Compare to open source Zeek

Corelight makes Zeek easier, faster, and even more powerful.

Minutes not months to full-scale Zeek deployment. Powerful C2 detections and encrypted insights that go well beyond JA3. Up to ten times the peak analysis throughput per sensor. Enterprise support from the people who wrote Zeek.

Compare to open source Zeek
Features & Benefits
Corelight
zeek_horizontal_rgb-24234cd
SENSORS
Physical Sensors
Yes
Corelight
Yes
DIY hardware purchase/build
zeek_horizontal_rgb-24234cd
DIY hardware purchase/build
Virtual Sensors for VMware & Hyper-V
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
Cloud Sensors for AWS, Azure, GCP
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
Binary Sensors for containers & Linux environments
Yes
Corelight
Yes
DIY manual configuration
zeek_horizontal_rgb-24234cd
DIY manual configuration
ENCRYPTED INSIGHTS
Corelight Encrypted Traffic Collection
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
JA3 / JA3S
Yes
Corelight
Yes
Yes
zeek_horizontal_rgb-24234cd
Yes
HASSH
Yes
Corelight
Yes
Yes
zeek_horizontal_rgb-24234cd
Yes
C2 DETECTIONS & INSIGHTS
HTTP C2
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
DNS tunneling
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
ICMP tunneling
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
Domain generation algorithms
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
Meterpreter
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
SURICATA
Natively integrated
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
PACKET CAPTURE
Smart PCAP
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
PERFORMANCE
100+ Gbps per 1U sensor
Yes
Corelight
Yes
3-4 Gbps max per sensor cluster
zeek_horizontal_rgb-24234cd
3-4 Gbps max per sensor cluster
Optimized file extraction (10,000+ files/minute)
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
Performance monitoring
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
< 1% packet loss rate
Yes
Corelight
Yes
Variable, risk of > 50% loss
zeek_horizontal_rgb-24234cd
Variable, risk of > 50% loss
MANAGEMENT
Deployed in <15 minutes
Yes
Corelight
Yes
Deployment takes weeks to months
zeek_horizontal_rgb-24234cd
Deployment takes weeks to months
Web management interface
Yes
Corelight
Yes
Command line only
zeek_horizontal_rgb-24234cd
Command line only
Automatic software updates
Yes
Corelight
Yes
Manual
zeek_horizontal_rgb-24234cd
Manual
Fleet management for up to 250 sensors
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
Comprehensive sensor health monitoring
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
RESTful API support
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
1-click package installation
Yes
Corelight
Yes
Manual
zeek_horizontal_rgb-24234cd
Manual
DATA EXPORT
Export integration with SIEMs
Yes
Corelight
Yes
Manual integration
zeek_horizontal_rgb-24234cd
Manual integration
Kafka, syslog, Amazon Kinesis, Apache Avro, SFTP
Yes
Corelight
Yes
Writes to files on disk
zeek_horizontal_rgb-24234cd
Writes to files on disk
Default log streaming
Yes
Corelight
Yes
Manual
zeek_horizontal_rgb-24234cd
Manual
Log stream forking to multiple destinations
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
DATA CONTROL
Log data reduction mode (30-50% reduction)
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
Filter by log type and contents
Yes
Corelight
Yes
Manual
zeek_horizontal_rgb-24234cd
Manual
Filter by file type
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
Traffic shunting for large & long running flows
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
SECURITY & SUPPORT
Jailed processes
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
FIPS 140-2
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
Automatic security updates
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
Disk encryption
Yes
Corelight
Yes
Manual
zeek_horizontal_rgb-24234cd
Manual
24/7 enterprise support from Zeek experts
Yes
Corelight
Yes
No
zeek_horizontal_rgb-24234cd
No
ZEEK FUNCTIONALITY
Logging
Yes
Corelight
Yes
Yes
zeek_horizontal_rgb-24234cd
Yes
File extraction
Yes
Corelight
Yes
Yes
zeek_horizontal_rgb-24234cd
Yes
Package manager
Yes
Corelight
Yes
Yes
zeek_horizontal_rgb-24234cd
Yes
Zeek Intel Framework
Yes
Corelight
Yes
Yes
zeek_horizontal_rgb-24234cd
Yes
Zeek Input Framework
Yes
Corelight
Yes
Yes
zeek_horizontal_rgb-24234cd
Yes
Zeek NetControl Framework
No
Corelight
No
Yes
zeek_horizontal_rgb-24234cd
Yes
Zeek Notice Framework
Yes
Corelight
Yes
Yes
zeek_horizontal_rgb-24234cd
Yes
Zeek PCAP Ingestion
Yes
Corelight
Yes
Yes
zeek_horizontal_rgb-24234cd
Yes