Corelight Agent Builder Library, Natural Language Query, and expanded AI-threat detection

Corelight announced (Sept 15, 2026) the Agent Builder Library (deterministic, exportable network-forensics playbooks/decision trees for building trustworthy SOC agents), Natural Language Query (plain-English queries generating auditable LogScale queries), and expanded detection for AI supply-chain compromise, anomalous AI application behavior, and stealth AI-driven C2/exfiltration.

Targets the 'AI-speed attack' problem (median exploit time ~5 days vs 60-150 day patch cycles) by giving SOC teams auditable, deterministic building blocks for agentic detection/response rather than opaque LLM verdicts — relevant to NIS2/DORA/SEC disclosure defensibility requirements.

Network security/SOC teams already using Corelight NDR should evaluate the Agent Builder Library for building compliant, explainable AI-SOC workflows.