The gold standard for network monitoring
Zeek transforms network traffic into compact, high-fidelity transaction logs, allowing defenders to understand activity, detect attacks, and respond to them. Zeek sits out-of-band, on-prem or in the cloud. It gathers metadata and extracted files, and formats everything for input into any SIEM or XDR. Zeek provides the evidence that is foundational to Corelight’s Open NDR Platform.
Free Zeek cheatsheets
A selection of cheatsheets for understanding what’s in Zeek metadata.
Close the case on ransomware
In high stakes ransomware investigations, many security teams are unable to answer key questions and default to worst-case assumptions. With complete visibility from Corelight, teams can avoid costly overreactions. One customer, when confronted with a $10 million ransomware demand, used Corelight to prove the exfiltrated data being held for ransom had no real value while providing legal aircover for refusing to pay the ransom.
