Arista Networks, Corelight, Darktrace and ExtraHop

About Corelight

Corelight sells the Open NDR Platform, which transforms network data into evidence. Corelight says that evidence powers AI-driven detection and expert-authored workflows.

Corelight sensors capture a copy of all traffic out-of-band. The sensor then deduplicates and cleans the data, discarding redundant multicast traffic. Powered by Zeek, the sensor performs deep protocol parsing across 70+ data types. The resulting evidence is routed to Corelight Investigator, a SIEM, or a data lake for long-term forensics.^[9]

Investigator is Corelight's SaaS-based NDR platform. Corelight says it streamlines complex investigations by eliminating repetitive review steps and enables up to 10x faster triage. Agentic Triage uses transparent, expert-written playbooks to follow consistent triage logic for every investigation. SIEM Verdict Export sends every triage verdict, including the reasoning chain, evidence links and recommended next steps, directly into the customer's SIEM. Investigator also offers host isolation, IP blocking and identity actions through integrated EDR, firewall and identity provider workflows.^[1][10]

Corelight fuses machine learning, behavioral analytics and curated signatures in its threat detection. AI/ML detection is a subscription-based module that can be purchased with Corelight Sensors, and AI/ML models are enabled, managed and tuned through Fleet Manager. Many of these detections run directly on-sensor, with no cloud dependency. Threat Intelligence is a licensed feature for Corelight Sensors and Investigator, and it is supported on all sensor options. Corelight Smart PCAP links Zeek logs, detections and extracted files to only the packets needed for investigations.^{[8][11][12][13]}

For cloud environments, Corelight Cloud Sensors are available for AWS, GCP and Azure. Corelight supports AWS, Azure and GCP native packet mirroring, and third-party packet brokers. Performance and Asset Visibility is a Corelight Open NDR module that passively extracts asset classification and network performance telemetry from traffic the sensors are already collecting.^[14][15]

Corelight also sells services. Corelight says it can provide a resident engineer to work alongside a customer's team, and services can be purchased standalone or bundled with the platform. Corelight describes integrations with Splunk Enterprise Security and Splunk SOAR, and with Microsoft Defender, Microsoft Sentinel and Microsoft Entra ID.^{[1][2][10][12][14][16]}

About Darktrace

Darktrace sells security for AI systems and agents, for network, cloud and OT environments, and for email and collaboration tools. Darktrace says it understands behavior across people, networks, applications, cloud, and AI. Darktrace says its Adaptive AI learns an organization's own operational patterns, unlike security tools that rely on static rules or training data from other organizations. Darktrace says its AI learns from each organization's own business data to identify anomalous activity for each asset across domains.^[1][14]

Darktrace says a dynamic understanding of every email user in an organization allows Darktrace / EMAIL to take a targeted response to threats that others miss. Darktrace learns from each organization's own activity and users, not a shared cross-customer model. Darktrace says its email security catches phishing, business email compromise, executive impersonation, and social engineering attacks. Darktrace says its behavioral detection extends across Microsoft Teams, Zoom, and Slack. When credentials are compromised, Darktrace responds autonomously by terminating sessions, forcing re-authentication, and restricting access across email, SaaS, and cloud. Darktrace says each employee's risk score adapts their email controls, so protection strengthens for higher-risk users as training progresses. The Darktrace Email Analysis Agent integrates with Microsoft Defender and Security Copilot to streamline investigation and response for SOC teams.^[1][15][16]

Darktrace says one solution detects, investigates, and contains threats across network, cloud, OT, endpoint, and identity, and learns the environment from the ground up. Darktrace / HYBRID NETWORK passively ingests traffic from on-premises and virtual networks, multi-cloud environments, OT, endpoints, and identities. Darktrace analyzes encrypted and decrypted traffic across network, cloud, and OT to surface activity that does not fit the environment. Darktrace then contains that activity with response actions taken natively or through firewalls, EDR, SOAR, and ITSM tools. Darktrace says it can flag account takeover, privilege escalation, and insider misuse when an identity stops matching how that identity normally behaves. When a threat is identified, Darktrace automatically acquires host and workload artifacts across endpoints, cloud, containers, and SaaS environments. Darktrace says its approach detects zero-day threats an average of 8 days before public CVE disclosure.

For cloud, Darktrace says its Adaptive AI continuously monitors activity across cloud assets, workloads, APIs, containers, and identities. Darktrace says Cyber AI Analyst automatically investigates alerts and connects related cloud and infrastructure activity. Darktrace's coverage extends across Compute, Serverless, Containers, IAM, Storage Services, and beyond. Darktrace draws data from lightweight host-based server agents or a combination of traffic mirroring and API logs. Darktrace supports security investigations by combining its detection and response capabilities with Amazon Security Lake.^[18][19]

For operational technology, Darktrace maintains a live asset inventory, obtained through passive and active scanning, and immediately reveals CVEs and End-Of-Life status. Darktrace says it identifies and contains threats across converged IT and OT environments with Adaptive AI. Darktrace says Cyber AI Analyst automatically investigates alerts and correlates related activity across OT and IT environments. Darktrace says it automatically maps its models to the MITRE for ICS attacks/techniques, and says it helps organizations meet NIST and other regulations and standards.^[20]

Darktrace calls its endpoint functionality Network Endpoint eXtended Telemetry (NEXT), which shows the endpoint process root cause for network threats. Darktrace says Cyber AI Analyst autonomously investigates alerts, gathers evidence, tests hypotheses, and delivers incident context. Darktrace responds autonomously with targeted actions that contain threats and avoid business disruption. Darktrace lets customers set response policies with configurable actions based on device types, user groups, locations, business hours, and operational requirements. Darktrace complements Microsoft Defender for Endpoint by connecting endpoint signals with behavioral understanding across a wider infrastructure.^[15][21]

Darktrace says action can be taken independently or via integrations with native security controls, and that alerts are sent wherever the customer wants them. Darktrace extends its autonomous response to Check Point firewalls and to Palo Alto firewalls. Darktrace incidents and model breach alerts can be analyzed in CIM compatible Splunk dashboards. Darktrace enriches its AI decision-making with alerts from the Crowdstrike Falcon platform. Darktrace's Cyber AI Analyst integrates with Microsoft Copilot for Security.^{[14][15][22][23]}

HARMAN International uses Darktrace coverage for email, network, and OT systems. Centre Parcs turned to Darktrace to protect its network, email, and cloud environments with a single AI security platform. Darktrace says organizations across all sizes and industries rely on it to get proactive about cyber security.^[14][16][20]

About ExtraHop

ExtraHop sells a network detection and response platform called RevealX that analyzes network traffic to identify hidden attack surfaces, lateral movement and credential abuse, and consolidates network performance management and intrusion detection tooling. The company also markets packet forensics and integrations supporting security operations and network operations teams.^[1]