Arista Networks, Corelight, Darktrace and Vectra AI

About Corelight

Corelight sells the Open NDR Platform, which transforms network data into evidence. Corelight says that evidence powers AI-driven detection and expert-authored workflows.

Corelight sensors capture a copy of all traffic out-of-band. The sensor then deduplicates and cleans the data, discarding redundant multicast traffic. Powered by Zeek, the sensor performs deep protocol parsing across 70+ data types. The resulting evidence is routed to Corelight Investigator, a SIEM, or a data lake for long-term forensics.^[9]

Investigator is Corelight's SaaS-based NDR platform. Corelight says it streamlines complex investigations by eliminating repetitive review steps and enables up to 10x faster triage. Agentic Triage uses transparent, expert-written playbooks to follow consistent triage logic for every investigation. SIEM Verdict Export sends every triage verdict, including the reasoning chain, evidence links and recommended next steps, directly into the customer's SIEM. Investigator also offers host isolation, IP blocking and identity actions through integrated EDR, firewall and identity provider workflows.^[1][10]

Corelight fuses machine learning, behavioral analytics and curated signatures in its threat detection. AI/ML detection is a subscription-based module that can be purchased with Corelight Sensors, and AI/ML models are enabled, managed and tuned through Fleet Manager. Many of these detections run directly on-sensor, with no cloud dependency. Threat Intelligence is a licensed feature for Corelight Sensors and Investigator, and it is supported on all sensor options. Corelight Smart PCAP links Zeek logs, detections and extracted files to only the packets needed for investigations.^{[8][11][12][13]}

For cloud environments, Corelight Cloud Sensors are available for AWS, GCP and Azure. Corelight supports AWS, Azure and GCP native packet mirroring, and third-party packet brokers. Performance and Asset Visibility is a Corelight Open NDR module that passively extracts asset classification and network performance telemetry from traffic the sensors are already collecting.^[14][15]

Corelight also sells services. Corelight says it can provide a resident engineer to work alongside a customer's team, and services can be purchased standalone or bundled with the platform. Corelight describes integrations with Splunk Enterprise Security and Splunk SOAR, and with Microsoft Defender, Microsoft Sentinel and Microsoft Entra ID.^{[1][2][10][12][14][16]}

About Darktrace

Darktrace sells security for AI systems and agents, for network, cloud and OT environments, and for email and collaboration tools. Darktrace says it understands behavior across people, networks, applications, cloud, and AI. Darktrace says its Adaptive AI learns an organization's own operational patterns, unlike security tools that rely on static rules or training data from other organizations. Darktrace says its AI learns from each organization's own business data to identify anomalous activity for each asset across domains.^[1][14]

Darktrace says a dynamic understanding of every email user in an organization allows Darktrace / EMAIL to take a targeted response to threats that others miss. Darktrace learns from each organization's own activity and users, not a shared cross-customer model. Darktrace says its email security catches phishing, business email compromise, executive impersonation, and social engineering attacks. Darktrace says its behavioral detection extends across Microsoft Teams, Zoom, and Slack. When credentials are compromised, Darktrace responds autonomously by terminating sessions, forcing re-authentication, and restricting access across email, SaaS, and cloud. Darktrace says each employee's risk score adapts their email controls, so protection strengthens for higher-risk users as training progresses. The Darktrace Email Analysis Agent integrates with Microsoft Defender and Security Copilot to streamline investigation and response for SOC teams.^[1][15][16]

Darktrace says one solution detects, investigates, and contains threats across network, cloud, OT, endpoint, and identity, and learns the environment from the ground up. Darktrace / HYBRID NETWORK passively ingests traffic from on-premises and virtual networks, multi-cloud environments, OT, endpoints, and identities. Darktrace analyzes encrypted and decrypted traffic across network, cloud, and OT to surface activity that does not fit the environment. Darktrace then contains that activity with response actions taken natively or through firewalls, EDR, SOAR, and ITSM tools. Darktrace says it can flag account takeover, privilege escalation, and insider misuse when an identity stops matching how that identity normally behaves. When a threat is identified, Darktrace automatically acquires host and workload artifacts across endpoints, cloud, containers, and SaaS environments. Darktrace says its approach detects zero-day threats an average of 8 days before public CVE disclosure.

