No. 10 of 19 ·Anomaly Detection Software

Corelight Open NDR

Web · Linux · Self-hosted · API

Freedom report

One barScore 5.5

Free tierNo free tier on record
Open codeNo open-source code on record
Runs widely2 of 6 device platforms
DocumentedPlans, terms and facts published

Corelight Open NDR is ranked #10 of 19 in anomaly detection software on Freedom251. It runs on API, Linux, Self-hosted, Web.

Corelight Open NDR plans and pricing

All plans

Custom Not published capacity-based licensing corelight.com · 30 Sept 2026

Compared on anomaly detection software

Detection method: hybrid
Real-time detection: Yes
Supported data: network traffic, packet data, flow logs, cloud network traffic, protocol logs, files
Deployment options: hybrid
Anomaly explanations: Yes

Best Corelight Open NDR alternatives

See all 18

Two bars ManageEngine NetFlow Analyzer Free tier No. 1$172/mo6.6 Two bars OpenSearch Free tier No. 2Free6.6 Two bars PyOD Free tier No. 3Free6.6 Two bars Anomalib Free tier No. 4Free6.5 Two bars PySAD Free tier No. 5Free6.5 One bar Soda Free tier No. 6$750/mo6.5

The record

Purpose: Corelight Open NDR transforms raw network and cloud traffic into context-enriched, high-fidelity evidence for security operations.
Detection: Its detection strategy combines machine learning, behavioral analytics, curated signatures, and threat intelligence.
Incident response: AI-powered explainability, automated triage, and integrated response workflows provide context for containing threats and lowering MTTR.
Tool consolidation: Corelight says Open NDR combines network security monitoring, intrusion detection, static file analysis, and intelligent packet capture in one platform.
Integrations: The platform has native integrations with SIEM, XDR, SOAR, and cloud platforms including Splunk, CrowdStrike, Microsoft, Elastic, and AWS.
APIs: Logs API and an MCP server provide programmatic access for custom orchestration and management.
Deployment: Corelight offers physical, software, virtual, cloud, and flow-log sensors for on-premises, air-gapped, hybrid, and multicloud environments.
Cloud coverage: Cloud-native sensors support AWS, Azure, and Google Cloud, while software sensors support Linux-based systems.
Scale: Physical and software sensors are built to handle network environments at 100+ Gbps scale.
Security and compliance: Corelight maintains a dedicated security program and says select products are independently audited and certified to industry-leading compliance standards.
Federal certifications: Corelight states that its sensors comply with FIPS 140-2, are NIAP Common Criteria certified, and that the Open NDR Platform is FedRAMP Class C (Moderate) in process.
Audience: Corelight serves large enterprises and government agencies in more than fifteen countries.
Founded: 2016
Headquarters: San Francisco, California, USA

Where it ranks on Freedom251

Best Anomaly Detection Software in 2026#10 of 19

Is Corelight Open NDR yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Corelight Open NDR

Sources

corelight.com/platform/· checked 30 Sept 2026
corelight.com/platform/deployment-options· checked 30 Sept 2026
corelight.com/legal/trust-center· checked 30 Sept 2026
corelight.com/solutions/industry/federal· checked 30 Sept 2026
corelight.com/company/about-corelight· checked 30 Sept 2026
corelight.com/contact· checked 30 Sept 2026