 9 - Federal Cyber Defense: Legacy Debt, Cloud Shifts, and Network Truth

    FEB 26

    Episode 9 - Federal Cyber Defense: Legacy Debt, Cloud Shifts, and Network Truth

    Richard Bejtlich sits down with Jean Schaffer, Corelight’s Federal CTO, to discuss the unique hurdles facing government agencies in an era of escalating state-sponsored threats. Jean highlights the persistent challenge of legacy IT infrastructure and the "technical debt" that complicates modernization efforts across the Department of Defense, the intelligence community, and the civilian sector. The conversation explores the strategic shift toward cloud adoption as a means to decommission vulnerable on-premise hardware and the evolving "whole of nation" defense strategy that requires deeper public-private partnerships. Jean also offers her perspective on the risks and rewards of open-source software in government environments, emphasizing the importance of code provenance. Finally, they delve into why Zero Trust architectures still require robust network telemetry as a foundational element to verify that security policies are actually working in the real world.

    15 min
  6. Episode 8 - Enterprise Nervous System: Using Network Signal to Direct Business Strategy

    FEB 20

    Episode 8 - Enterprise Nervous System: Using Network Signal to Direct Business Strategy

    In this episode of Corelight Defenders, I'm joined by Bernard Brantley, Chief Information Security Officer at Corelight, as we delve into the concept of the enterprise nervous system. Bernard shares insights from his extensive experience in network analysis, explaining how organizations can leverage their network traffic data to enhance security and drive business outcomes. We discuss the importance of understanding the interdependencies between assets, processes, and goals, and how security teams can position themselves as integral to business success rather than just risk mitigators. Join us as we explore how security can effectively align with business strategies, fostering a culture of proactive engagement and intelligence sharing.

    18 min
  7. Episode 7 - Practical AI for Zeek, MITRE, and Security Docs

    JAN 29

    Episode 7 - Practical AI for Zeek, MITRE, and Security Docs

    In Episode 7 of Corelight DefeNDRs, join me, Richard Bejtlich, as I sit down with Dr. Keith Jones, Corelight's principal security researcher, to discuss the practical applications of AI in enhancing network security. We delve into how large language models (LLMs) can assist in cleaning up documentation and generating Zeek scripts, sharing insights from our extensive experience in incident response and coding. Keith reveals the challenges and successes he has encountered using LLMs to streamline processes, including their role in analyzing MITRE techniques. Whether you're a seasoned coder or new to the field, this episode offers valuable perspectives on leveraging AI tools to improve efficiency and effectiveness in security operations. Tune in for a thought-provoking conversation that bridges AI innovation with real-world cybersecurity challenges.

    15 min
  8. Episode 6 - Detecting DNS Covert Channels in the Wild (Part 2)

    JAN 15

    Episode 6 - Detecting DNS Covert Channels in the Wild (Part 2)

    In Episode 6 of Corelight DefeNDRs, we delve deeper into the fascinating world of DNS covert channels with Vern Paxson, our chief scientist and co-founder. Continuing from our previous discussion, Vern shares his insights on techniques developed to detect these stealthy channels utilized by intruders to evade security measures. We explore the innovative approach of leveraging time series analysis of DNS lookups, how to distinguish benign traffic from potential threats, and the real-world implications of our findings across significant datasets. This episode is a must-listen for anyone interested in enhancing their understanding of network detection and response, as we uncover the delicate balance between legitimate data communication and covert malicious activity. Join me as we navigate these complex yet critical aspects of cybersecurity.

    14 min
See All (13)

Ratings & Reviews

5
out of 5
3 Ratings

About

Gain clear, actionable intelligence from Corelight's network defense experts. Corelight DefeNDRs translates complex cybersecurity detection challenges into concise, practical episodes designed to support faster, smarter decision-making across modern security teams.

Information

  • Creator
    Richard Bejtlich
  • Years Active
    2025 - 2026
  • Episodes
    13
  • Rating
    Clean

You Might Also Like