For cloud, Darktrace says its Adaptive AI continuously monitors activity across cloud assets, workloads, APIs, containers, and identities. Darktrace says Cyber AI Analyst automatically investigates alerts and connects related cloud and infrastructure activity. Darktrace's coverage extends across Compute, Serverless, Containers, IAM, Storage Services, and beyond. Darktrace draws data from lightweight host-based server agents or a combination of traffic mirroring and API logs. Darktrace supports security investigations by combining its detection and response capabilities with Amazon Security Lake.^[18][19]

For operational technology, Darktrace maintains a live asset inventory, obtained through passive and active scanning, and immediately reveals CVEs and End-Of-Life status. Darktrace says it identifies and contains threats across converged IT and OT environments with Adaptive AI. Darktrace says Cyber AI Analyst automatically investigates alerts and correlates related activity across OT and IT environments. Darktrace says it automatically maps its models to the MITRE for ICS attacks/techniques, and says it helps organizations meet NIST and other regulations and standards.^[20]

Darktrace calls its endpoint functionality Network Endpoint eXtended Telemetry (NEXT), which shows the endpoint process root cause for network threats. Darktrace says Cyber AI Analyst autonomously investigates alerts, gathers evidence, tests hypotheses, and delivers incident context. Darktrace responds autonomously with targeted actions that contain threats and avoid business disruption. Darktrace lets customers set response policies with configurable actions based on device types, user groups, locations, business hours, and operational requirements. Darktrace complements Microsoft Defender for Endpoint by connecting endpoint signals with behavioral understanding across a wider infrastructure.^[15][21]

Darktrace says action can be taken independently or via integrations with native security controls, and that alerts are sent wherever the customer wants them. Darktrace extends its autonomous response to Check Point firewalls and to Palo Alto firewalls. Darktrace incidents and model breach alerts can be analyzed in CIM compatible Splunk dashboards. Darktrace enriches its AI decision-making with alerts from the Crowdstrike Falcon platform. Darktrace's Cyber AI Analyst integrates with Microsoft Copilot for Security.^{[14][15][22][23]}

HARMAN International uses Darktrace coverage for email, network, and OT systems. Centre Parcs turned to Darktrace to protect its network, email, and cloud environments with a single AI security platform. Darktrace says organizations across all sizes and industries rely on it to get proactive about cyber security.^[14][16][20]

About Vectra AI

Vectra AI sells the Vectra AI Platform, a security platform that covers network, identity and cloud. Vectra AI says its platform uses behavioral detection and real-time network visibility to reduce exposure and stop attacks across network, identity, and cloud. Vectra AI says the platform covers >90% of MITRE ATT&CK techniques for real-world attack scenarios.^[1]

Vectra AI says its platform follows attackers across data centers, remote locations, clouds, identities, SaaS, Gen AI and IoT/OT. Vectra AI says its AI brings together three core capabilities to help security teams see what is happening, act on it, and strengthen security over time. Vectra AI describes one capability as continuously identifying and reducing attack exposure risk across the enterprise. The third capability is to track risk reduction, validate controls, and deliver audit-ready proof in real time.^[1][4]

On the detection side, Vectra AI says its detections surface attackers moving laterally in both east-west and north-south traffic. Vectra AI Detections for Identity surface attackers using credential theft, account compromise, and privilege escalation across both human and machine identities. Vectra AI Detections for Cloud surface multi-cloud attacks. Vectra AI says it offers over 200 AI-driven attacker behavior detections across network, identity and cloud. Vectra AI says AI Assistants automatically triage, correlate, and prioritize threats across domains. Vectra AI shows threats ranked by urgency score in a single view powered by Attack Signal Intelligence.^[1][5][6]

Vectra AI describes AI agents that triage, stitch, and prioritize detections. AI Triage separates normal network activity from behavior that is likely to be malicious. AI Stitching correlates behaviors across network, identity, and cloud to identify the original compromised account or device. AI Prioritization delivers entity-centric urgency scoring based on attack profile, velocity, and techniques. AI Analyst accelerates incident response for MDR customers. Vectra AI says analysts can answer security questions with 25+ enriched metadata types and 250+ contextual fields spanning network, identity, and cloud. Vectra AI says customers can connect Vectra AI to tools like Claude and Cursor.^[5]

For response, Vectra AI says its controls include disabling attacker-controlled accounts in Active Directory and Entra ID, and blocking command-and-control traffic at the firewall.^[5]

Vectra AI says its Cloud Detection and Response solution protects the Microsoft environments of enterprises. Vectra AI says its Microsoft 365 offering lets teams see attackers manipulating M365 access, tools, services and applications including SharePoint, OneDrive, Teams, Exchange, Power Automate and eDiscovery. Vectra AI lists native integrations for Microsoft Sentinel and Defender for Endpoint. Vectra AI says teams can use one central platform to query Azure AD, M365 and AWS Control Plane logs. Vectra AI says that before Vectra AI, developing a single detection at Blackstone took up to six months.^[7]

Vectra AI says Vectra MXDR analysts monitor, investigate and respond within a customer's security system around the clock. Vectra AI says the service provides complete 24/7 coverage across identity, public cloud, SaaS and data center networks of all types. Vectra AI says customers can choose full management or co-management based on their SOC's maturity. Vectra AI says Vectra MXDR will remotely respond and contain threats within minutes of initial alert, both natively on the Vectra AI Platform and through its security tools and integrations.^[9]

Vectra AI says its platform integrates across cloud services, packet brokers, virtualization, endpoint, SIEM, SOAR, ITSM and firewalls. Vectra AI says 2,000+ security teams use the Vectra AI Platform.^[1][4][6]