Virtual Sensors

Cloud Sensors hero banner

Our most flexible Zeek enterprise sensors, the Corelight Virtual Sensors are designed to monitor traffic anywhere at speeds up to 8 Gbps.

Our most flexible Zeek enterprise sensors, the Corelight Virtual Sensors are designed to monitor traffic anywhere at speeds up to 8 Gbps.

Cloud Sensors hero banner
Virtual Sensors Virtual Sensor for Hyper-V
  • Requires Hyper-V on Windows Server 2016
  • Up to 8 Gbps per instance
  • Capacity licensed (independent of instances)
  • 15 minute out-of-band deployment

Expander icon
Virtual Sensors Virtual Sensor for VMware
  • Requires VMware ESXi 6.0 or above
  • Up to 8 Gbps per instance
  • Capacity licensed (independent of instances)
  • 15 minute out-of-band deployment

Expander icon

Next-level results from your SIEM

Your SIEM success depends on the data you feed it. Stop sending Netflow and other low quality, “side-effect” network logs to your SIEM and replace them with Corelight’s rich, protocol-comprehensive logs that accelerate incident response and threat hunting workflows in your SIEM. Export Corelight’s Zeek logs to Splunk, Elastic, QRadar, Spark or just about any data tool of your choice in a matter of minutes.

splunkkafkajsonelastic
splunkkafkajsonelastic
Raise your SIEM’s upside

The security stack, elevated

  • Transform raw packets into security "ground truth"
  • Better network data = better security analytics
  • A flexible technology stack for all environments
Corelight Modern Security Stack

Recent release features

Find Lateral Movement with MITRE BZAR

Corelight Sensors now ship with the MITRE BZAR package in the Core Collection, which detects lateral movement techniques in MITRE ATT&CK related to SMB and DCE-RPC traffic, such as indicators targeting Windows Admin Shares and Remote File Copy. It can also extract detection-related files to enable investigations of suspicious traffic.

Pivot to Suricata and PCAP with Community ID

Community ID is an industry flow-identification standard that creates a common hash of the 5-tuple and appends it to Corelight’s conn.log so analysts can quickly pivot on a connection in Corelight to and from equivalent flows in tools such as Suricata, Elastic, Moloch and more.