Skip to content
SPECIFICTION
Get listed

Corelight Open NDR

corelight.com

WebLinuxAPISelf-hosted
Visit corelight.com
Spec score 7.7 #12 of 29 in Threat Hunting Software

What it is

Corelight Open NDR turns network and cloud traffic into evidence for security operations. Its detection combines machine learning, behavioral analytics, curated signatures and threat intelligence, with real-time detection and anomaly explanations. Automated triage and integrated response workflows provide context for containing threats. The platform brings network security monitoring, intrusion detection, static file analysis and intelligent packet capture together. It handles network traffic, packets, flow logs, cloud network traffic, protocol logs and files. Deployment options include physical, software, virtual, cloud and flow-log sensors across on-premises, air-gapped, hybrid and multicloud environments. Cloud-native sensors support AWS, Azure and Google Cloud; software sensors support Linux-based systems. Physical and software sensors are built for environments at 100+ Gbps scale. Native integrations cover SIEM, XDR, SOAR and cloud platforms, including Splunk, CrowdStrike, Microsoft, Elastic and AWS. A Logs API and MCP server support programmatic access. Pricing is on request, with capacity-based licensing. Corelight serves large enterprises and government agencies in more than fifteen countries.

Spec sheet

Purpose
Corelight Open NDR transforms raw network and cloud traffic into context-enriched, high-fidelity evidence for security operations.Read 30 Sep 2026 · corelight.com
Audience
Corelight serves large enterprises and government agencies in more than fifteen countries.Read 30 Sep 2026 · corelight.com
Deployment
Corelight offers physical, software, virtual, cloud, and flow-log sensors for on-premises, air-gapped, hybrid, and multicloud environments.Read 30 Sep 2026 · corelight.com
Integrations
The platform has native integrations with SIEM, XDR, SOAR, and cloud platforms including Splunk, CrowdStrike, Microsoft, Elastic, and AWS.Read 30 Sep 2026 · corelight.com
Support
Standard and Enterprise support plans include telephone and email support, software updates, security bulletins, an online support portal, and hardware replacement; Enterprise adds 24x7 availability and a one-hour P1 response SLA.Read 30 Sep 2026 · corelight.com
Headquarters
San Francisco, California, USARead 28 Sep 2026 · corelight.com
Founded
2016Read 28 Sep 2026 · corelight.com
APIs
Logs API and an MCP server provide programmatic access for custom orchestration and management.Read 30 Sep 2026 · corelight.com
Cloud coverage
Cloud-native sensors support AWS, Azure, and Google Cloud, while software sensors support Linux-based systems.Read 30 Sep 2026 · corelight.com
Detection
Its detection strategy combines machine learning, behavioral analytics, curated signatures, and threat intelligence.Read 30 Sep 2026 · corelight.com
Federal certifications
Corelight states that its sensors comply with FIPS 140-2, are NIAP Common Criteria certified, and that the Open NDR Platform is FedRAMP Class C (Moderate) in process.Read 30 Sep 2026 · corelight.com
Incident response
AI-powered explainability, automated triage, and integrated response workflows provide context for containing threats and lowering MTTR.Read 30 Sep 2026 · corelight.com
Scale
Physical and software sensors are built to handle network environments at 100+ Gbps scale.Read 30 Sep 2026 · corelight.com
Security and compliance
Corelight maintains a dedicated security program and says select products are independently audited and certified to industry-leading compliance standards.Read 30 Sep 2026 · corelight.com
Tool consolidation
Corelight says Open NDR combines network security monitoring, intrusion detection, static file analysis, and intelligent packet capture in one platform.Read 30 Sep 2026 · corelight.com

Plans and prices

Custom Priced on request capacity-based licensing Read 30 Sep 2026 · corelight.com

Every Corelight Open NDR plan and price →

Strong points and limits

Strong points

  • Combines four network security capabilities in one platform.
  • Supports real-time detection and anomaly explanations.
  • Cloud sensors cover AWS, Azure and Google Cloud.
  • Physical and software sensors target 100+ Gbps environments.

Limits

  • Pricing is available on request.
  • Licensing is capacity-based.
  • FedRAMP Class C (Moderate) is in process.

Who it suits

It is aimed at large enterprises and government agencies seeking network detection across on-premises, air-gapped, hybrid or multicloud environments. Teams can use its integrations and APIs for connections to existing security tools and custom orchestration.

Verdict

Open NDR offers several sensor types and detection methods, with broad deployment and integration options. Capacity-based licensing and pricing on request mean buyers will need to discuss requirements directly.

Where Specifiction places it

Alternatives to Corelight Open NDRAll alternatives →