CISO Tribune

Company record · security vendor

Corelight

CISO Tribune company record: Corelight, security vendor (Network detection and response)

Where Corelight appears on the record (18)

Every page on CISO Tribune and its network that carries this company, 18 in all.

Compared with (15)

vs Arista Networks, vs Blackwall, vs Darktrace, vs ExtraHop, vs Fidelis, vs FireMon, vs Gigamon, vs Guardsix, vs Illumio, vs NEOX NETWORKS, vs NETSCOUT, vs Network Critical, vs SolarWinds, vs ThreatDefence, vs Vectra AI

In the vendor directory (3)

What the company sells

Corelight sells the Open NDR Platform, which transforms network data into evidence. Corelight says that evidence powers AI-driven detection and expert-authored workflows.

Corelight sensors capture a copy of all traffic out-of-band. The sensor then deduplicates and cleans the data, discarding redundant multicast traffic. Powered by Zeek, the sensor performs deep protocol parsing across 70+ data types. The resulting evidence is routed to Corelight Investigator, a SIEM, or a data lake for long-term forensics.

Investigator is Corelight's SaaS-based NDR platform. Corelight says it streamlines complex investigations by eliminating repetitive review steps and enables up to 10x faster triage. Agentic Triage uses transparent, expert-written playbooks to follow consistent triage logic for every investigation. SIEM Verdict Export sends every triage verdict, including the reasoning chain, evidence links and recommended next steps, directly into the customer's SIEM. Investigator also offers host isolation, IP blocking and identity actions through integrated EDR, firewall and identity provider workflows.

Corelight fuses machine learning, behavioral analytics and curated signatures in its threat detection. AI/ML detection is a subscription-based module that can be purchased with Corelight Sensors, and AI/ML models are enabled, managed and tuned through Fleet Manager. Many of these detections run directly on-sensor, with no cloud dependency. Threat Intelligence is a licensed feature for Corelight Sensors and Investigator, and it is supported on all sensor options. Corelight Smart PCAP links Zeek logs, detections and extracted files to only the packets needed for investigations.

For cloud environments, Corelight Cloud Sensors are available for AWS, GCP and Azure. Corelight supports AWS, Azure and GCP native packet mirroring, and third-party packet brokers. Performance and Asset Visibility is a Corelight Open NDR module that passively extracts asset classification and network performance telemetry from traffic the sensors are already collecting.

Corelight also sells services. Corelight says it can provide a resident engineer to work alongside a customer's team, and services can be purchased standalone or bundled with the platform. Corelight describes integrations with Splunk Enterprise Security and Splunk SOAR, and with Microsoft Defender, Microsoft Sentinel and Microsoft Entra ID.[1][2][8][9][10][11][12][13][14][15][16]

Categories
Headquarters
San Francisco, United States[3]
Founded
2016
Ownership
Not established from our sources
CISO on record
Not yet on our record. Send a verified source
Website
corelight.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

  • Investigator[1][4][9][10][12][13][15][18]

    A SaaS-based NDR platform for investigations. It uses Agentic Triage playbooks to triage alerts.

    Investigator is Corelight's SaaS-based NDR platform that streamlines complex investigations. Agentic Triage uses transparent, expert-written playbooks. SIEM Verdict Export sends triage verdicts, reasoning chains and evidence links into a SIEM.

  • Corelight Sensors[8][12][13]

    Sensors that capture a copy of traffic out-of-band and turn it into network evidence with Zeek.

    The sensor captures a copy of all traffic out-of-band, then deduplicates and cleans the data. Powered by Zeek, it performs deep protocol parsing across 70+ data types. The evidence is routed to Investigator, a SIEM or a data lake.

  • Smart PCAP[1][4][12]

    Links Zeek logs, detections and extracted files to only the packets needed for investigations.

    Corelight Smart PCAP links Zeek logs, detections and extracted files to only the packets needed for investigations. Corelight says it lets teams store packets longer and find them faster.

  • AI/ML detections[8]

    A subscription-based module of AI/ML detections that can be purchased with Corelight Sensors.

    AI/ML detection is a subscription-based module that can be purchased with Corelight Sensors. It can be deployed across air-gapped, hybrid, cloud or multicloud environments. Models are enabled, managed and tuned through Fleet Manager. Many detections run directly on-sensor with no cloud dependency.

  • Threat Intelligence[4][8][13]

    A licensed feature for Corelight Sensors and Investigator.

    Threat Intelligence is a licensed feature for Corelight Sensors and Investigator. It is supported on all sensor options. It is managed through Fleet Manager or the sensor's Threat Intelligence framework.

