Compare to Open-Source Zeek / Bro

Corelight makes Zeek / Bro quick to deploy, 10x faster, and easier to manage.

Minutes, not months to full-scale Zeek/ Bro deployment. A beautiful, web GUI, no command-line skills needed. Up to 10x peak analysis throughput per sensor. These are just some of the many advantages Corelight brings to the table to make your Zeek / Bro deployment enterprise-grade and significantly more powerful.

Products compare data
Features & Benefits
Open-source Zeek
Flexible and simple data export
Yes
No
Web management UI
Yes
No
Hardware accelerated NIC
Included
Separate purchase required
Analysis throughput, per sensor
Up to 25 Gbps
3-4 Gbps
3rd party integrations
Yes
No
LDAP support
Yes
No
Support for Zeek / Bro Intelligence Framework
Yes
Yes
Support for Zeek / Bro Input Framework
Yes
Yes
Streaming data export
Yes
No
Shunting of large flows
Yes
Separate NIC purchase required
Optimized file extraction
Yes
No
Filtering to control export volume
Yes
No
Comprehensive API
Yes
No
Performance charts
Yes
No
Geolocation
Yes
No
Encrypted drives
Yes
System implementation required
Zeek / Bro logs
Yes
Yes
FIPS Certified
Yes
No
Support for custom scripts and the Zeek / Bro Package Manager
Yes
Yes
Preloaded Zeek / Bro Scripts / Packages
Corelight Core Collection
No
Support
Commercial support from the creators of Zeek / Bro
Community mailing lists
Staff required for deployment
Minimal—appliance model
Zeek / Bro experts and systems specialists
Updates and maintenance
Automatic updates, optional real-time monitoring
Manual patching, tuning, and updating required
Time for deployment
Application configuration in minutes
Typically weeks to months
Flexible and simple data export
Corelight logo
Yes
Open-Source Zeek / Bro
No
Web management UI
Corelight logo
Yes
Open-Source Zeek / Bro
No
Hardware accelerated NIC
Corelight logo
Included
Open-Source Zeek / Bro
Separate purchase required
Analysis throughput, per sensor
Corelight logo
Up to 25 Gbps
Open-Source Zeek / Bro
3-4 Gbps
3rd party integrations
Corelight logo
Yes
Open-Source Zeek / Bro
No
LDAP support
Corelight logo
Yes
Open-Source Zeek / Bro
No
Support for Zeek / Bro Intelligence Framework
Corelight logo
Yes
Open-Source Zeek / Bro
Yes
Support for Zeek / Bro Input Framework
Corelight logo
Yes
Open-Source Zeek / Bro
Yes
Streaming data export
Corelight logo
Yes
Open-Source Zeek / Bro
No
Shunting of large flows
Corelight logo
Yes
Open-Source Zeek / Bro
Separate NIC purchase required
Optimized file extraction
Corelight logo
Yes
Open-Source Zeek / Bro
No
Filtering to control export volume
Corelight logo
Yes
Open-Source Zeek / Bro
No
Comprehensive API
Corelight logo
Yes
Open-Source Zeek / Bro
No
Performance charts
Corelight logo
Yes
Open-Source Zeek / Bro
No
Geolocation
Corelight logo
Yes
Open-Source Zeek / Bro
No
Encrypted drives
Corelight logo
Yes
Open-Source Zeek / Bro
System implementation required
Zeek / Bro logs
Corelight logo
Yes
Open-Source Zeek / Bro
Yes
FIPS Certified
Corelight logo
Yes
Open-Source Zeek / Bro
No
Support for custom scripts and the Zeek / Bro Package Manager
Corelight logo
Yes
Open-Source Zeek / Bro
Yes
Preloaded Zeek / Bro Scripts / Packages
Corelight logo
Corelight Core Collection
Open-Source Zeek / Bro
No
Support
Corelight logo
Commercial support from the creators of Zeek / Bro
Open-Source Zeek / Bro
Community mailing lists
Staff required for deployment
Corelight logo
Minimal—appliance model
Open-Source Zeek / Bro
Zeek / Bro experts and systems specialists
Updates and maintenance
Corelight logo
Automatic updates, optional real-time monitoring
Open-Source Zeek / Bro
Manual patching, tuning, and updating required
Time for deployment
Corelight logo
Application configuration in minutes
Open-Source Zeek / Bro
Typically weeks to months