Corelight

Overview

Corelight offers a powerful Network Detection & Response (NDR) platform designed to provide security teams with comprehensive visibility into network traffic and the ability to detect and investigate advanced threats. Built on the foundation of the open-source Zeek network security monitor (formerly Bro), Corelight transforms raw packet data into rich, structured logs and metadata, which are essential for understanding network behavior and conducting effective threat hunting.

The platform goes beyond traditional signature-based detection by focusing on behavioral analysis and leveraging advanced techniques, including AI and machine learning in components like Corelight Investigator, to identify anomalous activity and sophisticated attack patterns. By providing high-fidelity detections, accelerating investigations with deep contextual data, and integrating seamlessly with existing security tools (SIEM, SOAR, data lakes), Corelight helps organizations improve their security posture, reduce dwell time, and streamline incident response workflows. Its deployment flexibility across physical, virtual, and cloud environments makes it suitable for various organizational needs.

Key Features

• Network Detection and Response (NDR) capabilities
• Built on the powerful open-source Zeek network security monitor
• Transforms raw network traffic into rich, structured Zeek logs and metadata
• Deep network visibility and behavioral analysis
• High-fidelity threat detection using advanced techniques (including AI/ML in Corelight Investigator)
• Accelerates threat hunting and incident investigation workflows
• Flexible deployment options (physical, virtual, cloud sensors)
• Seamless integration with SIEMs, SOARs, data lakes, and other security tools
• Provides comprehensive evidence for incident response
• Analysis of network protocols and application layer activity

Supported Platforms

• Web Browser (Management Interface)
• Physical Appliance
• Virtual Appliance
• Cloud (AWS, Azure, GCP)

Integrations

• Splunk
• Microsoft Sentinel
• Palo Alto Networks Cortex XSOAR
• CrowdStrike
• ServiceNow
• Exabeam
• IBM QRadar
• LogRhythm
• Elastic Security
• Various SIEMs, SOARs, and data lake platforms via API and data export

User Reviews