Corelight

What is Corelight?

Network detection and response with evidence-backed insight.

Who is Corelight best for?

Corelight is best for security operations teams at large organizations that want full network traffic records with AI-assisted triage.

• SOC teams drowning in alerts

  Its Investigator service groups detections by host, works through the last seven days of activity and writes up what happened with suggested next steps.

• Threat hunting and forensics

  Sensors turn traffic into Zeek logs, Suricata alerts and Smart PCAP captures that analysts can search long after an incident.

• Air-gapped and regulated networks

  Physical and software sensors run fully on premises, and they can be updated offline where the network has no internet access.

• Splunk, CrowdStrike and Microsoft shops

  Built-in connectors send network evidence and triage verdicts into Splunk, CrowdStrike, Microsoft Sentinel and Defender.

How much does Corelight cost?

Corelight does not publish prices: its Open NDR platform is sold through a demo request and its sales team, and the maker states no free plan or trial.

Corelight has no pricing page and names no plans; buying starts with Get a demo or Contact us. Cost depends on how you deploy: physical, virtual, software or cloud sensors, the Investigator SaaS platform or a hybrid, and cloud sensor licensing is based on consumption. Plans and current prices are on corelight.com.

How do readers rate Corelight?

No one has rated Corelight yet. Be the first.

Questions about Corelight