The Target of Evaluation (TOE) is Corelight’s Sensors. The TOE is a network device which is composed of hardware and software that offers a scalable solution to the end users. The TOE boundary is the hardware appliance, which comprises hardware and software components. The TOE operating system is BroLin v28.
\r\nSimple to deploy and integrate with existing analysis tools, the Corelight Sensor Appliances transform high-volume network traffic into high-fidelity data for incident response, intrusion detection, forensics and more. The Sensor parses dozens of network protocols and generates rich, actionable data streams designed for security professionals.
","evaluation_configuration":"The TOE includes several models as shown below:
\r\n| \r\n Model \r\n | \r\n\r\n CPU \r\n | \r\n\r\n Form Factor \r\n | \r\n\r\n Monitoring Interface \r\n | \r\n\r\n Management Interface \r\n | \r\n\r\n Power \r\n | \r\n
| \r\n AP 200 \r\n | \r\n\r\n Intel Xeon Scalable Silver 4110 Skylake-SP \r\n | \r\n\r\n 1U half-depth rackmount \r\n | \r\n\r\n Four 1G SFP interfaces \r\n | \r\n\r\n One 10/100/1000 copper Ethernet port \r\n | \r\n\r\n 120/240 VAC 50/60 Hz single PSUs. \r\n | \r\n
| \r\n AP 520 \r\n | \r\n\r\n Intel Xeon Scalable Gold 5317 Sunny Cove/Icelake-SP \r\n | \r\n\r\n 1U rackmount \r\n | \r\n\r\n Four 1G SFP interfaces \r\n | \r\n\r\n One 10/100/1000 copper Ethernet port \r\n | \r\n\r\n 120/240 VAC 50/60 Hz single PSUs. \r\n | \r\n
| \r\n AP 1001 \r\n | \r\n\r\n Intel Xeon Scalable Silver 4116 Skylake-SP \r\n | \r\n\r\n 1U rackmount \r\n | \r\n\r\n Four 1G/10G SFP/SFP+ interfaces \r\n | \r\n\r\n One 10/100/1000 copper ethernet port and up to 2 10G Ethernet ports \r\n | \r\n\r\n 120/240 VAC 50/60 Hz redundant dual PSUs. \r\n | \r\n
| \r\n AP 1100 \r\n | \r\n\r\n Intel Xeon Scalable Silver 4314 Sunny Cove/Icelake-SP \r\n | \r\n\r\n 1U rackmount \r\n | \r\n\r\n Four 1G/10G SFP/SFP+ interfaces \r\n | \r\n\r\n 2 1G Ethernet ports and 4 10G Ethernet ports \r\n | \r\n\r\n 120/240 VAC 50/60 Hz redundant dual PSUs. \r\n | \r\n
| \r\n AP 1200 \r\n | \r\n\r\n AMD EPYC 9254 Genoa/Zen 4 \r\n | \r\n\r\n 1U rackmount \r\n | \r\n\r\n Four 1G/10G SFP/SFP+ interfaces \r\n | \r\n\r\n 2 1G Ethernet ports and 4 10/25G Ethernet ports \r\n | \r\n\r\n 120/240 VAC 50/60 Hz redundant dual PSUs. \r\n | \r\n
| \r\n AP 3000 \r\n | \r\n\r\n Intel Xeon Scalable Gold 6238 Skylake/Cascade Lake-SP \r\n | \r\n\r\n 1U rackmount \r\n | \r\n\r\n Four 1G/10G SFP/SFP+ interfaces OR 10G QSF28 OR two 40G QSFP28 OR eight 10G QSFP28 interfaces \r\n | \r\n\r\n 2 1G Ethernet ports and 4 10G Ethernet ports \r\n | \r\n\r\n 120/240 VAC 50/60 Hz redundant dual PSUs. \r\n | \r\n
| \r\n AP 3100 \r\n | \r\n\r\n Intel Xeon Scalable Gold 5318Y Sunny Cove/Icelake-SP \r\n | \r\n\r\n 1U rackmount \r\n | \r\n\r\n Four 1G/10G SFP/SFP+ interfaces OR 10G QSF28 OR two 40G QSFP28 OR eight 10G QSFP28 interfaces \r\n | \r\n\r\n 2 1G Ethernet ports and 4 10G Ethernet ports \r\n | \r\n\r\n 120/240 VAC 50/60 Hz redundant dual PSUs. \r\n | \r\n
| \r\n AP 3200 \r\n | \r\n\r\n AMD EPYC 9534 Genoa/Zen4 \r\n | \r\n\r\n 1U rackmount \r\n | \r\n\r\n Four 1G/10G SFP/SFP+ interfaces OR 10G QSF28 OR two 40G QSFP28 OR eight 10G QSFP28 interfaces \r\n | \r\n\r\n 2 1G Ethernet ports and 4 10/25G Ethernet ports \r\n | \r\n\r\n 120/240 VAC 50/60 Hz redundant dual PSUs. \r\n | \r\n
| \r\n AP 5000 \r\n | \r\n\r\n AMD EPYC 7742 Rome/Zen2 \r\n | \r\n\r\n 1U rackmount \r\n | \r\n\r\n Two QSFP28 bays, capable of supporting eight 10G OR two 40G 8 OR two 100G interfaces in a powerful, specialized NIC. \r\n | \r\n\r\n One 10/100/1000 copper ethernet port and up to 4 10G ethernet ports \r\n | \r\n\r\n 120/240 VAC 50/60 Hz redundant dual PSUs. \r\n | \r\n
| \r\n AP 5002 \r\n | \r\n\r\n AMD EPYC 7713 Milan/Zen3 \r\n | \r\n\r\n 1U rackmount \r\n | \r\n\r\n 2 x QSFP56 bays capable of supporting eight 10G, two 40G or two 100G interfaces. \r\n | \r\n\r\n One 10/100/1000 copper ethernet port and up to 4 10G ethernet ports \r\n | \r\n\r\n 120/240 VAC 50/60 Hz redundant dual PSUs. \r\n | \r\n
| \r\n AP 5200 \r\n | \r\n\r\n AMD EPYC 9754 Bergamo/Zen 4c \r\n | \r\n\r\n 1U rackmount \r\n | \r\n\r\n 2 x QSFP56 bays capable of supporting eight 10G, two 40G or two 100G interfaces. \r\n | \r\n\r\n 2 1G Ethernet ports and 4 10/25G Ethernet ports \r\n | \r\n\r\n 120/240 VAC 50/60 Hz redundant dual PSUs. \r\n | \r\n
The TOE operates within a network environment as diagrammed below.
