Product
Performance and Asset Visibility
Open NDR Sensors passively classify every network asset and surface threshold-based performance alerts from traffic you're already collecting, giving security and network operations teams a shared source of truth from a single deployment.
Visibility into actively exploited devices
Open NDR Sensors passively discover and classify every device by analyzing protocol fingerprints to identify device type, OS, manufacturer, and network role. When a threat is detected, asset context such as device type, OS, and network role appears in the same log entry as the alert.
Prove "it's not the network" in minutes, not hours
Open NDR generates domain-aware alerts correlated to actual service names: DNS query names, TLS, QUIC traffic, SNI, and HTTP Host headers. The anomaly-first architecture fires only when configurable thresholds are crossed, instantly answering in a single log entry which side of the sensor is the problem. Every performance alert includes a direct forensic pivot to the exact connection that triggered the threshold.
One sensor, one truth for SecOps and NetOps
Extract high-fidelity, anomaly-first performance signals from traffic already flowing through your Open NDR Sensors. No additional hardware, no active polling agents, no dedicated NetOps vendor bloat. Both teams work from the same evidence layer without tool-switching. Your Open NDR platform investment delivers value to both security and network operations from a single deployment.
Network Security Monitoring with Zeek
Suricata alerts are linked directly to the Zeek session logs that captured the same traffic, giving every signature hit immediate evidence and forensic context.
Agentic Triage
Agentic Triage reads Zeek protocol logs as the ground truth for every AI-authored investigation step and playbook finding.
Threat Intelligence
Curated, high-confidence IOCs, powered by CrowdStrike, are updated hourly to enable rapid identification of known and unknown threats.
Build your platform
Performance and asset visibility is included in both the Open NDR Sensor and Investigator bundles at no additional cost. Asset classification is available as an add-on SKU.
Maximize ROI with services and training from Corelight
Corelight Services and Training puts elite defense within reach by ensuring your team can maximize the value of our Open NDR Platform. From precision deployment and SIEM integration to activity-based training from world-class experts, our services provide the technical guidance needed to accelerate SOC maturity.
- Accelerate implementation and time to value with health checks
- Precision engineering for detection calibration, and customization
- Expert-led training and education services
