CISO Tribune

Vendor comparison · 2 companies

Corelight vs Gigamon

Corelight sells the Open NDR Platform, which transforms network data into evidence. The Gigamon Deep Observability Pipeline combines physical, virtual, cloud-native, and software-based components to provide visibility, intelligence, and control across hybrid cloud infrastructure. CISO Tribune files both under Network detection and response and Network visibility and traffic brokering. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Corelight
  • Gigamon
Corelight vs Gigamon: Products, Customers and Funding Compared
CorelightCorelight sells the Open NDR Platform, which transforms network data into evidence.corelight.comGigamonThe Gigamon Deep Observability Pipeline combines physical, virtual, cloud-native, and software-based components to provide visibility, intelligence, and control across hybrid cloud infrastructure.gigamon.com
What it sells
  • Investigator[1][4][9][10][12][13][15][18]A SaaS-based NDR platform for investigations. It uses Agentic Triage playbooks to triage alerts.
  • Corelight Sensors[8][12][13]Sensors that capture a copy of traffic out-of-band and turn it into network evidence with Zeek.
  • Smart PCAP[1][4][12]Links Zeek logs, detections and extracted files to only the packets needed for investigations.
  • AI/ML detections[8]A subscription-based module of AI/ML detections that can be purchased with Corelight Sensors.
  • Threat Intelligence[4][8][13]A licensed feature for Corelight Sensors and Investigator.
  • Cloud Sensors[14]Corelight sensors for cloud networks, available for AWS, GCP and Azure.
  • Gigamon Deep Observability PipelineA pipeline that delivers optimized traffic, enriched metadata and network-derived telemetry to security, observability, analytics and AI platforms.
  • GigaVUE Cloud Suite[1][5][6][8]Cloud visibility for private cloud and hybrid public cloud infrastructure.
  • GigaVUE-FM[3]Fabric manager for orchestration and policy management.
  • GigaSMART[1][3][4]Applications that transform, decrypt, optimize and enrich traffic.
  • Gigamon Insights[10]Applies agentic AI to network-derived telemetry.
  • Application Metadata Intelligence[2][10]Extracts application and protocol context from network traffic.
Categories
Headquarters
San Francisco, United States[3]Not stated on its pages
Founded
2016Not stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • October 6, 2026Corelight announced the establishment of Corelight Canada, a standalone entity intended to work more closely with customers, partners and public sector organizations in Canada.[17]
  • July 27, 2026Corelight announced the appointment of Amanda Berger as its Chief Customer Officer.[5]
  • June 9, 2026Corelight announced that its Open NDR Platform, including Investigator and Hosted Fleet Manager, was listed on the FedRAMP Marketplace as FedRAMP In Process at the Class C (Moderate) level.[18]
  • June 9, 2026Corelight announced it has reached FedRAMP In Process status.[6]
  • September 2, 2026Gigamon appointed Grant Yacomeni as chief information security officer, reporting to its chief operating officer.[14]
  • June 15, 2026Gigamon announced a new integration with Zscaler that combines Zscaler Private Access with Gigamon Application Metadata Intelligence.[2]
G2 and Gartner Peer Insights
  • G2: listed, seen November 5, 2026[7]
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Corelight sells mainly to SOC teams that want network evidence for detection, investigation and threat hunting. Corelight describes customers extending visibility across hybrid and multi-cloud environments. Customer examples on its pages include a global beauty retailer protecting point-of-sale terminals and a major U.S mortgage lender with data centers and multi-cloud workloads in AWS and Azure.Its pages address NetOps and InfoSec teams that need visibility to troubleshoot application performance problems and security-related issues. Gigamon offers capabilities for fixed network or wireline providers. IT and cloud teams monitoring workloads as they are migrated to the cloud are addressed in the pages.
Last verified
September 27, 2026November 3, 2026

Where they overlap

  • Corelight and Gigamon are both filed under Network detection and response and Network visibility and traffic brokering.

Where they differ, field by field

  • Corelight's primary category is Network detection and response; Gigamon's is Network visibility and traffic brokering.
  • Gigamon is also filed under Zero trust network access.
  • Corelight lists Investigator, Corelight Sensors, Smart PCAP, AI/ML detections, Threat Intelligence and 1 more. Gigamon lists Gigamon Deep Observability Pipeline, GigaVUE Cloud Suite, GigaVUE-FM, GigaSMART, Gigamon Insights and 1 more.
  • Corelight is headquartered in San Francisco, United States.
  • Corelight was founded in 2016.

