Get Started

          Compare to open source Zeek

          Corelight makes Zeek easier, faster, and even more powerful.

          Minutes not months to full-scale Zeek deployment. Powerful C2 detections and encrypted insights that go well beyond JA3. Up to ten times the peak analysis throughput per sensor. Enterprise support from the people who wrote Zeek.

          Compare to open source Zeek
          Features & Benefits
          Corelight
          zeek_horizontal_rgb-24234cd
          SENSORS
          Physical Sensors
          Yes
          Corelight
          Yes
          DIY hardware purchase/build
          zeek_horizontal_rgb-24234cd
          DIY hardware purchase/build
          Virtual Sensors for VMware & Hyper-V
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          Cloud Sensors for AWS, Azure, GCP
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          Binary Sensors for containers & Linux environments
          Yes
          Corelight
          Yes
          DIY manual configuration
          zeek_horizontal_rgb-24234cd
          DIY manual configuration
          ENCRYPTED INSIGHTS
          Corelight Encrypted Traffic Collection
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          JA3 / JA3S
          Yes
          Corelight
          Yes
          Yes
          zeek_horizontal_rgb-24234cd
          Yes
          HASSH
          Yes
          Corelight
          Yes
          Yes
          zeek_horizontal_rgb-24234cd
          Yes
          C2 DETECTIONS & INSIGHTS
          HTTP C2
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          DNS tunneling
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          ICMP tunneling
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          Domain generation algorithms
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          Meterpreter
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          SURICATA
          Natively integrated
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          PACKET CAPTURE
          Smart PCAP
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          PERFORMANCE
          100+ Gbps per 1U sensor
          Yes
          Corelight
          Yes
          3-4 Gbps max per sensor cluster
          zeek_horizontal_rgb-24234cd
          3-4 Gbps max per sensor cluster
          Optimized file extraction (10,000+ files/minute)
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          Performance monitoring
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          < 1% packet loss rate
          Yes
          Corelight
          Yes
          Variable, risk of > 50% loss
          zeek_horizontal_rgb-24234cd
          Variable, risk of > 50% loss
          MANAGEMENT
          Deployed in <15 minutes
          Yes
          Corelight
          Yes
          Deployment takes weeks to months
          zeek_horizontal_rgb-24234cd
          Deployment takes weeks to months
          Web management interface
          Yes
          Corelight
          Yes
          Command line only
          zeek_horizontal_rgb-24234cd
          Command line only
          Automatic software updates
          Yes
          Corelight
          Yes
          Manual
          zeek_horizontal_rgb-24234cd
          Manual
          Fleet management for up to 250 sensors
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          Comprehensive sensor health monitoring
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          RESTful API support
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          1-click package installation
          Yes
          Corelight
          Yes
          Manual
          zeek_horizontal_rgb-24234cd
          Manual
          DATA EXPORT
          Export integration with SIEMs
          Yes
          Corelight
          Yes
          Manual integration
          zeek_horizontal_rgb-24234cd
          Manual integration
          Kafka, syslog, Amazon Kinesis, Apache Avro, SFTP
          Yes
          Corelight
          Yes
          Writes to files on disk
          zeek_horizontal_rgb-24234cd
          Writes to files on disk
          Default log streaming
          Yes
          Corelight
          Yes
          Manual
          zeek_horizontal_rgb-24234cd
          Manual
          Log stream forking to multiple destinations
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          DATA CONTROL
          Log data reduction mode (30-50% reduction)
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          Filter by log type and contents
          Yes
          Corelight
          Yes
          Manual
          zeek_horizontal_rgb-24234cd
          Manual
          Filter by file type
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          Traffic shunting for large & long running flows
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          SECURITY & SUPPORT
          Jailed processes
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          FIPS 140-2
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          Automatic security updates
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          Disk encryption
          Yes
          Corelight
          Yes
          Manual
          zeek_horizontal_rgb-24234cd
          Manual
          24/7 enterprise support from Zeek experts
          Yes
          Corelight
          Yes
          No
          zeek_horizontal_rgb-24234cd
          No
          ZEEK FUNCTIONALITY
          Logging
          Yes
          Corelight
          Yes
          Yes
          zeek_horizontal_rgb-24234cd
          Yes
          File extraction
          Yes
          Corelight
          Yes
          Yes
          zeek_horizontal_rgb-24234cd
          Yes
          Package manager
          Yes
          Corelight
          Yes
          Yes
          zeek_horizontal_rgb-24234cd
          Yes
          Zeek Intel Framework
          Yes
          Corelight
          Yes
          Yes
          zeek_horizontal_rgb-24234cd
          Yes
          Zeek Input Framework
          Yes
          Corelight
          Yes
          Yes
          zeek_horizontal_rgb-24234cd
          Yes
          Zeek NetControl Framework
          No
          Corelight
          No
          Yes
          zeek_horizontal_rgb-24234cd
          Yes
          Zeek Notice Framework
          Yes
          Corelight
          Yes
          Yes
          zeek_horizontal_rgb-24234cd
          Yes
          Zeek PCAP Ingestion
          Yes
          Corelight
          Yes
          Yes
          zeek_horizontal_rgb-24234cd
          Yes