\r\nFigure 1: TOE and TOE Operational Environment
\r\nAn administrator uses an SSHv2 client or a web browser (each running on the administrator's workstation) to administer the TOE. The TOE does not have distributed components. Instead, the TOE implements all functionality within each model (physical appliance). Because the TOE independently satisfies all SFRs in the cPP without the Management Component, the NDcPP22e prescribes that the TOE be certified (by itself) according to the cPP and without the Management Component. \"Figure 4: Non-distributed TOE use case\" in the NDcPP22e depicts the TOE and its dedicated provisioning applications.
\r\nAs a result, the TOE boundary includes only the TOE itself. The SSHv2 client and web browser (running on the administrator's workstation) as well as the remote SFTP audit server lie in the TOE's Operational Environment.
","security_evaluation_summary":"The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Corelight Sensor AP 200, AP 520, AP 1001, AP 1100, AP 1200, AP 3000, AP 3100, AP 3200, AP 5000, AP 5002 & AP 5200 Common Criteria Guidance Document, Version 0.2, December 20, 2024 document, satisfies all of the security functional requirements stated in the Corelight Sensors with BroLin v28 Security Target, Version 0.6, December 20, 2024. The project underwent CCEVS Validator review. The evaluation was completed in January 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11489-2025) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of the Sensors with BroLin v28 are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\n
Security audit:
\r\nThe TOE generates audit events for all start-up and shut-down functions, and all auditable events as specified in the Security Target. Audit events are also generated for management actions specified in FAU_GEN.1. The TOE can store audit events locally and export them to an external audit server (via SFTP using SSH v2). Each audit record contains the date and time of event, type of event, subject identity, and the relevant data of the event.
\r\nCryptographic support:
\r\nThe TOE provides cryptographic support for the secure administration access and audit export via SSH, for secure administration access via SFTP (FTP over SSH v2). Secure administration may also be performed using HTTPS/TLS (remote WebUI). The operating system is BroLin v28 which is based upon Linux Kernel version 5.4. The TOE leverages the SafeLogic’s OpenSSL 3.0 and FIPS provider module for its cryptographic functionality. Functions include Key generation, key establishment, key distribution, key destruction, and cryptographic operations.
\r\nIdentification and authentication:
\r\nThe TOE provides authentication services for administrative users to connect to the TOE’s secure CLI administrator interface and to its WebUI. The TOE requires Authorized Administrators to authenticate prior to being granted access to any of the management functionality. The TOE supports SSH password-based authentication and public key-based authentication. The TOE’s WebUI and local console support password-based authentication. The TOE’s SSHv2 interface supports authentication of administrative clients using SSH public keys.
\r\nSecurity management:
\r\nTOE administrators manage the security functions of the TOE through both an SSH CLI and through the TOE’s HTTPS/TLS WebUI. The TOE also provides the ability to configure the session activity timeout of an administrator and to configure the TOE’s access banner.
\r\nProtection of the TSF:
\r\nThe TOE protects all passwords, pre-shared keys, symmetric keys and private keys from unauthorized disclosure. Passwords are stored on the file system in encrypted format. Passwords are stored as SHA-512 salted hash value as per standard Linux approach. The TOE executes self-tests during initial start-up to ensure correct operation and enforcement of its security functions. An administrator can install software updates to the TOE. The TOE internally maintains the date and time.
\r\nTOE access:
\r\nPrior to establishing an administration session with the TOE, a banner is displayed to the user. The banner messaging is customizable. The TOE will terminate an interactive session after 60 minutes of session inactivity. A user can terminate their local CLI session and remote CLI session by entering exit at the prompt.
\r\nTrusted path/channels:
\r\nThe TOE supports SSH v2 for secure communication to the following IT entities: Audit server via SFTP. The TOE supports SSH v2 (remote CLI) and HTTPS/TLS (remote WebUI) for secure remote administration.
","features":[{"id":646,"feature_name":"Asymmetric Key Generation"},{"id":641,"feature_name":"Auditing"},{"id":652,"feature_name":"Cryptographic Hashing"},{"id":647,"feature_name":"Cryptographic Key Establishment"},{"id":651,"feature_name":"Cryptographic Signature Verification"},{"id":643,"feature_name":"DRBG"},{"id":1550,"feature_name":"HTTPS Server without Mutual Authentication"},{"id":642,"feature_name":"Key Destruction"},{"id":654,"feature_name":"Keyed-hash message authentication"},{"id":657,"feature_name":"SSH Client"},{"id":658,"feature_name":"SSH Server"},{"id":656,"feature_name":"TLS 1.2"},{"id":655,"feature_name":"TLS Server without Mutual Authentication"}]}