Corelight Open NDR vs Hunters
Corelight Open NDR
corelight.com
Hunters
hunters.securitySide by side
| Figure | Corelight Open NDR | Hunters |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Threat Hunting Software | 7.7 (#12) | 8.2 (#7) |
| Deployment | Corelight offers physical, software, virtual, cloud, and flow-log sensors for on-premises, air-gapped, hybrid, and multicloud environments. | Hunters says its out-of-the-box SIEM can be deployed in days without professional services or ongoing SIEM management. |
| Detection | Its detection strategy combines machine learning, behavioral analytics, curated signatures, and threat intelligence. | Pre-built detections cover UEBA, identity, endpoint, and cloud, and are built, managed, and tuned by Team Axon. |
| Founded | 2016 | 2019 |
| Headquarters | San Francisco, California, USA | Tel Aviv, Israel |
| Integrations | The platform has native integrations with SIEM, XDR, SOAR, and cloud platforms including Splunk, CrowdStrike, Microsoft, Elastic, and AWS. | The integration catalog spans cloud infrastructure, email, endpoint and EDR, identity and access management, network security, threat intelligence, and workflow and response. |
| Support | Standard and Enterprise support plans include telephone and email support, software updates, security bulletins, an online support portal, and hardware replacement; Enterprise adds 24x7 availability and a one-hour P1 response SLA. | Team Axon offers rapid response to emerging threats, incident investigations, proactive threat hunting, and security posture reporting. |
Plans
In their own words
Corelight Open NDR
Corelight Open NDR turns network and cloud traffic into evidence for security operations. Its detection combines machine learning, behavioral analytics, curated signatures and threat intelligence, with real-time detection and anomaly explanations. Automated triage and integrated response workflows provide context for containing threats. The platform brings network security monitoring, intrusion detection, static file analysis and intelligent packet capture together. It handles network traffic, packets, flow logs, cloud network traffic, protocol logs and files. Deployment options include physical, software, virtual, cloud and flow-log sensors across on-premises, air-gapped, hybrid and multicloud environments. Cloud-native sensors support AWS, Azure and Google Cloud; software sensors support Linux-based systems. Physical and software sensors are built for environments at 100+ Gbps scale. Native integrations cover SIEM, XDR, SOAR and cloud platforms, including Splunk, CrowdStrike, Microsoft, Elastic and AWS. A Logs API and MCP server support programmatic access. Pricing is on request, with capacity-based licensing. Corelight serves large enterprises and government agencies in more than fifteen countries.