Skip to content
  • There are no suggestions because the search field is empty.
PROTECTING OVER $1B IN DAILY TRADES
DEFENDING ENERGY FOR 32+M U.S. USERS
SECURING NETWORKS FOR 52K+ TRANSPORT VEHICLES
PROTECTING OVER $10T IN MANAGED ASSETS
SECURING 16+M ANNUAL PATIENT VISITS
+1(888) 547-9497
Platform

Deployment options

Your security architecture, your rules. Corelight offers complete deployment freedom across cloud, virtual, software, and physical sensors—giving you zero-friction integration in SaaS, air-gapped, or hybrid environments.

Choosing the right deployment model for your environment

The Corelight Open NDR Platform offers the flexibility to select the optimal deployment model for your specific infrastructure and allows you to adapt your security posture as your requirements evolve.

Corelight_Graphics_DeploymentGraphics

Deployment options designed to fit any SOC architecture

Resilient, high-performance infrastructure options to run anywhere, from air-gapped data centers to multicloud environments.

On-prem

Ideal for organizations requiring on-premises or air-gapped solutions, and for those who prefer to feed raw network data and detections into SIEM, data lake, or XDR solutions, Corelight’s sensor-only option ensures data remains private and audit-ready within your trusted perimeter. Our physical and software sensors combine six legacy security functions into a single high-fidelity source of truth and are built to handle demanding network environments at 100+ Gbps scale, with built-in support for merging high-volume traffic.

SaaS

Corelight's cloud-delivered platform gives you flexibility in how you deploy and consume network evidence. Use cloud-managed sensors with Fleet Manager to simplify sensor operations and export rich network evidence directly to your existing SIEM or data lake. Or go further with Corelight Investigator — a complete NDR platform that adds AI/ML detections, generative and agentic AI assistance, and unified investigation workflows, consolidating IDS, PCAP, NSM, and file analysis into a single experience with flexible storage options.

Hybrid

For organizations that require a blended deployment option, our hybrid offering provides the agility to secure a complex distributed environment. Maintain sensitive data analysis on-site while leveraging cloud resources for unified detection and investigations across distributed environments. Hybrid licensing supports mixed environments and ensures that the same Zeek®-based context is available everywhere.

Corelight Sensor options

Unparalleled control and defensibility for on-prem and air-gapped environments

On-premises or air-gapped deployments offer complete control by keeping data and analytics within your physical environment. Choose hardware appliances or software-based sensors to passively ingest mirrored network traffic without impacting performance

Explore Physical and Software Sensors

High-fidelity visibility in virtualized environments

Leverage your existing infrastructure for a cost-effective, flexible solution. Virtual deployments utilize software-based sensors on your virtual machines running on Microsoft Hyper-V and VMware, reducing hardware costs and physical footprint. This model offers high-fidelity network visibility in virtualized environments without dedicated hardware, supporting incident response, threat detection, and compliance. It is an ideal choice for organizations with robust virtualization platforms seeking scalable, efficient network visibility.

Hyper-v--cmware--logo-combos
Explore Virtual Sensors

Unified visibility across your entire cloud ecosystem

Lightweight cloud-native sensors for AWS, Azure, and GCP capture cloud traffic and flow logs. Corelight provides a unified, standard Zeek log format that simplifies security investigations and integrations with SIEM and SOAR tools. Scalable, usage-based licensing is ideal for dynamic cloud environments, streamlining security management and giving you a single, coherent view of your security posture across disparate cloud environments.

Google-cloud-AWS-Azure--logo-combo
Explore Cloud Sensors Explore Investigator

Turn raw flow logs into high-fidelity security evidence

Flow log sensors transform raw cloud and network flow data into structured Zeek logs by ingesting from devices or storage systems, such as AWS S3 buckets and NetFlow sources. This delivers standardized, high-fidelity network evidence that integrates seamlessly with your existing cloud and on-prem security stack.

Explore Flow Log Sensors

Manage large sensor deployments with Fleet Manager

Fleet Manager acts as the centralized command center for your global network security infrastructure, giving you a commanding view of network health and performance across thousands of sensors. Rapidly deploy and tune detections, machine learning models, and custom YARA rules in minutes, all while streamlining workflows.

Explore Fleet Manager
Corelight_Graphics_FleetManager_Small (1)

Breaches are inevitable; confident response is not

Our NDR Buyer's Guide provides the clarity to select the right platform and master crisis decision-making.

Get it now
BuyersGuide26_NDR_Cover_Crop
Partner ecosystem

Seamless integration with your environment

The Corelight ecosystem delivers an open, flexible architecture designed to secure sprawling networks by integrating high-fidelity network evidence seamlessly into any security stack. With native integrations across SIEM, XDR, Cloud, and identity platforms, Open NDR eliminates operational silos and simplifies adoption without the constraints of proprietary lock-in.

Explore our partnerships

Unified visibility with extended context

Extend high-fidelity network evidence with integrated host, identity, and vulnerability data from partners like CrowdStrike and Microsoft. Leverage the connectors to periodically query APIs for near-real-time host attributes and CVE enrichment directly within sensor logs.

Refined investigative workflow

Refine your SOC operations by delivering network evidence directly into your SIEM / XDR through built-in connectors while dramatically reducing network log volume and preserving critical security insights.

Confident and rapid response

Mount a decisive defense with integrated response actions across identity platforms, firewalls, and ticketing systems. Respond immediately from Corelight Investigator or create new cases for further investigation.

Maximize ROI with services and training from Corelight

Corelight Services and Training puts elite defense within reach by ensuring your team can maximize the value of our Open NDR Platform. From precision deployment and SIEM integration to activity-based training from world-class experts, our services provide the technical guidance needed to accelerate SOC maturity.

  • Accelerate implementation and time to value with health checks

  • Precision engineering for detection calibration and customization

  • Expert-led training and education services

Professional Services Corelight Training
training-hero
 

FAQ