Corelight

Open NDR platform built on the open-source Zeek network monitoring framework

ToolNetwork Detection & Response (NDR)Cloud, Self-hosted, Open source

Pricing: Contact for pricing

Reviewed by the Cyber Vendor Guide editorial team against the public sources cited below · Last reviewed June 2026 · How we review listings

What is Corelight?

Corelight is a network detection and response (NDR) vendor founded in 2013 by the creators of the open-source Zeek framework (formerly Bro). Its Open NDR Platform combines Zeek network evidence with Suricata intrusion detection, YARA file analysis, behavioral analytics, machine learning, and packet capture for threat detection, investigation, and incident response. It is positioned as an open-core product and integrates with SIEM and XDR tools, supporting on-premise appliances, virtual and software sensors, and cloud deployments across AWS, Azure, and GCP. Corelight remains a steward of the Zeek project.

Best for: Teams wanting open, Zeek-based network evidence and forensics

Pros

Built on the open-source Zeek standard, producing high-fidelity, well-enriched network logs
Combines Zeek evidence with Suricata IDS and packet capture for detection and forensic context
Flexible deployment across appliances, virtual sensors, and major cloud providers

Things to check

Reported learning curve; better suited to larger organizations and experienced SOC teams
Alerting reported as limited to Zeek and Suricata detections
Total cost can be high when feeding ingest-priced SIEMs, and pricing is not publicly listed

Reported in public reviews and vendor documentation. See sources below.