Corelight
AI-powered network detection and response platform for hybrid security operations
- Also known as
- corelight
Available worldwide
What is Corelight?
An NDR platform that analyzes network traffic using AI and behavioral analytics to detect threats across hybrid and cloud environments. It provides forensic-grade evidence, explainable detections, and automated investigation workflows to help security teams detect and respond to threats faster.
Corelight pricing
We don't have Corelight's full plan breakdown yet (its pricing page resisted automated reading). Here's what we could confirm. Always check live pricing for exact numbers.
What Corelight does
The capabilities that matter for network security, normalised so it lines up with every alternative. “-” means we haven't confirmed it, not that it's missing.
- Deployment model
- Hybrid
- Behavioral anomaly detection
- ✓
- Full packet pcap retention
- ✓
- Encrypted traffic metadata analysis
- ✓
- Active endpoint containment response
- -
- Host microsegmentation
- -
- Network access control 802 1x
- -
- EDR crowdstrike sentinelone integration
- -
- Iot ot device discovery
- -
- Fips 140 2 certification
- -
- SOC2 type ii
- -
- ISO 27001
- -
- Pricing model
- -
Platform & deployment
Independently observed- Cloud / SaaS
- Hybrid
- On-premise
- Air-gapped
Integrations (18)
Independently observed- Splunk
- Splunk Enterprise Security
- Splunk SOAR
- Microsoft Defender
- Microsoft Sentinel
- Microsoft Entra ID
- CrowdStrike
- Google Cloud Security
- Elastic
- Kafka
- Syslog
- AWS
- Azure
- Google Cloud
- VMware
- Hyper-V
- S3
- Zeek
Corelight FAQ
Common questions about Corelight, answered from independent, dated evidence.
What is Corelight?
Platform that monitors network traffic to identify security threats and accelerate incident response. Uses machine learning, behavioral analytics, and protocol-level analysis built on the open-source Zeek framework to deliver actionable intelligence for security operations centers. It is indexed under Network Security.
Source: https://corelight.com
How much does Corelight cost?
Corelight does not publish its prices. Pricing is quoted on request, so the figure depends on your seat count and requirements. We record this as a pricing-transparency signal rather than guessing a number. Pricing changes often, so verify at source before relying on it.
Source: https://corelight.com
Can Corelight be self-hosted?
Yes. Corelight can be deployed cloud / SaaS, hybrid, on-premise, air-gapped and self-hosted, so it does not have to run on the vendor's infrastructure.
Source: https://corelight.com
What does Corelight integrate with?
We have confirmed 15 integrations for Corelight, including Splunk, Microsoft Defender, Microsoft Sentinel, Microsoft Entra ID, CrowdStrike, Google Cloud Security, Elastic and Kafka, plus 7 more. This is what we could verify from public sources, so the vendor may support others we have not indexed.
Source: https://corelight.com
Where is Corelight available?
Corelight is available worldwide. The vendor is headquartered in the United States.
Source: https://corelight.com
Corelight alternatives
Other network security we track, ranked by the same independent score.
- ZeekOpen-source network traffic analysis and threat detection systemlow · 27%
- ExtraHop Reveal(x)Real-time network traffic analysis and threat detection platformlow · 45%
- Arkimelow · 27%
- Vectra AIAn AI-driven security platform that integrates threat detection with your existing enterprise security toolslow · 6%
- SnortOpen-source network intrusion detection and prevention systemlow · 22%
- IllumioA network microsegmentation platform that prevents breach propagation across cloud and on-premises infrastructure using zero trust principleslow · 46%
The vioscaleAI score: one lens on the evidence
Not user reviews and not a paid placement: a confidence-weighted blend of the independent signals below (adoption, activity, security posture, and more), which you can sort and re-weight yourself. Vendors can correct their listing but can never move their rank, and stars are weighted low as a vanity metric. It is one way to read the evidence for Corelight, not the verdict.
| Signal | Score | Weight | Contribution | Evidence |
|---|---|---|---|---|
| Capabilities | 58 | 0.05 | 3.0 | ✓ |
| Integrations | 37 | 0.05 | 1.9 | ✓ |
| Price level | 0 | 0.04 | 0.0 | - |
| Reliability | 0 | 0.09 | 0.0 | - |
| Security posture | 5 | 0.21 | 0.0 | - |
| Pricing transparency | 0 | 0.05 | 0.0 | ✓ |
Computed . Re-weight it by intent, or see the full method.
All data & sourcesshow ↓
Every value we hold, with its source, retrieval date, and confidence. This is the evidence behind the score: don't trust it, verify it.
Content
| Attribute | Value | Evidence |
|---|---|---|
| Faq | 5 items | mediumsource · 2026-09-10 · 63% |
Features
| Attribute | Value | Evidence |
|---|---|---|
| Capabilities | Deployment model: hybrid · Full packet pcap retention: Yes · Behavioral anomaly detection: Yes · Encrypted traffic metadata analysis: Yes | mediumsource · 2026-09-28 · 60% |
Integrations
| Attribute | Value | Evidence |
|---|---|---|
| Count | 18 | mediumsource · 2026-08-19 · 60% |
Market
| Attribute | Value | Evidence |
|---|---|---|
| Availability | HqCountry: US · PrimaryMarkets: … · AvailabilityScope: global · AvailableCountries: … · NotAvailableCountries: … | highsource · 2026-08-19 · 75% |
Pricing
Security
| Attribute | Value | Evidence |
|---|---|---|
| Disclosure policy | Yes | mediumsource · 2026-08-19 · 60% |
Is Corelight the right choice for you?
Tell us the job, the constraints and what you weigh most, and we will rank Corelight against the rest of the network security we index, using the same dated evidence weighted your way.
Free to run, no account needed to start. How the evaluation works
Is this your product?
This profile was built from public sources without asking you. You can take the badge below and use it anywhere, and you can claim the profile to correct anything we got wrong. Both are free, and neither moves Corelight up or down: nobody can buy rank here, including you.
Take the badge
Live, always current, and free to use on your own site. It shows Corelight's independent score and links back to this profile.
<a href="https://www.vioscale.ai/software/corelight" target="_blank" rel="noopener">
<img src="https://www.vioscale.ai/badge/software/corelight.svg" alt="Corelight, verified on vioscaleAI" width="330" height="76" loading="lazy" />
</a>Markdown, for a README →
[](https://www.vioscale.ai/software/corelight)Claim the profile
Verify you control the domain, then point us at the pages that state the facts about Corelight and add your own description and media. Free, and it does not change the score.
- Correct anything wrong, with evidence
- Point our crawler at the pages that matter
- Write your own description and add media
Not the owner? How vendor profiles work