OPEN NDR PLATFORM
Corelight transforms network and cloud activity into evidence. Easily deployed and available in on-prem and SaaS-based formats, Corelight combines the power of open source and proprietary technologies to deliver a complete Open Network Detection & Response (NDR) Platform that includes intrusion detection (IDS), network security monitoring and Smart PCAP solutions.

WHY OPEN NDR
Network Detection and Response platforms monitor and analyze network traffic, delivering telemetry into existing SIEM, XDR, or SaaS-based solutions. Corelight’s platform is unique because our detections and visibility engineering are community driven—with continuous content creation from Zeek®, Suricata IDS, and other Intel communities. And our integration with CrowdStrike XDR enables cross platform (EDR+NDR) analytics. This provides you with the most complete network visibility, powerful analytics, and threat hunting capabilities, and accelerates investigation across your entire kill chain.
The Open NDR Platform
HOW NDR WORKS
It starts with the right telemetry
Zeek is the gold standard in open source network security monitoring with more than 10,000 deployments worldwide.
Correlate alerts & packets into evidence

Automate core SOC capabilities
Our open core approach and broad integration strategy allows you to easily integrate Corelight data into existing SIEM, XDR, and SOAR solutions.
REPORT
Get The Forrester Wave™: Network Analysis And Visibility, Q2 2023 Report
Forrester rates Corelight a strong performer
Corelight received the highest scores possible in the criteria of
- Detection fidelity
- Egress and internal visibility
- Cloud