  • Cloud Sensors[14]

    Corelight sensors for cloud networks, available for AWS, GCP and Azure.

    Corelight Cloud Sensors are available for AWS, GCP and Azure. Corelight supports AWS, Azure and GCP native packet mirroring, and third-party packet brokers.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Corelight's categories, then alphabetical. A list from the record, never a ranking.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

  • G2 · 4.6 out of 5[7]seen November 5, 2026

Recent news

Dated company events from the last twelve months, each in one sentence of ours with its source. Newest first.

  • October 6, 2026

    Corelight announced the establishment of Corelight Canada, a standalone entity intended to work more closely with customers, partners and public sector organizations in Canada. Corelight[17]

  • July 27, 2026

    Corelight announced the appointment of Amanda Berger as its Chief Customer Officer. Corelight[5]

  • June 9, 2026

    Corelight announced that its Open NDR Platform, including Investigator and Hosted Fleet Manager, was listed on the FedRAMP Marketplace as FedRAMP In Process at the Class C (Moderate) level. PR Newswire[18]

  • June 9, 2026

    Corelight announced it has reached FedRAMP In Process status. Corelight[6]

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

  1. [1]All productsCorelight · corelight.com · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
  2. [2]About corelightCorelight · corelight.com · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
  3. [3]H i g growth partners invests in corelights 75m series d financingH.I.G. Capital · hig.com · published September 3, 2021 · Tier C
  4. [4]Corelight | Evidence-Based NDR & Threat Hunting PlatformCorelight · undated page, accessed October 24, 2026 · Tier A: the company, a regulator or a filing
  5. [5]Corelight Welcomes Veteran Customer Advocate Amanda Berger as Chief Customer OfficerCorelight · published July 27, 2026 · Tier A: the company, a regulator or a filing
  6. [6]Corelight Achieves FedRAMP In Process Certification, Advancing Network Detection and Response for Federal Government AgenciesCorelight · published June 9, 2026 · Tier A: the company, a regulator or a filing
  7. [7]Corelight Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
  8. [8]AI/ML Detections: Transparent, Evidence-Based NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
  9. [9]Network Visibility: Complete Visibility for Security Operations | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
  10. [10]Investigator: Agentic AI Triage for NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
  11. [11]AI-Powered Threat Detection Platform | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
  12. [12]Intrusion Detection System (IDS) Powered by Suricata | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
  13. [13]Cyber Threat Intelligence for Open NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
  14. [14]Cloud Solutions | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
  15. [15]Performance and Asset Visibility | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
  16. [16]Professional & Consulting Services | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
  17. [17]Corelight establishes Corelight CanadaCorelight · published October 6, 2026 · Tier A: the company, a regulator or a filing
  18. [18]Corelight Achieves FedRAMP In Process Certification, Advancing Network Detection and Response for Federal Government AgenciesPR Newswire · published June 9, 2026 · Tier A: the company, a regulator or a filing

Last verified September 27, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded September 27, 2026, expanded November 5, 2026 from the references above.

Work for Corelight? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.

Security leadership

CISO Tribune has not yet recorded who holds the top security seat at Corelight. We add a seat only from a verified source; if you have one, send it to the desk.

Questions CISOs ask about Corelight

What does Corelight sell?
Corelight sells Investigator, Corelight Sensors, Smart PCAP, AI/ML detections, Threat Intelligence and Cloud Sensors. Investigator: A SaaS-based NDR platform for investigations. It uses Agentic Triage playbooks to triage alerts. Corelight Sensors: Sensors that capture a copy of traffic out-of-band and turn it into network evidence with Zeek. Smart PCAP: Links Zeek logs, detections and extracted files to only the packets needed for investigations. AI/ML detections: A subscription-based module of AI/ML detections that can be purchased with Corelight Sensors.
Who does Corelight fit?
From its own pages, Corelight sells mainly to SOC teams that want network evidence for detection, investigation and threat hunting. Corelight describes customers extending visibility across hybrid and multi-cloud environments. Customer examples on its pages include a global beauty retailer protecting point-of-sale terminals and a major U.S mortgage lender with data centers and multi-cloud workloads in AWS and Azure.
How does CISO Tribune file Corelight?
CISO Tribune files Corelight under Network detection and response, with Network visibility and traffic brokering as a secondary category.
Where is Corelight headquartered?
Corelight is headquartered in San Francisco, United States.
When was Corelight founded?
Corelight was founded in 2016.

Related guides