Corelight MITRE ATT&CK is a network detection and response solution that provides coverage for over 80 MITRE ATT&CK techniques across multiple tactics. The platform uses Zeek network telemetry as its foundation to capture activity across network protocols and enable advanced analytics. The solution focuses on detecting adversary techniques in several key areas including Defense Evasion, Credential Access, Discovery, and Command and Control. Coverage spans Initial Access, Persistence, Privilege Escalation, Lateral Movement, Collection, Exfiltration, and Impact tactics. The platform employs multiple detection methods including machine learning models, behavioral alerts, and Suricata-based IDS rules. The approach emphasizes visibility and evidence-based analytics to identify tactics, techniques, and procedures mapped to the MITRE ATT&CK framework. Corelight's Open NDR Platform architecture allows security teams to build custom detection content or leverage community contributions. The system provides network protocol analysis and generates telemetry data that feeds detection analytics for identifying malicious activity patterns across the network infrastructure.