How Corelight Saved 30% of Technical Support Time with RunLLM’s AI Support Engineer

‍

“What really sets RunLLM apart is the team. They understood our complexity, helped us untangle overlapping knowledge bases, and built a system that reflects how we work. The support has been outstanding — and the partnership even better.”  — Jamey DeLuzio, Senior Director of Customer Experience

‍

The Challenge: Scaling Expert Support in a High-Stakes, Complex Environment

Corelight empowers the world's most security-conscious organizations with unparalleled network detection and response solutions. By seamlessly integrating open-source technologies such as Zeek and Suricata with Corelight's advanced commercial software, they deliver unmatched visibility and robust threat detection capabilities.

Jamey DeLuzio leads Corelight’s Support and Technical Account Management organizations as Sr. Director of Customer Experience. He built the global team from scratch. It includes both pre- and post-sales engineers with an industry-leading Net Promoter score. 

Engineers handle complex support tickets about configuration, tuning, threat analysis, and integration — often requiring deep knowledge of Corelight’s product, Zeek scripting, Suricata behavior, and the unique deployment details of each customer.

Finding the right answer often means researching historical tickets, digging through Corelight’s internal wiki, and recreating behaviors in a test environment — all important but time consuming.

“Our support tickets can be complex. Each one might require deep context about Zeek or Suricata, an understanding of the customer’s environment, and even some revalidation before you can respond confidently.” — Jamey DeLuzio, Sr. Director of Customer Experience, Corelight

Engineers fell into a cycle of reactivity. The relentless stream of demanding tickets was all they had time for. No time for training. No time to step back and get better.

“If we want to retain top engineers and keep our edge, we need to give them time to grow. That means staying sharp on new technology, understanding how threats are evolving, and improving how we support our customers.” — Jamey DeLuzio, Sr. Director of Customer Experience, Corelight

Jamey needed to reduce repetition, preserve tribal knowledge, and protect his team from getting stuck in firefighting mode — all without lowering the high bar Corelight is known for.

‍

The Solution: An AI Support Engineer Tuned to Corelight’s Complexity

Jamey first heard about RunLLM from a trusted former colleague. He evaluated the tool with clear goals: faster responses, less repetitive work, and stronger first-response quality — all without increasing headcount.

Corelight deployed RunLLM as an AI Support Engineer, configured to ingest content from their internal wiki, product documentation, and relevant public sources. Support engineers now use RunLLM daily to draft reliable replies, summarize past cases, and quickly validate behaviors.

“RunLLM didn’t just improve findability — it gave our own engineers fast and accurate technical support. The answers reflected how our team actually works, and how our customers think.” — Jamey DeLuzio, Sr. Director of Customer Experience, Corelight

Early on, RunLLM’s team collaborated closely with Corelight to clearly separate documentation from open-source components — such as Zeek — from materials specific to Corelight’s broader platform. With careful tuning, they built a system aligned with Corelight’s unique knowledge base, diverse toolset, and technical standards. As a result, customers consistently receive precise, expert-level support tailored explicitly to Corelight’s products, rather than general open-source information alone.

As adoption grew, Corelight expanded RunLLM into three areas:

• Internal assistant — Used daily with the helpdesk software to reduce rediscovery and speed up ticket response
• Documentation insights — Flags unclear content and surfaces improvement ideas for the writing team
• Public-facing assistant — Live and performing well, trained only on public-facing docs

‍

‍

The Results: Faster Answers, Unblocked Engineers, and Better Support

RunLLM is now a central part of Corelight’s support strategy. It helps the team work faster, deliver stronger responses, and carve out time for higher-value work.

• 30% time saved — RunLLM handles repetitive and complex questions, giving engineers more capacity for critical tasks and customer success
• More time to upskill — Engineers can now spend more time on professional development, keeping skills sharp and staying current with evolving tools and threats
• Better first responses — Engineers start with context-aware drafts grounded in Corelight’s institutional knowledge — not boilerplate
• Smarter documentation and self-service — RunLLM flags doc issues and powers a public-facing assistant that delivers fast, trusted answers

“RunLLM helped us preserve and scale our tribal knowledge. It delivers fast, reliable answers across a fast-changing and fragmented knowledge base. That’s critical when you’re supporting enterprise customers.” — Jamey DeLuzio, Sr. Director of Customer Experience, Corelight

What stood out most wasn’t just the answers — it was the partnership. RunLLM worked closely with Corelight to understand their setup, segment their data, and build a system that fits how the team operates.

“What really sets RunLLM apart is the team. They understood our complexity, helped us untangle overlapping knowledge bases, and built a system that reflects how we work. The support has been outstanding — and the partnership even better.” — Jamey DeLuzio, Sr. Director of Customer Experience, Corelight

‍

Learn More

Supporting complex customers doesn’t have to burn out your engineers. RunLLM helps you respond faster, scale smarter, and preserve what makes your team great. More at  runllm.com.