Corelight Adds Agent Tools, Behavioral Threat Detection to Support AI SOC Adoption -- Security Today

Corelight’s new pitch is simple, and not very flashy

Corelight announced on Sept. 15, 2026 that it is adding an Agent Builder Library and Natural Language Query to help security teams use AI inside the SOC, while also expanding behavioral detections for AI-related abuse and stealthy network threats. Security Today covered the release on Sept. 21, 2026. This is useful work. It is not magic.

For a small or mid-sized business, the main point is not that Corelight is chasing AI. The point is that it is trying to make network evidence easier to use, and easier to act on, without asking your team to become packet analysts first. That matters if you have one security generalist, or a managed service provider watching the alerts after hours.

What the new tools actually do

The Agent Builder Library is Corelight’s way of packaging investigation logic into something customers can reuse in their own AI agents, SOAR workflows, or private LLM environments. Corelight says that logic is deterministic, documented, and exportable, including for air-gapped networks where cloud AI is off the table. That is a practical feature, not a marketing flourish.

Natural Language Query is the other half of the story. Instead of forcing an analyst to know the query syntax upfront, Corelight says users can ask plain-English questions about network evidence and get working queries back. For a busy team, that lowers the bar. It also means a newer analyst can do useful work sooner. Good. We like that.

Corelight also says its Agentic Triage and behavioral analytics can surface hidden outbound traffic patterns and suspicious activity without decrypting all traffic. For many businesses, that is the part worth paying attention to. Most companies do not have the time or budget to decrypt everything. They need enough evidence to see what is leaving the network and whether it looks wrong.

The detections that matter to a 30-person company

The new behavioral detections are aimed at AI supply-chain compromise indicators, suspicious AI gateway and provider activity, attacks on exposed AI infrastructure, anomalous AI application behavior, stealth command-and-control, and data exfiltration. That sounds broad because it is broad. The real value is in the last two. Those are the threats that cost time, money, and credibility.

Corelight’s examples are worth translating into plain English. It says it can keep 31 days of subnet-level destination history and build per-host upload baselines to expose never-before-seen countries and unusual outbound transfers. That is the kind of signal a small business actually needs. If a workstation that normally talks to San Diego and Phoenix starts sending data to a country nobody in the company does business with, somebody should know fast.

The company also says it is looking for AI-related misuse in a way that is meant to be documented and explainable, not black box guesswork. That matters because businesses do not buy security tools just to collect more alerts. They buy them to answer one question. Is this real, and what do we do next?

What we think is overhyped

The AI SOC label is getting stretched thin across the industry. Some of it is real. Some of it is a new coat of paint on old detection logic. This release is mostly the former, but the hype still outruns the average company’s need. If you are a 30-person firm with a single firewall, Microsoft 365, and a managed endpoint stack, this does not suddenly change your world.

What would change your world is missing an odd outbound transfer or not seeing that an account is being used in a strange way after a vendor compromise. That is where network behavior tools earn their keep. If Corelight helps your team spot that faster, it has done something useful. If it just produces fancier dashboards, skip it.

We also would not get distracted by the AI wording. The better question is whether the detections are documented, exportable, and usable in your existing workflow. Corelight says yes. That is the right test.

What we would do about it

If we were advising a small or mid-sized business, we would not start by chasing an AI SOC project. We would first ask whether your team can already see outbound traffic, cloud logins, and endpoint alerts in one place. If not, fix that first. If yes, a tool like this becomes more interesting because it gives your analysts better evidence, faster.

We would also ask whether you have any AI tools in use that might create risk, like public chat assistants, internal copilots, or custom integrations touching sensitive data. If the answer is yes, then detections for suspicious AI gateway activity and exposed AI infrastructure are not just buzzwords. They are a reasonable control.

The practical move is to test the product against one real incident or one recent mystery outbound connection, not a vendor slide deck. Ask whether it can show you where the traffic went, how long it has been happening, and whether the pattern is new. If it can do that cleanly, it deserves a place on the short list. IT911Now can help you decide whether this kind of visibility fits your budget and your current stack.