Corelight Adds Agent Tools, Behavioral Threat Detection to Support AI SOC Adoption
Analytics use destination history and per-host upload baselines to flag stealth command-and-control traffic and unusual outbound transfers.
- By Danielle Naidu
- Sep 21, 2026
Corelight has introduced two investigation tools and expanded its detection coverage for threats involving artificial intelligence: the Agent Builder Library and Natural Language Query. The company said the update is intended to support AI SOC adoption.
Detection changes address unusual AI application behavior, attacks against exposed AI infrastructure, suspicious provider or gateway activity and indicators connected to AI supply-chain compromises. To identify stealth command-and-control traffic and possible data exfiltration, the company said its analytics compare individual hosts against upload baselines and evaluate destinations using 31 days of subnet history.
Natural Language Query builds editable LogScale queries from questions submitted in everyday language. Corelight said the queries are checked before being run against the organization’s network data. The Agent Builder Library packages documented investigation material for use in customer AI agents, security orchestration, automation and response workflows, and private large language model environments. Its logic can also operate without cloud access in air-gapped and classified networks, the company said.
Signals generated by the expanded Anomaly Engine are routed into Agentic Triage and the library’s investigation playbooks. Analysts can examine the playbook, behavioral signals and network evidence behind each verdict. Corelight said the capabilities are designed to support incident-response documentation under NIS2, DORA, SEC disclosure rules and CMMC 2.0.
About the Author
Danielle Naidu is assistant editor for Security Today, Campus Security Today, Occupational Health & Safety and Environmental Protection Online.