- Home
- Threat Hunting Software
- Corelight Open NDR
Corelight Open NDR
San Francisco, California, USA
What it is
Corelight Open NDR is a network detection and response platform that turns network and cloud traffic into context-enriched evidence for security operations. Its detection combines machine learning, behavioral analytics, curated signatures and threat intelligence. The platform brings together network security monitoring, intrusion detection, static file analysis and intelligent packet capture. AI-powered explainability, automated triage and response workflows provide context for threat containment.
It integrates with SIEM, XDR, SOAR and cloud platforms, including Splunk, CrowdStrike, Microsoft, Elastic and AWS. A Logs API and MCP server provide programmatic access for orchestration and management. Deployment options include physical, software, virtual, cloud and flow-log sensors for on-premises, air-gapped, hybrid and multicloud environments. Cloud-native sensors support AWS, Azure and Google Cloud; software sensors support Linux. Physical and software sensors are built for networks at 100+ Gbps scale. Pricing is on request, with capacity-based licensing.
For and against
For
- Combines four network security capabilities in one platform.
- Supports real-time detection and anomaly explanations.
- Offers physical, software, virtual, cloud and flow-log sensors.
- Integrates with SIEM, XDR, SOAR and cloud platforms.
Against
- Pricing is on request.
- Licensing is capacity-based.
- FedRAMP Class C (Moderate) is in process.
The verdict
Corelight Open NDR combines multiple detection methods, deployment choices and integrations for security operations. Buyers should request pricing and assess its capacity-based licensing against their environment.
Who it suits
Corelight Open NDR is intended for large enterprises and government agencies managing network and cloud security operations. It suits organizations that need deployment options across on-premises, air-gapped, hybrid or multicloud environments.
Plans and prices
Custom
capacity-based licensing
Read 30 Sep 2026 · corelight.com
On the record
- APIs
- Logs API and an MCP server provide programmatic access for custom orchestration and management.corelight.com · read 30 Sep 2026
- Audience
- Corelight serves large enterprises and government agencies in more than fifteen countries.corelight.com · read 30 Sep 2026
- Cloud coverage
- Cloud-native sensors support AWS, Azure, and Google Cloud, while software sensors support Linux-based systems.corelight.com · read 30 Sep 2026
- Deployment
- Corelight offers physical, software, virtual, cloud, and flow-log sensors for on-premises, air-gapped, hybrid, and multicloud environments.corelight.com · read 30 Sep 2026
- Detection
- Its detection strategy combines machine learning, behavioral analytics, curated signatures, and threat intelligence.corelight.com · read 30 Sep 2026
- Federal certifications
- Corelight states that its sensors comply with FIPS 140-2, are NIAP Common Criteria certified, and that the Open NDR Platform is FedRAMP Class C (Moderate) in process.corelight.com · read 30 Sep 2026
- Incident response
- AI-powered explainability, automated triage, and integrated response workflows provide context for containing threats and lowering MTTR.corelight.com · read 30 Sep 2026
- Integrations
- The platform has native integrations with SIEM, XDR, SOAR, and cloud platforms including Splunk, CrowdStrike, Microsoft, Elastic, and AWS.corelight.com · read 30 Sep 2026
- Purpose
- Corelight Open NDR transforms raw network and cloud traffic into context-enriched, high-fidelity evidence for security operations.corelight.com · read 30 Sep 2026
- Scale
- Physical and software sensors are built to handle network environments at 100+ Gbps scale.corelight.com · read 30 Sep 2026
- Security and compliance
- Corelight maintains a dedicated security program and says select products are independently audited and certified to industry-leading compliance standards.corelight.com · read 30 Sep 2026
- Support
- Standard and Enterprise support plans include telephone and email support, software updates, security bulletins, an online support portal, and hardware replacement; Enterprise adds 24x7 availability and a one-hour P1 response SLA.corelight.com · read 30 Sep 2026
- Tool consolidation
- Corelight says Open NDR combines network security monitoring, intrusion detection, static file analysis, and intelligent packet capture in one platform.corelight.com · read 30 Sep 2026
