Not at all. Investigator complements your existing SOC workflow and tools including SIEMs, SOAR and XDR solutions. If you do not have a SIEM, we can make Investigator’s evidence and insights available to your data lake or other tools.

Of course. The built-in threat hunting queries and intuitive search capabilities can turn almost any Tier 1 analyst into a threat hunter. Investigator provides network evidence and advanced analytics to your entire team, from Tier 1s doing triage to hunters chasing nation-state actors.

Yes. Corelight is dedicated to making our products as open as possible. Plus, you can leverage the latest from the Zeek^® and Suricata communities to further tune your analytics.

Both options leverage open source tools (Zeek^® and Suricata) to transform network activity into powerful evidence. Investigator is optimized for SOCs that want its additional capabilities (including machine learning and behavioral analytics), and prefer a SaaS-based solution with built-in dashboards and queries.

Investigator is a SaaS-based solution that is sold as a subscription with various options for log-storage, services, and other features. Please contact us to get the latest quotes and pricing information.