Axomaly vs Corelight Open NDR

Axomaly is a cloud service that learns patterns in SaaS product and business metrics and flags meaningful changes without fixed thresholds. It accepts timestamped time-series values, with optional metadata, for business, operational, and application metrics. Before creation, Smart Metric Creation prepares a detection configuration and baseline requirements for review. Values are submitted through a REST API, one timestamped value per POST request. Detection begins once the required history is available; the amount depends on metric cadence and detector configuration. Results include an anomaly decision, confidence, expected range, direction of change, and detector evidence, which can feed existing workflows alongside logs, traces, dashboards, and alerting. The alpha starts with one metric and includes guided onboarding and direct support. It is free during alpha with no credit card required. During that period, data and results are hosted in the EU, isolated by organisation, encrypted in transit using HTTPS/TLS, and kept for up to 12 months before rolling deletion.

Corelight Open NDR turns network and cloud traffic into evidence for security operations. Its detection combines machine learning, behavioral analytics, curated signatures and threat intelligence, with real-time detection and anomaly explanations. Automated triage and integrated response workflows provide context for containing threats. The platform brings network security monitoring, intrusion detection, static file analysis and intelligent packet capture together. It handles network traffic, packets, flow logs, cloud network traffic, protocol logs and files. Deployment options include physical, software, virtual, cloud and flow-log sensors across on-premises, air-gapped, hybrid and multicloud environments. Cloud-native sensors support AWS, Azure and Google Cloud; software sensors support Linux-based systems. Physical and software sensors are built for environments at 100+ Gbps scale. Native integrations cover SIEM, XDR, SOAR and cloud platforms, including Splunk, CrowdStrike, Microsoft, Elastic and AWS. A Logs API and MCP server support programmatic access. Pricing is on request, with capacity-based licensing. Corelight serves large enterprises and government agencies in more than fifteen countries.