What it sells: Corelight

What Investigator does[1][4][9][10][12][13][15][18]
Investigator is Corelight's SaaS-based NDR platform that streamlines complex investigations. Agentic Triage uses transparent, expert-written playbooks. SIEM Verdict Export sends triage verdicts, reasoning chains and evidence links into a SIEM.
What Corelight Sensors does[8][12][13]
The sensor captures a copy of all traffic out-of-band, then deduplicates and cleans the data. Powered by Zeek, it performs deep protocol parsing across 70+ data types. The evidence is routed to Investigator, a SIEM or a data lake.
What Smart PCAP does[1][4][12]
Corelight Smart PCAP links Zeek logs, detections and extracted files to only the packets needed for investigations. Corelight says it lets teams store packets longer and find them faster.
What AI/ML detections does[8]
AI/ML detection is a subscription-based module that can be purchased with Corelight Sensors. It can be deployed across air-gapped, hybrid, cloud or multicloud environments. Models are enabled, managed and tuned through Fleet Manager. Many detections run directly on-sensor with no cloud dependency.
What Threat Intelligence does[4][8][13]
Threat Intelligence is a licensed feature for Corelight Sensors and Investigator. It is supported on all sensor options. It is managed through Fleet Manager or the sensor's Threat Intelligence framework.
What Cloud Sensors does[14]
Corelight Cloud Sensors are available for AWS, GCP and Azure. Corelight supports AWS, Azure and GCP native packet mirroring, and third-party packet brokers.

What it sells: Gigamon

What Gigamon Deep Observability Pipeline does
The Gigamon Deep Observability Pipeline delivers optimized traffic, enriched metadata and network-derived telemetry to security, observability, analytics and AI platforms. It combines physical, virtual, cloud-native and software-based components across hybrid cloud infrastructure. It provides visibility into traffic in motion across physical, virtual, container and cloud environments.
What GigaVUE Cloud Suite does[1][5][6][8]
GigaVUE Cloud Suite is a core component of the Gigamon Deep Observability Pipeline. Public cloud visibility covers hosted workloads in AWS, Azure or Google Cloud Platform. Private cloud visibility covers applications running on Kubernetes, Nutanix, OpenStack, Red Hat OpenShift and VMware.
What GigaVUE-FM does[3]
GigaVUE-FM fabric manager provides centralized orchestration and policy management across distributed environments. It centralizes orchestration, policy management and operational visibility across physical, virtual and cloud environments.
What Gigamon Insights does[10]
Gigamon Insights applies agentic AI to network-derived telemetry to identify hidden threats. It delivers recommendations and guided actions within existing security workflows.
What Application Metadata Intelligence does[2][10]
Gigamon Application Metadata Intelligence (AMI) extracts application and protocol context from observed network traffic. It delivers that context to SIEM, NDR and observability platforms.

Questions about Corelight and Gigamon

What do Corelight and Gigamon sell?
Corelight sells Investigator, Corelight Sensors, Smart PCAP, AI/ML detections, Threat Intelligence and 1 more. Gigamon sells Gigamon Deep Observability Pipeline, GigaVUE Cloud Suite, GigaVUE-FM, GigaSMART, Gigamon Insights and 1 more.
Are Corelight and Gigamon in the same category?
They share Network detection and response and Network visibility and traffic brokering. Corelight's primary category is Network detection and response and Gigamon's is Network visibility and traffic brokering.
Where are Corelight and Gigamon headquartered?
Corelight is headquartered in San Francisco, United States.
When were Corelight and Gigamon founded?
Corelight was founded in 2016.
Who are Corelight and Gigamon sold to?
From its own pages, Corelight sells mainly to SOC teams that want network evidence for detection, investigation and threat hunting. Its pages address NetOps and InfoSec teams that need visibility to troubleshoot application performance problems and security-related issues.
What have Corelight and Gigamon announced recently?
October 6, 2026: Corelight announced the establishment of Corelight Canada, a standalone entity intended to work more closely with customers, partners and public sector organizations in Canada. September 2, 2026: Gigamon appointed Grant Yacomeni as chief information security officer, reporting to its chief operating officer.

About Corelight

Corelight sells the Open NDR Platform, which transforms network data into evidence. Corelight says that evidence powers AI-driven detection and expert-authored workflows.

Corelight sensors capture a copy of all traffic out-of-band. The sensor then deduplicates and cleans the data, discarding redundant multicast traffic. Powered by Zeek, the sensor performs deep protocol parsing across 70+ data types. The resulting evidence is routed to Corelight Investigator, a SIEM, or a data lake for long-term forensics.[9]

Investigator is Corelight's SaaS-based NDR platform. Corelight says it streamlines complex investigations by eliminating repetitive review steps and enables up to 10x faster triage. Agentic Triage uses transparent, expert-written playbooks to follow consistent triage logic for every investigation. SIEM Verdict Export sends every triage verdict, including the reasoning chain, evidence links and recommended next steps, directly into the customer's SIEM. Investigator also offers host isolation, IP blocking and identity actions through integrated EDR, firewall and identity provider workflows.[1][10]

