Investigator
The only evidence-first threat investigation platform. Investigator is a SaaS-based network detection and response solution that dramatically simplifies Tier 1 workflows.
Zeek
The standard for network traffic monitoring and proactive data-first defense, Zeek® is foundational to the Open NDR Platform.
IDS
The best-in-class open source alerting engine—Suricata IDS—deeply integrated into the Open NDR Platform.
Smart PCAP
Capture just the packets you need for investigations, and store months—not minutes—of traffic history.
Static file analysis
Detect malware threats with pattern-based detection through YARA rules, the standard in malware analysis.
C2 Collection
50+ detections and insights into known command and control activity, as well as MITRE ATT&CK® C2 techniques for finding novel attacks.
Core Collection
Proprietary packages that help sensors scale in high-throughput environments, combined with curated insights from the Zeek community.
Encrypted Traffic Collection
Dozens of insights into SSL, SSH, and RDP connections enhanced with community contributions like JA3—all without decryption.
Entity Collection
Allows easy searching and grouping on entity inventory, including identification of subnets and 80+ applications.
ICS/OT Collection
Identify and log ICS/OT protocols like BACnet, DNP3, Ethercat, Modbus, and more.
Cloud Sensors
Deploy in AWS, GCP, and Azure environments. SaaS and self-managed options available.
Software Sensor
Throughput: 8 Gbps | Get all the benefits of the full Open NDR Platform capabilities in places that you couldn't otherwise reach.
Virtual Sensors
Available for Hyper-V and VMware | Throughput: up to 8 Gbps. Corelight's Hyper-V and VMware NDR virtual sensors transform network traffic into high-fidelity data for incident response, intrusion detection, and more.
Fleet Manager
Corelight Fleet Manager gives you the ability to manage your entire fleet of sensors from one user-friendly GUI console. Create custom configuration templates in minutes to manage individual sensors, groups, or your entire fleet.
