Corelight

What Corelight actually does

Corelight is built on Zeek (formerly Bro), the open-source network security monitor. It takes raw packet data and transforms it into structured, high-fidelity logs — connection records, DNS queries, HTTP transactions, TLS certificates, file hashes, and dozens more log types. Every network conversation becomes searchable evidence.

The platform deploys as physical sensors, virtual sensors, or cloud sensors in AWS, Azure, and GCP. Corelight adds proprietary detections, encrypted traffic analysis, and smart PCAP on top of open-source Zeek. The Investigator platform provides a cloud-hosted search and analysis interface, or you can ship everything to your SIEM.

What makes Corelight different from conventional NDR is the data model. Instead of black-box alerts, you get the raw evidence. An analyst can pivot from a detection to the actual connection metadata, see what was transferred, and reconstruct the full story. This is why threat hunters love it.

Who it’s best for

• Mature SOC teams with analysts who can work with structured network logs
• Organizations that do active threat hunting and need deep network evidence
• Enterprises feeding Splunk, Elastic, or CrowdStrike LogScale and wanting better network telemetry
• Incident response teams that need PCAP and session metadata for forensics
• Government and financial services organizations with network monitoring mandates

Pricing reality check

Corelight is not cheap. Sensor hardware starts in the tens of thousands, and software subscriptions scale with throughput — measured in gigabits per second monitored. A large enterprise deployment across multiple data centers and cloud environments can easily reach seven figures annually.

The hidden cost is data. Corelight generates enormous log volumes. Your SIEM bill will increase meaningfully. Budget for the downstream storage and compute costs, not just the Corelight subscription. Some organizations deploy Corelight Investigator to avoid pumping everything into an expensive SIEM.

Alternatives to consider

• ExtraHop Reveal(x) — NDR with application-layer visibility. Easier to deploy, less raw evidence depth.
• Vectra AI — AI-driven NDR focused on automated detections. Less data, more alerts. Lower analyst skill requirement.
• Open-source Zeek — Free. You manage the sensors, tuning, and scaling yourself. Corelight exists because this is hard.
• Darktrace — Self-learning NDR. Very different approach. More automated, less evidence-rich.

The Charting Cyber take

Corelight is the best network evidence platform available. If your SOC investigates incidents by digging into network data, Corelight gives them the richest dataset possible. It turns good analysts into great ones.

But it’s not for everyone. If your security team is small and alert-driven, you’ll drown in data. If you don’t have analysts who know what a conn.log is, the investment won’t pay off. Start with a proof of concept on one network segment. If your team lights up when they see the data, buy it. If they look confused, consider ExtraHop or Vectra instead.