Corelight fuses machine learning, behavioral analytics and curated signatures in its threat detection. AI/ML detection is a subscription-based module that can be purchased with Corelight Sensors, and AI/ML models are enabled, managed and tuned through Fleet Manager. Many of these detections run directly on-sensor, with no cloud dependency. Threat Intelligence is a licensed feature for Corelight Sensors and Investigator, and it is supported on all sensor options. Corelight Smart PCAP links Zeek logs, detections and extracted files to only the packets needed for investigations.[8][11][12][13]

For cloud environments, Corelight Cloud Sensors are available for AWS, GCP and Azure. Corelight supports AWS, Azure and GCP native packet mirroring, and third-party packet brokers. Performance and Asset Visibility is a Corelight Open NDR module that passively extracts asset classification and network performance telemetry from traffic the sensors are already collecting.[14][15]

Corelight also sells services. Corelight says it can provide a resident engineer to work alongside a customer's team, and services can be purchased standalone or bundled with the platform. Corelight describes integrations with Splunk Enterprise Security and Splunk SOAR, and with Microsoft Defender, Microsoft Sentinel and Microsoft Entra ID.[1][2][10][12][14][16]

Corelight on the record

Sources

Corelight full record

  1. [1]All productsCorelight · corelight.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]About corelightCorelight · corelight.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]H i g growth partners invests in corelights 75m series d financingH.I.G. Capital · hig.com · published September 3, 2021 · Tier C
  4. [4]Corelight | Evidence-Based NDR & Threat Hunting PlatformCorelight · undated page, accessed October 24, 2026 · Tier A
  5. [5]Corelight Welcomes Veteran Customer Advocate Amanda Berger as Chief Customer OfficerCorelight · published July 27, 2026 · Tier A
  6. [6]Corelight Achieves FedRAMP In Process Certification, Advancing Network Detection and Response for Federal Government AgenciesCorelight · published June 9, 2026 · Tier A
  7. [7]Corelight Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
  8. [8]AI/ML Detections: Transparent, Evidence-Based NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  9. [9]Network Visibility: Complete Visibility for Security Operations | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  10. [10]Investigator: Agentic AI Triage for NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  11. [11]AI-Powered Threat Detection Platform | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  12. [12]Intrusion Detection System (IDS) Powered by Suricata | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  13. [13]Cyber Threat Intelligence for Open NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  14. [14]Cloud Solutions | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  15. [15]Performance and Asset Visibility | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  16. [16]Professional & Consulting Services | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  17. [17]Corelight establishes Corelight CanadaCorelight · published October 6, 2026 · Tier A
  18. [18]Corelight Achieves FedRAMP In Process Certification, Advancing Network Detection and Response for Federal Government AgenciesPR Newswire · published June 9, 2026 · Tier A

Gigamon full record

  1. [1]Network-Derived Telemetry for Hybrid Cloud Security | GigamonGigamon · undated page, accessed November 3, 2026 · Tier A
  2. [2]Gigamon Partners with Zscaler to Deliver Deep Observability to Zero Trust Private AccessGigamon · undated page, accessed November 3, 2026 · Tier A
  3. [3]Deep Observability Pipeline | GigamonGigamon · undated page, accessed November 10, 2026 · Tier A
  4. [4]Slash Network Traffic Tool Costs by 33% | GigamonGigamon · undated page, accessed November 10, 2026 · Tier A
  5. [5]Cloud Cost Optimization, Management, and Savings | GigamonGigamon · undated page, accessed November 10, 2026 · Tier A
  6. [6]Cloud Visibility Solutions | GigamonGigamon · undated page, accessed November 10, 2026 · Tier A
  7. [7]Cloud Migration Strategies, Tools and Solutions | GigamonGigamon · undated page, accessed November 10, 2026 · Tier A
  8. [8]Assure Cloud Security and Compliance | GigamonGigamon · undated page, accessed November 10, 2026 · Tier A
  9. [9]Make Network Changes without DisruptionGigamon · undated page, accessed November 10, 2026 · Tier A
  10. [10]Security Operations and Threat Detection | GigamonGigamon · undated page, accessed November 10, 2026 · Tier A
  11. [11]Managing Your Network | NetOps | GigamonGigamon · undated page, accessed November 10, 2026 · Tier A
  12. [12]Managing Multi-Cloud Infrastructures | GigamonGigamon · undated page, accessed November 10, 2026 · Tier A
  13. [13]Visibilty For Service Providers | Subscriber-Aware | GigamonGigamon · undated page, accessed November 10, 2026 · Tier A
  14. [14]Gigamon Appoints Grant Yacomeni as Chief Information Security OfficerGigamon · published September 2, 2026 · Tier A

Spot a factual error? Request a correction.