No decryption?
No problem.

NEW Encrypted Traffic Collection

Corelight quickly makes sense of encrypted traffic without decryption. The Encrypted Traffic Collection allows security analysts to fingerprint SSL & SSH connections, monitor soon-to-expire certificates, detect SSH client brute force attacks, and much more.

Products

Sensor Appliances

Cloud Sensor

Virtual Sensor

Download specifications

Select product

Corelight Fleet Manager

Fleet Manager streamlines the deployment, configuration, and administration of Corelight Sensors across an organization. A single management dashboard gives you RBAC, customizable configuration templates, and sensor health and performance monitoring.

Download specifications

Perfectly balanced network visibility

100x richer than Netflow / 100x smaller than PCAP / 50+ data types and protocols.

Corelight’s logs are the “Goldilocks” of network data: 100x richer than Netflow and 100x times smaller than PCAP. Covering 50+ data types and protocols and interlinked for lightning-fast search, these logs offer just the right amount of data for security tools and operators. Corelight’s fork, filter, and log data reduction features make it easy to manage log volumes for your SIEM without sacrificing critical network visibility.

Core Collection packages

Corelight Sensors come preloaded with the Core Collection—a curated set of Zeek / Bro packages for detection, data enrichment, and operations.

The Core Collection delivers actionable insights like cryptomining and port scanning detections. It also offers operational controls like tuning log export volumes to manage SIEM costs.