What is Corelight?
Corelight is a commercial wrapper and hardware accelerator for the open-source Zeek network monitoring framework. It turns raw network traffic into structured logs for threat hunting. (Corelight essentially acts as a commercial interface for the open-source Zeek project). It feeds high-fidelity data to your existing security tools rather than taking action on its own.
Developed by Corelight, Inc., this network detection and response platform targets large enterprise security operations centers. It solves the problem of blind spots in internal network traffic. Analysts use it to track lateral movement and data exfiltration across physical and cloud environments.
- Primary Use Case: Identifying lateral movement and data exfiltration using Zeek metadata.
- Ideal For: Enterprise security teams with dedicated threat hunters.
- Pricing: Starts at Custom Pricing (Enterprise Subscription) : High-end hardware and software costs limit this to large budgets.
Key Features and How Corelight Works
Network Metadata and Alerting
- Zeek-based Metadata: Generates over 400 specific logs for protocols like HTTP and DNS. Limit: Requires significant SIEM storage capacity.
- Suricata Integration: Adds signature-based alerting alongside behavioral analysis. Limit: High traffic volumes can trigger alert fatigue without careful tuning.
Traffic Analysis and Capture
- Smart PCAP: Captures only packets associated with specific alerts. Limit: Does not provide full continuous packet capture for retrospective analysis of unalerted traffic.
- Encrypted Traffic Analysis: Extracts insights from SSH and TLS sessions. Limit: Cannot inspect the actual payload of encrypted packets without a separate decryption broker.
Cloud and Hardware Sensors
- Hardware Acceleration: Uses specialized NICs to monitor up to 100 Gbps of traffic. Limit: Physical appliances require rack space and manual deployment.
- Cloud Sensors: Supports AWS VPC Traffic Mirroring and Azure vTAP. Limit: Cloud provider mirroring fees add hidden costs to the deployment.
Corelight Pros and Cons
Pros
- Zeek logs provide deep context, reducing false positives compared to standard NetFlow data.
- The open-source foundation prevents vendor lock-in for your underlying data formats.
- Physical appliances handle massive throughput up to 100 Gbps without dropping packets.
- Pre-built connectors send data directly to Splunk and Microsoft Sentinel.
Cons
- Enterprise pricing makes this inaccessible for small and medium businesses.
- Querying Zeek logs requires advanced knowledge of network protocols.
- Storing 400 distinct log types demands massive SIEM compute and storage resources.
- The platform focuses strictly on detection rather than automated blocking or quarantine.
Who Should Use Corelight?
- Enterprise Threat Hunters: Analysts who need deep protocol visibility to track advanced persistent threats.
- Large SOC Teams: Organizations with the budget to ingest massive log volumes into Splunk or Sentinel.
- Small IT Teams: Solo admins will struggle with the complex deployment and lack of automated remediation. Look elsewhere.
Corelight Pricing and Plans
Corelight does not publish public pricing or offer a free trial. You must contact sales for a custom quote.
The Enterprise Subscription covers the software updates, Zeek sensor monitoring, and the cloud management console. The Enterprise Support Tier adds 24/7 availability and a one-hour response SLA for critical issues.
Expect costs to scale based on the number of sensors and total network throughput. Hardware appliances require upfront capital expenditure. Cloud sensors incur ongoing subscription fees.
How Corelight Compares to Alternatives
Similar to ExtraHop, Corelight provides deep network visibility. But ExtraHop focuses heavily on machine learning and automated behavioral anomalies. Corelight relies more on structured Zeek metadata, giving analysts raw data for manual threat hunting. ExtraHop is often easier for mid-level analysts to read.
Unlike Darktrace, Corelight does not emphasize autonomous response. Darktrace actively interrupts suspicious connections using its AI engine. Corelight acts strictly as an observer. It feeds high-fidelity data to your existing security tools rather than taking action on its own.
Final Verdict: Is Corelight Right for Your SOC?
Corelight is a specialized tool for mature security teams. If you have dedicated threat hunters who know how to query Zeek logs, choose this platform. It provides unmatched protocol visibility.
But it requires a massive budget.
The storage costs alone will shock unprepared buyers.
If you need automated remediation or lack a dedicated SOC, look elsewhere. Darktrace offers a better fit for teams wanting AI to handle the active blocking.