Corelight

Corelight is an evidence-based Network Detection and Response (NDR) and threat hunting platform for enterprise security teams that turns network traffic into correlated, high-fidelity security evidence for detection, triage, and investigation.

Key capabilities include:

• Open NDR sensors powered by Zeek and Suricata that provide complete visibility into North-South and East-West traffic across on-prem, hybrid, and multicloud environments, parsing connections into rich metadata that can persist for months.
• Collections (curated packages of detections, enrichment, and analytics) designed to hunt and detect behaviors such as C2 activity, encrypted threats, lateral movement, port scanning, and cryptomining.
• Investigator and Investigation Promptbooks to support faster alert triage with automated, evidence-backed workflows.
• Integrations for security operations via an MCP Server and SIEM connectivity (including Splunk, Elastic, and LogScale), plus support for Microsoft Defender for IoT and Microsoft Sentinel.

Pricing: Not publicly listed.

Notable for combining out-of-band sensor visibility with long-lived network evidence and expert-authored workflows, making it suited for SOCs that need higher-confidence detections and deeper investigations than flow logs or firewall telemetry alone.