Freedom251 › Threat Hunting Software
Corelight Open NDR
What Corelight Open NDR is
Corelight Open NDR turns network and cloud traffic into context-enriched evidence for security operations. It combines machine learning, behavioral analytics, curated signatures, and threat intelligence for detection, with AI-powered explainability, automated triage, and integrated response workflows to support threat containment. The platform brings together network security monitoring, intrusion detection, static file analysis, and intelligent packet capture. Native integrations connect it with SIEM, XDR, SOAR, and cloud platforms such as Splunk, CrowdStrike, Microsoft, Elastic, and AWS. A Logs API and MCP server provide programmatic access for custom orchestration and management. Deployment options include physical, software, virtual, cloud, and flow-log sensors for on-premises, air-gapped, hybrid, and multicloud environments. Cloud-native sensors support AWS, Azure, and Google Cloud, while software sensors support Linux-based systems. Physical and software sensors are built for environments at 100+ Gbps scale. Licensing is capacity-based and pricing is on request. Corelight serves large enterprises and government agencies in more than fifteen countries.
Who it suits
Corelight Open NDR suits large enterprises and government agencies seeking network and cloud traffic detection across on-premises, hybrid, or multicloud environments. Its deployment range includes air-gapped environments and Linux-based software sensors.
What it does well
- Combines four network security capabilities in one platform
- Supports cloud, physical, virtual, software, and flow-log sensors
- Integrates with SIEM, XDR, SOAR, and cloud platforms
- Logs API and MCP server support programmatic access
- Built for network environments at 100+ Gbps scale
What to know first
- Pricing is on request
- Licensing is capacity-based
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Custom | capacity-based licensing | On request |
As corelight.com lists them, read 30 Sept 2026. The maker's own page has the final word.
Getting started
- Visit the Corelight platform website.
- Choose a deployment approach from the physical, software, virtual, cloud, or flow-log sensor options.
- For cloud coverage, consider the cloud-native sensors for AWS, Azure, or Google Cloud; software sensors support Linux.
- Contact Corelight for capacity-based licensing and pricing.
- Select Standard or Enterprise support based on the listed support coverage.
Verdict
Corelight Open NDR combines detection, traffic analysis, and response workflows across several deployment types. Capacity-based licensing and request-only pricing mean buyers need to discuss terms directly.
Questions
How much does Corelight Open NDR cost?
Pricing is available on request. The Custom plan uses capacity-based licensing.
Which platforms and deployment options does it support?
Listed platforms are API, Linux, self-hosted, and web. Deployment options include physical, software, virtual, cloud, and flow-log sensors.
Which cloud environments are supported?
Cloud-native sensors support AWS, Azure, and Google Cloud. Software sensors support Linux-based systems.
What does it integrate with?
Native integrations cover SIEM, XDR, SOAR, and cloud platforms, including Splunk, CrowdStrike, Microsoft, Elastic, and AWS.
What support plans are available?
Standard and Enterprise include telephone and email support, software updates, security bulletins, an online support portal, and hardware replacement. Enterprise adds 24x7 availability and a one-hour P1 response SLA.
What compliance credentials does Corelight state?
Corelight says its sensors comply with FIPS 140-2 and are NIAP Common Criteria certified. The Open NDR Platform is FedRAMP Class C (Moderate) in process.
Facts from Corelight Open NDR's own pages
- APIs
- Logs API and an MCP server provide programmatic access for custom orchestration and management. · corelight.com, 30 Sept 2026
- Audience
- Corelight serves large enterprises and government agencies in more than fifteen countries. · corelight.com, 30 Sept 2026
- Cloud coverage
- Cloud-native sensors support AWS, Azure, and Google Cloud, while software sensors support Linux-based systems. · corelight.com, 30 Sept 2026
- Deployment
- Corelight offers physical, software, virtual, cloud, and flow-log sensors for on-premises, air-gapped, hybrid, and multicloud environments. · corelight.com, 30 Sept 2026
- Detection
- Its detection strategy combines machine learning, behavioral analytics, curated signatures, and threat intelligence. · corelight.com, 30 Sept 2026
- Federal certifications
- Corelight states that its sensors comply with FIPS 140-2, are NIAP Common Criteria certified, and that the Open NDR Platform is FedRAMP Class C (Moderate) in process. · corelight.com, 30 Sept 2026
- Founded
- 2016 · corelight.com, 28 Sept 2026
- Headquarters
- San Francisco, California, USA · corelight.com, 28 Sept 2026
- Incident response
- AI-powered explainability, automated triage, and integrated response workflows provide context for containing threats and lowering MTTR. · corelight.com, 30 Sept 2026
- Integrations
- The platform has native integrations with SIEM, XDR, SOAR, and cloud platforms including Splunk, CrowdStrike, Microsoft, Elastic, and AWS. · corelight.com, 30 Sept 2026
- Purpose
- Corelight Open NDR transforms raw network and cloud traffic into context-enriched, high-fidelity evidence for security operations. · corelight.com, 30 Sept 2026
- Scale
- Physical and software sensors are built to handle network environments at 100+ Gbps scale. · corelight.com, 30 Sept 2026
- Security and compliance
- Corelight maintains a dedicated security program and says select products are independently audited and certified to industry-leading compliance standards. · corelight.com, 30 Sept 2026
- Support
- Standard and Enterprise support plans include telephone and email support, software updates, security bulletins, an online support portal, and hardware replacement; Enterprise adds 24x7 availability and a one-hour P1 response SLA. · corelight.com, 30 Sept 2026
- Tool consolidation
- Corelight says Open NDR combines network security monitoring, intrusion detection, static file analysis, and intelligent packet capture in one platform. · corelight.com, 30 Sept 2026
Where Corelight Open NDR stands on Freedom251
- Threat Hunting Software#10 of 29
- Anomaly Detection Software#14 of 22