Overview
Product Information on Corelight Open NDR Platform
What is Corelight Open NDR Platform?
Corelight Open NDR Platform Pricing
Corelight Open NDR Platform Product Images






Corelight is a company that primarily focuses on network security. Its objective is to transform network and cloud data into detailed evidence to help counter ever-evolving cyber threats. The company offers an open Network Detection and Response (NDR) platform that provides a comprehensive, correlated view of the network, granting unmatched visibility to users. With the advantage of swift investigation, expert-like cyber threat hunting and potential attack disruption capabilities, Corelight targets to enhance cybersecurity preparedness. It offers both on-premise and cloud-based sensors capable of capturing standard industry telemetry and insights that align with pre-existing user tools and processes. Clients of Corelight span diverse sectors, including large scale businesses, government agencies and research institutions.
Do You Manage Peer Insights at Corelight?
Access Vendor Portal to update and manage your profile.
Ease of deployment and implementation. Quick deployment in the environment without the need of installing additional agents. After providing network traffic to the sensor, data immediately shows up in the Corelight console. Extraction of network data in a minimal and easily readable format that makes security triage and analysis faster and more straightforward. Additionally, if any alert is detected, it enables in depth analysis of network packets which are captured through the efficient SmartPCAP technology. Encrypted traffic analysis provides high fidelity insights into encrypted traffic (e.g., HTTPS, SSH, VPN, and DNS over TLS) without the need for traffic decryption. The underlying engine enables extraction of all relevant data from the encrypted traffic with no impact on the traffic analysis performance. Enables capturing of files across all analyzed traffic and storage of files for automated analysis. This is further enhanced by the YARA scanning functionality that detects potentially malicious files transferred through the network. Reliability and speed of traffic capture, data collection and data analytics. Traffic is parsed and quickly forwarded to the Corelight SIEM where it is available for analysis in less than a minute. Readiness of technical and customer support to jump on a call and discuss improvements to the platform provides peace of mind when using the solution. The Corelight team really aims at making a quality product that will streamline detection and response activities as much as possible by providing valuable information to security analysts.
FleetManager
The clarity and structure of the data. Corelight gives us high-fidelity, well-enriched logs that are actionable instead of chaotic. The detections are more organized, the data is richer, and investigations move faster because we are able to lay everything out in a way that makes sense. Sensor management is easy and the overall stability of the sensors has been a major plus. The product is consistently working towards reducing the noise and that's rare in this space.
Integration with EDR vendors - Integration exists but is limited to querying EDR vendors API endpoints. This can provide great context but it is far from a fully integrated console that would integrate EDR and NDR telemetry into one timeline. Limitations on Alerting capabilities - Currently one can only create alerts based on Zeek and Suricata detections. There is no ability to create custom alerts in the Investigator SIEM based on the collected network data. Cloud traffic inspection can incur sizeable additional costs - If using a cloud provider that doesn't natively support Cloud Network TAPs the price hike for monitoring cloud network infrastructure is significant.
The lack of having fully centralized operational management in environments with a large number of sensors deployed across multiple environments
The product is incredibly powerful, but some tuning requires trial and error before everything aligns the way you want. Certain detections and log types can feel a bit rigid in terms of customization, and more granular configuration options would help streamline deployments. Additionally, scaling log volume can overwhelm our SIEM licensing, so it requires careful planning to avoid ingest bloat. None of these are deal-breakers, but they are areas where more flexibility could make the experience better.